cc-safety-net 2.4.13 → 2.4.15

package/dist/chunks/index-gj6afr0n.js

@@ -0,0 +1,45 @@
+var Xs="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Fn="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",So="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Zs={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Co={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},a=Object.freeze({realpathAttempts:{cap:16384,...Zs},processedCandidateBytes:{cap:4194304,...Zs},pathEnvironmentExpansion:{cap:64,...Zs},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Co},trackedHeredocFiles:{cap:64,...Co},controlFlowStates:{cap:64,...Co},wrapperPeelIterations:{cap:20,...Co},derivedCommandShape:Co});class s extends Error{kind;name="AnalysisLimit";constructor(D){super(a[D].reason);this.kind=D}}function gn(){let D=new Map;return{counters:D,resolvedPaths:new Map,charge(N,z=1){let ee=(D.get(N)??0)+z;if(D.set(N,ee),ee>a[N].cap)throw new s(N)}}}var bg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function V(D){return ke(D.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function ke(D){return bg.reduce((N,z)=>N.replace(z,"<redacted>"),D.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function Ue(D){return Nc(D).reduceRight((N,z)=>`${N.slice(0,z.valueStart)}<redacted>${N.slice(z.valueEnd)}`,D)}function k(D){return ke(Ue(D))}function Ze(D){return Nc(D).map((N)=>D.slice(N.valueStart,N.valueEnd))}function Ge(D){return/[A-Za-z_][A-Za-z0-9_]*=/.test(D)}function Nc(D){return[...D.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((N)=>{let z=D[N.index-1];if(N.index>0&&z&&!/[\s"'([{]/.test(z))return[];let ee=N.index+N[0].length;if(ee>=D.length)return[];return[{valueStart:ee,valueEnd:Cg(D,ee)}]})}function Cg(D,N){if(D.startsWith("$(",N))return Sg(D,N);let z=D[N];if(z==='"'||z==="'"){for(let te=N+1;te<D.length;te++){if(z==='"'&&D[te]==="\\"){te++;continue}if(D[te]===z)return te+1}return D.length}let ee=N;while(ee<D.length&&!/\s/.test(D[ee]??""))ee++;return ee}function Sg(D,N){let z=0,ee;for(let te=N;te<D.length;te++){let he=D[te];if(ee){if(ee==='"'&&he==="\\"){te++;continue}if(he===ee)ee=void 0;continue}if(he==='"'||he==="'"){ee=he;continue}if(he==="$"&&D[te+1]==="("){z++,te++;continue}if(he!==")")continue;if(z--,z===0)return te+1}return D.length}var vg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Eg(D){let N=D.maxLen??200,z=D.redact??((te)=>te),ee=(te)=>te.length>N?`${te.slice(0,N)}...`:te;return[D.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${z(D.reason)}`,D.ruleId?`Rule: ${D.ruleId}`:void 0,D.toolName?`Tool: ${D.toolName}`:void 0,D.command?`Command: ${ee(z(D.command))}`:void 0,D.segment&&D.segment!==D.command?`Segment: ${ee(z(D.segment))}`:void 0,D.cwd?`Working directory: ${ee(z(D.cwd))}`:void 0,D.configWarning?`Config warning: ${z(D.configWarning)}`:void 0,D.askUser?"Approve only if you expected this command.":vg[D.intent??"manual_only"]].filter((te)=>te!==void 0).join(`
+
+`)}function ye(D,N){if(D.decision.kind!=="deny")return;let z=N.includeEvidence?D.decision.evidence:void 0;return{reason:D.decision.reason,ruleId:D.decision.ruleId,intent:D.decision.intent,command:z?.command,segment:z?.segment,toolName:N.toolName,...D.configFallback?{configWarning:D.configFallback.reason}:{},...D.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function P(D={}){return{reason:So,intent:"stop_and_explain",command:D.command,segment:D.segment??D.command,toolName:D.toolName}}var xg={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative"}}};function A(D,N={}){return{...xg[D.directory][D.problem],command:N.command,toolName:N.toolName,cwd:D.cwd}}function be(D){return Eg({...D,redact:V})}function Xe(D){return V(D instanceof Error?D.message:String(D))}import{lstatSync as ih,realpathSync as sh,statSync as ah}from"node:fs";import{homedir as lh,tmpdir as ch}from"node:os";import{statSync as nh}from"node:fs";import{join as rh}from"node:path";import{basename as Gc,dirname as Rg,isAbsolute as _g,join as wg,normalize as Pg,resolve as Lc}from"node:path";var Ag=256,hi=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function hn(D,N=process.platform){if(N!=="win32")return D;return D.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function nr(D,N=process.platform){if(N!=="win32")return!1;return(D[0]==="/"||D[0]==="\\")&&(D[1]==="/"||D[1]==="\\")}function ta(D,N){return Js(D,0,N)}function Js(D,N,z){let ee="",te=0;while(te<D.length){if(D[te]!=="$"){ee+=D[te],te++;continue}if(D[te+1]==="{"){let je=Qs(D,te+2),at=Tg(D,te,N);if(at===null){if(hi.has(je))throw new s("pathEnvironmentExpansion");ee+=D.slice(te);break}let lt=D.slice(te,at+1);ee+=Ig(lt,N,z),te=at+1;continue}let he=Qs(D,te+1);if(!he){ee+="$",te++;continue}ee+=ea(he,z)??`$${he}`,te+=he.length+1}return ee}function Tg(D,N,z){let ee=1;for(let te=N+2;te<D.length;te++){if(D[te]==="\\"){te++;continue}if(D[te]==="$"&&D[te+1]==="{"){if(ee++,z+ee>a.pathEnvironmentExpansion.cap)throw new s("pathEnvironmentExpansion");te++;continue}if(D[te]!=="}")continue;if(ee--,ee===0)return te}return null}function Ig(D,N,z){let ee=D.slice(2,-1),te=Qs(ee,0);if(!te)return D;let he=ee.slice(te.length);if(!he)return ea(te,z)??D;let je=[":-",":+",":=",":?","-","+","=","?"].find((ct)=>he.startsWith(ct));if(!je){if(hi.has(te))throw new s("pathEnvironmentExpansion");return D}if(!hi.has(te))return D;if(je.endsWith("="))throw new s("pathEnvironmentExpansion");let at=ea(te,z),lt=je.startsWith(":")?at!==null&&at!=="":at!==null;if(je.endsWith("?")&&!lt)throw new s("pathEnvironmentExpansion");if(je.endsWith("-")||je.endsWith("?"))return lt?at??"":Js(he.slice(je.length),N+1,z);return lt?Js(he.slice(je.length),N+1,z):""}function Qs(D,N){if(!/[A-Za-z_]/.test(D[N]??""))return"";let z=N+1;while(/[A-Za-z0-9_]/.test(D[z]??""))z++;return D.slice(N,z)}function ea(D,N){if(!hi.has(D))return null;if(D==="HOME")return N.env.get("HOME")??N.home;return N.env.get(D)??null}function Mt(D,N,z){if(!D)return D;let ee=z.resolvedPaths.get(D);if(ee!==void 0)return ee;let te=[],he=D;while(!0){Fc(z,he);let je=N.realpath(he);if(je!==null)return Wc(z,D,je,te);let at=Rg(he);if(at===he||te.length>=Ag)return Wc(z,D,he,te);te.push(Gc(he)),he=at}}function Wc(D,N,z,ee){let te=ee.length===0?z:wg(z,...ee.reverse());return D.resolvedPaths.set(N,te),te}function kg(D,N,z){let ee=z.resolvedPaths.get(D);if(ee!==void 0)return ee;Fc(z,D);let te=N.realpath(D);if(te!==null)z.resolvedPaths.set(D,te);return te}function Fc(D,N){D.charge("realpathAttempts"),D.charge("processedCandidateBytes",Buffer.byteLength(N))}function rn(D,N,z,ee){let te=Bc(D,N,z);if(!te)return"";return Mt(te,z.paths,ee).replace(/\\/g,"/")}function zc(D,N,z,ee,te){let he=Bc(D,N,z);if(!he)return null;if(te(Gc(he)))return Mt(he,z.paths,ee).replace(/\\/g,"/");let je=kg(he,z.paths,ee);return je===null?null:je.replace(/\\/g,"/")}function Bc(D,N,z){let ee=z.home,te=ta(D.trim(),z).replace(/\\/g,"/");if(!te)return"";let he=te==="~"?ee:te.startsWith("~/")?Lc(ee,te.slice(2)):te,je=hn(he);return Pg(_g(je)?je:Lc(N,je))}import{spawnSync as Og}from"node:child_process";import{existsSync as Eo,lstatSync as Mg,readFileSync as xo,realpathSync as $r,statSync as vo}from"node:fs";import{dirname as na,isAbsolute as ra,join as Ur,resolve as yi}from"node:path";var Dg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Ng=5000;function Uc(D,N=Jg(),z=Ng){let ee=Lg(D),te=ee===null?null:Wg(ee);if(ee===null||te===null)return null;let he=Zg(ee,te,N,z);return he===null?null:{recursiveSubmodules:he}}function Lg(D){try{let N=$r(yi(D));return vo(N).isDirectory()?N:null}catch{return null}}function Wg(D){let N=Yg(D);if(!N)return null;try{let z=Mg(N);if(z.isSymbolicLink()||!z.isFile())return null;let ee=oa(N);if(!ee?.commonDir)return null;if(!zg(ee.gitDir,N))return null;return Bg(ee.gitDir,na(N))?{gitDir:ee.gitDir,commonDir:ee.commonDir}:null}catch{return null}}function oa(D){try{let N=Gg(D);if(!N)return null;let z=$r(ra(N)?N:yi(na(D),N));if(!vo(z).isDirectory())return null;return{gitDir:z,commonDir:Fg(z)}}catch{return null}}function Gg(D){let N=xo(D,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!N.startsWith("gitdir:"))return null;return N.slice(7).trim()||null}function Fg(D){try{let N=xo(Ur(D,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!N)return null;let z=$r(ra(N)?N:yi(D,N));return vo(z).isDirectory()?z:null}catch{return null}}function zg(D,N){let z=$g(D);return z===null?!1:Hc(D,z,N)}function Bg(D,N){let z=Ug(D);return z===null?!0:Hc(D,z,N)}function $g(D){let N=Ur(D,"gitdir");if(!Eo(N))return null;let z=xo(N,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return z===""?null:z}function Ug(D){let N=Ur(D,"config.worktree");return Eo(N)?jg(N):null}function Hc(D,N,z){try{return Hg(ra(N)?N:yi(D,N),z)}catch{return!1}}function Hg(D,N){try{let z=vo(D),ee=vo(N);if(z.ino!==0&&ee.ino!==0&&z.dev===ee.dev&&z.ino===ee.ino)return!0}catch{}return $c($r.native(D))===$c($r.native(N))}function $c(D){let N=D.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),z=N.length>1&&N.endsWith("/")?N.slice(0,-1):N;return process.platform==="win32"?z.toLowerCase():z}function jg(D){let N=xo(D,"utf-8"),z=!1,ee=null;for(let te of N.split(/\r?\n/)){let he=te.trim();if(he===""||he.startsWith("#")||he.startsWith(";"))continue;if(he.startsWith("[")){z=/^\[core\]$/i.test(he);continue}if(!z)continue;let je=he.match(/^worktree\s*=\s*(.*)$/i);if(je)ee=Vg(je[1]??"")}return ee}function Vg(D){let N=D.trim();if(!N.startsWith('"')||!N.endsWith('"'))return N;return qg(N.slice(1,-1))}var Kg={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function qg(D){return D.replace(/\\(.?)/gs,(N,z)=>z===""?N:Kg[z]??N)}function Yg(D){try{return ia($r(D))}catch{return null}}function ia(D){let N=D;while(!0){let z=Ur(N,".git");if(Eo(z))return z;let ee=na(N);if(ee===N)return null;N=ee}}function Zg(D,N,z,ee){if(Xg(N))return!0;if(z===null)return!0;let te=Og(z,["config","--get","submodule.recurse"],{cwd:D,encoding:"utf8",env:Qg(process.env),stdio:["ignore","pipe","ignore"],timeout:ee});if(te.error!==void 0||te.status!==0&&te.status!==1)return null;return te.status===0&&jc(te.stdout.trim())}function Xg(D){return[Ur(D.commonDir,"config"),Ur(D.gitDir,"config.worktree")].filter((N)=>Eo(N)).some((N)=>eh(N))}function Jg(){return Dg.find((D)=>Eo(D))??null}function Ro(D){return D==="GIT_CONFIG_COUNT"||D==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(D)}function Qg(D){return Object.fromEntries(Object.entries(D).filter(([N])=>!Ro(N)))}function eh(D){let N;try{N=xo(D,"utf-8")}catch{return!0}let z="",ee=!1;for(let te of N.split(/\r?\n/)){let he=te.trim();if(he===""||he.startsWith("#")||he.startsWith(";"))continue;let je=he.match(/^\[([^\]]+)\]$/);if(je){z=je[1]?.trim().toLowerCase()??"";continue}let at=he.indexOf("="),lt=(at===-1?he:he.slice(0,at)).trim().toLowerCase(),ct=at===-1?"true":he.slice(at+1).trim();if(th(z)&&lt==="path")return!0;if(z==="submodule"&&lt==="recurse")ee=jc(ct)}return ee}function th(D){return D==="include"||D.startsWith("includeif ")}function jc(D){let N=D.toLowerCase();return N!=="false"&&N!=="no"&&N!=="off"&&N!=="0"}function Vc(D,N){if(D==="")return null;let z=gn(),ee=ia(rn(D,D,N,z)),te=ee?oh(ee,D,N,z):null;if(!te)return null;return Object.freeze({entries:Object.freeze([te.entry]),markerFiles:Object.freeze(te.markerFile?[te.markerFile]:[]),directories:Object.freeze(te.directories),hooksDirectories:Object.freeze(te.hooksDirectories)})}function oh(D,N,z,ee){try{let te=rn(D,N,z,ee),he=nh(D),je=he.isFile()?te:null,at=he.isFile()?oa(D):null,lt=(he.isDirectory()?[te]:[at?.gitDir,at?.commonDir]).flatMap((dt)=>dt?[Hr(rn(dt,N,z,ee))]:[]),ct=[...new Set(he.isDirectory()?[Hr(D.replace(/\\/g,"/")),...lt]:lt)];return{entry:Hr(te),markerFile:je?Hr(je):null,directories:ct,hooksDirectories:[...new Set(ct.flatMap((dt)=>{let ft=Hr(rh(dt,"hooks").replace(/\\/g,"/"));return[ft,Hr(rn(ft,N,z,ee))]}))]}}catch{return null}}function Hr(D){return process.platform==="win32"?D.toLowerCase():D}var uh={realpath:(D)=>{try{return sh(D)}catch{return null}},entryKind:(D)=>{let N=ih(D,{throwIfNoEntry:!1});if(!N)return"missing";return N.isSymbolicLink()?"symlink":"present"},isDirectory:(D)=>{try{return ah(D).isDirectory()}catch{return!1}}};function c(){return dh({env:new Map(Object.entries(process.env).flatMap(([D,N])=>N===void 0?[]:[[D,N]])),home:hn(process.env.HOME||lh()),tmpdir:ch(),paths:uh})}function dh(D,N={}){let z=new Map,ee=new Map,te={...D,gitMetadata:(he)=>Kc(z,he,()=>Vc(he,te)),worktreeFacts:(he)=>Kc(ee,he,()=>Uc(he)),...N};return te}function Kc(D,N,z){let ee=D.get(N);if(ee!==void 0)return ee;let te=z();return D.set(N,te),te}import{accessSync as Dh,constants as cu,statSync as Nh}from"node:fs";import{isAbsolute as du,relative as Lh,resolve as Wh,sep as Gh}from"node:path";import{types as fh}from"node:util";var mh=new Set(["applypatch","patch"]),ph=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),gh=new Set(["grep","grepsearch","rg"]),hh=new Set(["find","findbyname","glob"]),yh=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),bh=new Set(["command","diff","input","patch","patchtext"]),qc=new TextEncoder,Ch=new TextDecoder,Sh=/\s/,vh=64;class f extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var _o=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Qc(D){return D.replace(/[-_\s]/g,"").toLowerCase()}function Ci(D){return yh.has(Qc(D))}function q(D){let N=Qc(D);if(mh.has(N))return"patch";if(gh.has(N))return"grep";if(hh.has(N))return"glob";if(ph.has(N))return"path";return"unknown"}function ne(D){if(!D||typeof D!=="object")return;su(D);let N=Object.getOwnPropertyDescriptor(D,"command");if(!N){if("command"in D)zn();return}if(N.get||N.set)zn();let z=N.value;return typeof z==="string"&&z!==""?z:void 0}function eu(D,N){return tu(D,N,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function tu(D,N,z,ee,te){let he=iu(D,ee,te);if(typeof D==="string")return z?[D]:[];if(!he)return[];let je=he.entries.flatMap(([at,lt])=>tu(lt,N,he.array?z:N.has(nu(at)),ee,te+1));return ee.ancestors.delete(he.object),je}function nu(D){return D.replace(/-/g,"_").toLowerCase()}function ru(D){return ou(D,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(xh)}function ou(D,N,z,ee){let te=iu(D,z,ee);if(typeof D==="string")return N?[D]:[];if(!te)return[];let he=te.entries.flatMap(([je,at])=>ou(at,te.array?N:bh.has(nu(je)),z,ee+1));return z.ancestors.delete(te.object),he}function Eh(D,N,z){if(N.nodes++,D!==null&&typeof D==="object"&&z>_o.maxDepth||N.nodes>_o.maxNodes)zn();if(typeof D!=="string")return;let ee=Buffer.byteLength(D);if(N.stringBytes+=ee,ee>_o.maxStringBytes||N.stringBytes>_o.maxAggregateStringBytes)zn()}function iu(D,N,z){if(Eh(D,N,z),!D||typeof D!=="object")return null;let ee=su(D);if(N.ancestors.has(D))zn();let te=Reflect.ownKeys(D);if(N.keys+=te.length,N.keys>_o.maxKeys)zn();let he=te.flatMap((je)=>{let at=Object.getOwnPropertyDescriptor(D,je);if(!at||at.get||at.set)zn();return typeof je==="string"&&at.enumerable?[[je,at.value]]:[]});return N.ancestors.add(D),{object:D,array:ee,entries:he}}function su(D){if(fh.isProxy(D))zn();let N=Array.isArray(D),z=Object.getPrototypeOf(D);if(N&&z!==Array.prototype||!N&&z!==Object.prototype&&z!==null)zn();return N}function zn(){throw new f}function xh(D){let N=[],z=D.split(/\r?\n/),ee=!1,te=!1,he=null,je=null,at=()=>{te=!1,he=null,je=null};for(let lt=0;lt<z.length;lt++){let ct=z[lt]??"";if(ct==="*** Begin Patch"){ee=!0,at();continue}if(ct==="*** End Patch"){ee=!1,at();continue}if(ct.startsWith("@@")){let dt=Rh(ct);if(te=!0,he=dt?.oldLines??null,je=dt?.newLines??null,he===0&&je===0)at();continue}if(te&&he!==null&&je!==null){let dt=ct.startsWith(" ")||ct.startsWith("-")?1:0,ft=ct.startsWith(" ")||ct.startsWith("+")?1:0;if(he=Math.max(0,he-dt),je=Math.max(0,je-ft),he===0&&je===0)at();continue}if(ct.startsWith("*** ")){at(),N.push(...sa(ct));continue}if(te)continue;if(ct.startsWith("diff --git ")){N.push(...sa(ct));continue}if(ct.startsWith("--- ")){let dt=z[lt+1]??"";if(!dt.startsWith("+++ "))continue;N.push(...la(bi(ct.slice(4),!0),bi(dt.slice(4),!0))),lt++;continue}if(!ee)N.push(...sa(ct))}return N}function Rh(D){let N=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(D);if(!N)return null;return{oldLines:Number(N[1]??1),newLines:Number(N[2]??1)}}function sa(D){let N=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(D);if(N?.[1])return Jc(N[1]);let z=/^\*\*\* Move to: (.+)$/.exec(D);if(z?.[1])return Jc(z[1]);if(D.startsWith("diff --git "))return _h(D.slice(11));let ee=/^--- (.+)$/.exec(D);if(ee?.[1])return Xc(ee[1]);let te=/^\+\+\+ (.+)$/.exec(D);if(te?.[1])return Xc(te[1]);let he=/^(?:rename|copy) (?:from|to) (.+)$/.exec(D);if(he?.[1])return Oh(he[1]);return[]}function _h(D){let N=wh(D);if(N.length===2&&N[0]&&N[1])return la(N[0],N[1]);let z=Ph(D);return z?la(D.slice(z.oldStart,z.oldEnd),D.slice(z.newStart,z.newEnd)):[]}function wh(D){let N=[],z=0;while(z<D.length&&N.length<2){while(br(D[z]))z++;if(z>=D.length)break;let ee=D[z]==='"'||D[z]==="'"?D[z]:void 0;if(!ee){let he=z;while(z<D.length&&!br(D[z]))z++;N.push(D.slice(he,z));continue}let te=au(D,z,ee);if(!te)return[];N.push(te.value),z=te.end}while(br(D[z]))z++;return z===D.length?N:[]}function Ph(D){let N=0;while(N<D.length&&br(D[N]))N++;let z=D.length;while(z>N&&br(D[z-1]))z--;let ee=0,te=N;while(te<z){if(!br(D[te])){te++;continue}let he=te;while(te<z&&br(D[te]))te++;if(he===N||te===z)continue;if(ee++,ee>vh)zn();if(Ah(D,N,he,te,z))return{oldStart:N,oldEnd:he,newStart:te,newEnd:z}}return null}function Ah(D,N,z,ee,te){if(aa(D,N,z,ee,te))return!0;let he=Yc(D,"/",N,z),je=Yc(D,"/",ee,te);if(he<=N||je<=ee)return!1;if(aa(D,N,he,ee,je))return!1;return aa(D,he+1,z,je+1,te)}function aa(D,N,z,ee,te){if(z-N!==te-ee)return!1;for(let he=0;he<z-N;he++)if(D[N+he]!==D[ee+he])return!1;return!0}function Yc(D,N,z,ee){for(let te=z;te<ee;te++)if(D[te]===N)return te;return-1}function br(D){return D!==void 0&&Sh.test(D)}function au(D,N,z){let ee=[],te=N+1;while(te<D.length){let he=String.fromCodePoint(D.codePointAt(te)??0);if(he===z)return{value:Ch.decode(Uint8Array.from(ee)),end:te+1};if(he!=="\\"||z==="'"){ee.push(...qc.encode(he)),te+=he.length;continue}let je=D.slice(te+1),at=/^[0-7]{1,3}/.exec(je)?.[0];if(at){ee.push(Number.parseInt(at,8)),te+=at.length+1;continue}ee.push(...qc.encode(Th(je[0]??""))),te+=2}return null}function Th(D){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[D]??D}function Ih(D){return wo(Mh(D))}function la(D,N){if(D==="/dev/null")return Zc(N);if(N==="/dev/null")return Zc(D);if(D.startsWith("a/")&&N.startsWith("b/"))return[D.slice(2),N.slice(2)].flatMap(wo);let z=kh(D,N)??(D===N?lu(D):null);return[D,N,...z?[z]:[]].flatMap(wo)}function Zc(D){let N=lu(D);return[D,...N?[N]:[]].flatMap(wo)}function lu(D){let N=D.indexOf("/");return N>0&&N<D.length-1?D.slice(N+1):null}function kh(D,N){let z=D.indexOf("/"),ee=N.indexOf("/");if(z<1||ee<1)return null;if(D.slice(0,z)===N.slice(0,ee))return null;let te=D.slice(z+1);return te===N.slice(ee+1)?te:null}function Xc(D){return Ih(bi(D,!0))}function Oh(D){return wo(bi(D,!1))}function bi(D,N){let z=D.trim(),ee=z[0]==='"'||z[0]==="'"?z[0]:void 0;if(ee){let te=au(z,0,ee);if(te&&(N||z.slice(te.end).trim()===""))return te.value}return N?z.split("\t",1)[0]?.trim()??"":z}function Mh(D){return D.startsWith("a/")||D.startsWith("b/")?D.slice(2):D}function wo(D){return D===""||D==="/dev/null"?[]:[D]}function Jc(D){let N=D.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return N===""||N==="/dev/null"?[]:[N]}function ce(D){try{if(!Nh(D).isDirectory())return!1;return Dh(D,cu.R_OK|cu.X_OK),!0}catch{return!1}}function et(D,N,z){if(nr(D))return;let ee=N.flatMap((he)=>uu(he,z));if(!ee[0])return;let te=uu(du(D)?D:Wh(ee[0],D),z)[0];if(!te)return;return ee.some((he)=>Fh(te,he))?te:void 0}function uu(D,N){let z=N.realpath(D);if(z===null)return[];return N.isDirectory(z)?[z]:[]}function Fh(D,N){let z=Lh(N,D);return z===""||z!==".."&&!z.startsWith(`..${Gh}`)&&!du(z)}var zh=8388608;async function We(D){let N=[],z=0;for await(let ee of D){let te=typeof ee==="string"?Buffer.from(ee,"utf-8"):Buffer.from(ee.buffer,ee.byteOffset,ee.byteLength);if(z+=te.byteLength,z>zh)throw Bh(D),Error("hook input byte limit exceeded");N.push(te)}return Buffer.concat(N,z).toString("utf-8")}function Bh(D){let N=D.destroy??D.cancel;if(!N)return;try{Promise.resolve(N.call(D)).catch(()=>{})}catch{}}function d(D,N,z,ee,te){if(z.kind!=="command")return{toolName:D,input:N,route:z,context:ee};return{toolName:D,input:N,route:z,context:ee,command:te}}var jr=["fail_closed","paranoid_rm","paranoid_interpreters"],Si={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var o={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},vi=["standard","strict","paranoid"];function $h(D,N){if(!N)return D;return vi.indexOf(N)>vi.indexOf(D)?N:D}function Uh(D){let N=ve(o.level,D);if(N===void 0||N==="")return;if(vi.includes(N))return N;console.error(`CC Safety Net: ignored invalid ${o.level.name}=${JSON.stringify(N.slice(0,40))}. Use ${vi.join(", ")}.`);return}function He(D){if(D===void 0||D==="all")return"all";if(D==="blocked")return"blocked";return"invalid"}function xe(D){return He(ve(o.auditScope,D))==="all"}function ca(D){if(D.failClosed&&D.paranoidRm&&D.paranoidInterpreters)return"paranoid";if(D.failClosed&&!D.paranoidRm&&!D.paranoidInterpreters)return"strict";if(!D.failClosed&&!D.paranoidRm&&!D.paranoidInterpreters)return"standard";return"custom"}function R(D={},N){let z=D.safety?.level??"standard",ee=Uh(N),te=$h(z,ee),he=Si[te],je={failClosed:he.fail_closed,paranoidRm:he.paranoid_rm,paranoidInterpreters:he.paranoid_interpreters},at={failClosed:te===z?"preset":"environment",paranoidRm:te===z?"preset":"environment",paranoidInterpreters:te===z?"preset":"environment"},lt={failClosed:[`policy safety.level=${z}`],paranoidRm:[`policy safety.level=${z}`],paranoidInterpreters:[`policy safety.level=${z}`]};if(te!==z)lt.failClosed.push(`env ${o.level.name}=${ee}`),lt.paranoidRm.push(`env ${o.level.name}=${ee}`),lt.paranoidInterpreters.push(`env ${o.level.name}=${ee}`);if(D.safety?.overrides?.failClosed!==void 0)je.failClosed=D.safety.overrides.failClosed,at.failClosed="capability_override",lt.failClosed.push("policy safety.overrides.fail_closed");if(D.safety?.overrides?.paranoidRm!==void 0)je.paranoidRm=D.safety.overrides.paranoidRm,at.paranoidRm="capability_override",lt.paranoidRm.push("policy safety.overrides.paranoid_rm");if(D.safety?.overrides?.paranoidInterpreters!==void 0)je.paranoidInterpreters=D.safety.overrides.paranoidInterpreters,at.paranoidInterpreters="capability_override",lt.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(L(o.strict,N))je.failClosed=!0,at.failClosed="environment",lt.failClosed.push(`env ${o.strict.name}`);if(L(o.paranoid,N))je.paranoidRm=!0,je.paranoidInterpreters=!0,at.paranoidRm="environment",at.paranoidInterpreters="environment",lt.paranoidRm.push(`env ${o.paranoid.name}`),lt.paranoidInterpreters.push(`env ${o.paranoid.name}`);if(L(o.paranoidRm,N))je.paranoidRm=!0,at.paranoidRm="environment",lt.paranoidRm.push(`env ${o.paranoidRm.name}`);if(L(o.paranoidInterpreters,N))je.paranoidInterpreters=!0,at.paranoidInterpreters="environment",lt.paranoidInterpreters.push(`env ${o.paranoidInterpreters.name}`);let ct=!!D.worktreeMode||L(o.worktree,N);return{strict:je.failClosed,paranoidRm:je.paranoidRm,paranoidInterpreters:je.paranoidInterpreters,worktreeMode:ct,effectiveLevel:ca(je),capabilities:{fail_closed:{enabled:je.failClosed,source:at.failClosed,sources:lt.failClosed},paranoid_rm:{enabled:je.paranoidRm,source:at.paranoidRm,sources:lt.paranoidRm},paranoid_interpreters:{enabled:je.paranoidInterpreters,source:at.paranoidInterpreters,sources:lt.paranoidInterpreters}}}}function L(D,N){let z=typeof D==="string"?Po(D,N):ve(D,N);return z==="1"||z?.toLowerCase()==="true"}function Po(D,N){return N.get(D)}function ve(D,N){let z=Po(D.name,N);if(z!==void 0)return z;if(D.legacyName)return Po(D.legacyName,N);return}function Qe(D,N){return Po(D.name,N)!==void 0||!!D.legacyName&&Po(D.legacyName,N)!==void 0}import{dirname as xr}from"node:path";import{closeSync as Hh,constants as Ao,fstatSync as ua,fsyncSync as jh,lstatSync as xn,mkdirSync as fu,openSync as mu,readdirSync as fa,readFileSync as Vh,realpathSync as Vr,renameSync as Kh,rmdirSync as pu,statSync as da,unlinkSync as ma,writeFileSync as qh}from"node:fs";import{isAbsolute as gu,join as Cr,normalize as Yh,parse as Ei,relative as pa,resolve as ga,sep as xi}from"node:path";function Re(){let D=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${D()}${D()}`}var Zh=Symbol("PolicyFilesystemScope"),Xh=Symbol("PolicyFilesystemTarget"),hu=Ao.O_NOFOLLOW??0;class r extends Error{name="PolicyFilesystemError";constructor(D){super(`Unable to access ${D} filesystem safely.`)}}function v(D,N){return{[Zh]:!0,root:ga(D),label:N}}function To(D,N){let z=Yh(N);if(N===""||gu(N)||z===".."||z.startsWith(`..${xi}`))throw new r(D.label);return{[Xh]:!0,scope:D,relativePath:z,path:Cr(D.root,z)}}function i(D,N){return To(D,pa(D.root,ga(N)))}function re(D,N="rules policy"){let z=ga(D),ee=Ei(z).dir;return To(v(ee,N),pa(ee,z))}function n(D){return Vn(D.scope.label,()=>{if(!Zt(D))return null;let N=mu(D.path,Ao.O_RDONLY|hu);return bu(N,()=>{let z=ua(N);if(!z.isFile())throw new r(D.scope.label);let ee=Vh(N,"utf-8"),te=xn(D.path);if(!te.isFile()||te.isSymbolicLink()||z.dev!==te.dev||z.ino!==te.ino)throw new r(D.scope.label);return Zt(D),ee})})}function g(D,N,z=384,ee){let te=`${D.path}.${Re()}.tmp`;Vn(D.scope.label,()=>{Qh(D),Zt(D);let he=mu(te,Ao.O_CREAT|Ao.O_EXCL|Ao.O_WRONLY|hu,z),je=bu(he,()=>{let at=ua(he);if(!at.isFile())throw new r(D.scope.label);qh(he,N,"utf-8"),jh(he);let lt=ua(he);if(!lt.isFile()||lt.dev!==at.dev||lt.ino!==at.ino)throw new r(D.scope.label);return lt});Zt(D),ty(D,te,je.dev,je.ino),Kh(te,D.path),ee?.(D.path),Zt(D)},()=>ny(te))}function yu(D,N){if(D.path===N.path)return!0;return Vn(D.scope.label,()=>{if(!Zt(D)||!Zt(N))return!1;let z=(ee)=>Cr(Vr(Ei(ee).dir),Ei(ee).base);return z(D.path)===z(N.path)})}function le(D){let N=Vn(D.scope.label,()=>{if(!Zt(D,"directory"))return null;let z=fa(D.path);return Zt(D,"directory"),z});if(!N)return null;return Vn(D.scope.label,()=>{let z=N.map((ee)=>{let te=To(D.scope,Cr(D.relativePath,ee)),he=xn(te.path);if(he.isSymbolicLink()||!he.isFile()&&!he.isDirectory())throw new r(D.scope.label);return Ri(ha(D.scope),Vr(te.path),D.scope.label),{name:ee,kind:he.isDirectory()?"directory":"file"}});return Zt(D,"directory"),z})}function F(D){Vn(D.scope.label,()=>{if(!Zt(D))return;ma(D.path),Zt(D)})}function tt(D){Vn(D.scope.label,()=>{if(!Jh(D))return;Su(D),Zt(D,"directory")})}function nt(D){Vn(D.scope.label,()=>{if(!Zt(D,"directory"))return;pu(D.path),Zt(D,"directory")})}function Jh(D){return Vn(D.scope.label,()=>{if(!Zt(D,"directory"))return!1;return Cu(D),!0})}function Vn(D,N,z){try{return N()}catch(ee){if(z?.(),ee instanceof r)throw ee;throw new r(D)}}function bu(D,N){try{return N()}finally{Hh(D)}}function Zt(D,N="file"){let z=vu(D.scope);if(!z)return!1;let ee=D.relativePath.split(xi);for(let te of ee.keys()){let he=Cr(D.scope.root,...ee.slice(0,te+1)),je=xn(he,{throwIfNoEntry:!1});if(!je)return!1;if(je.isSymbolicLink())throw new r(D.scope.label);if(te<ee.length-1&&!je.isDirectory())throw new r(D.scope.label);if(te===ee.length-1&&(N==="file"?!je.isFile():!je.isDirectory()))throw new r(D.scope.label);Ri(z,Vr(he),D.scope.label)}return!0}function Cu(D){for(let N of fa(D.path)){let z=To(D.scope,Cr(D.relativePath,N)),ee=xn(z.path);if(ee.isSymbolicLink()||!ee.isDirectory()&&!ee.isFile())throw new r(D.scope.label);if(ee.isDirectory())Cu(z)}Zt(D,"directory")}function Su(D){for(let N of fa(D.path)){let z=To(D.scope,Cr(D.relativePath,N)),ee=xn(z.path);if(ee.isSymbolicLink())throw new r(D.scope.label);if(ee.isDirectory()){Su(z);continue}if(!ee.isFile())throw new r(D.scope.label);ma(z.path)}pu(D.path)}function Qh(D){ey(D.scope);let N=ha(D.scope),z=D.relativePath.split(xi).slice(0,-1);for(let ee of z.keys()){let te=Cr(D.scope.root,...z.slice(0,ee+1));if(!xn(te,{throwIfNoEntry:!1}))fu(te,{mode:448});let he=xn(te);if(!he.isDirectory()||he.isSymbolicLink())throw new r(D.scope.label);Ri(N,Vr(te),D.scope.label)}}function ey(D){if(xn(D.root,{throwIfNoEntry:!1})){if(!da(D.root).isDirectory())throw new r(D.label);return}let N=[],z=D.root;while(!xn(z,{throwIfNoEntry:!1})){N.unshift(z);let ee=Ei(z).dir;if(ee===z)throw new r(D.label);z=ee}if(!da(z).isDirectory())throw new r(D.label);for(let ee of N){fu(ee,{mode:448});let te=xn(ee);if(!te.isDirectory()||te.isSymbolicLink())throw new r(D.label)}}function vu(D){if(!xn(D.root,{throwIfNoEntry:!1}))return null;if(!da(D.root).isDirectory())throw new r(D.label);return Vr(D.root)}function ha(D){let N=vu(D);if(!N)throw new r(D.label);return N}function ty(D,N,z,ee){let te=xn(N);if(!te.isFile()||te.isSymbolicLink()||te.dev!==z||te.ino!==ee)throw new r(D.scope.label);Ri(ha(D.scope),Vr(N),D.scope.label)}function Ri(D,N,z){let ee=pa(D,N);if(ee===".."||ee.startsWith(`..${xi}`)||gu(ee))throw new r(z)}function ny(D){try{ma(D)}catch{}}import{dirname as Sr,isAbsolute as ay,join as Er,relative as ly,resolve as vr,sep as cy}from"node:path";var l=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,ue="rulebook.json",de=".cc-safety-net/rules";var Eu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,ry=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,xu=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,oy=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),iy="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),rt=new RegExp(`^${oy}/(${l.source.slice(1,-1)})/${iy}$`);function sy(D){return`.cc-safety-net/rules/${D}/rulebook.json`}function Ru(D){if(S(D))try{return I(D),null}catch(N){return N instanceof Error?N.message:String(N)}return l.test(D)?null:`Local rulebook sources must be bare names matching ${l}: ${D}`}function I(D){if(D.startsWith("github:"))throw Error(`Invalid rulebook source: ${D}`);let N=D.match(Eu);if(!N?.[1]||!N[2]||!N[3])throw Error(`Invalid GitHub rulebook source: ${D}`);let z=N[3].lastIndexOf("/");if(z<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${D}`);let ee=N[3].slice(0,z),te=N[3].slice(z+1);if(!ee||!xu.test(ee))throw Error(`GitHub rulebook refs must use valid path segments: ${D}`);if(!te||!l.test(te))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${D}`);return{owner:N[1],repo:N[2],ref:ee,path:sy(te),name:te}}function K(D){return ry.test(D)}function oe(D){return xu.test(D)}function S(D){return Eu.test(D)}function ot(D){if(!l.test(D))throw Error(`Local rulebook sources must be bare names matching ${l}: ${D}`)}var _u="rule.json",_i="policy.json",wu=".cc-safety-net",uy="rules",dy="CC_SAFETY_NET_HOME",Pu="`cc-safety-net rule update`";function fy(D){return vr(D,de)}function M(D){return Er(fy(D),_u)}function b(D){return Er(vr(D),wu,_i)}function Se(D,N={}){return N.userConfigDir??(N.userConfigPath?Sr(N.userConfigPath):Er(my(D),uy))}function my(D){let N=D.env.get(dy);return N?vr(hn(N)):Er(D.home,wu)}function j(D,N={}){return Er(Se(D,N),_u)}function u(D,N={}){return Er(Sr(Se(D,N)),_i)}function J(D,N){let z=N.userConfigPath??j(D,N),ee=N.projectConfigPath??M(N.cwd),te=Be(D,N),he=ze(ee,N.cwd);return{userConfigPath:z,projectConfigPath:ee,userScope:te,projectScope:he,userConfigTarget:i(te,z),projectConfigTarget:i(he,ee)}}function Be(D,N){let z=N.userConfigPath?Sr(Sr(vr(N.userConfigPath))):Sr(vr(N.userConfigDir??Se(D,N)));return v(z,"user policy")}function ze(D,N){let z=vr(N),ee=vr(D),te=ly(z,ee);if(te!==".."&&!te.startsWith(`..${cy}`)&&!ay(te))return v(z,"project policy");return v(Sr(Sr(ee)),"project policy")}function O(D,N){return Er(D,N,ue)}var yn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),w=/^[a-zA-Z][a-zA-Z0-9_-]*$/,T=256,Ht=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Au=new Set(["python","python3","python2","node","ruby","perl"]),wi=/^python(?:[23](?:\.\d+)*)?$/,Rn=new Set(["awk","gawk","nawk","mawk"]),Pi=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Tu="Rulebook exceeds CC Safety Net's safe validation limits.",Iu="Additional rulebook validation errors were omitted.",An=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function ku(D){if(ya(D.allowed_commands,An.maxAllowedCommands)||ya(D.rules,An.maxRules)||ya(D.tests,An.maxTests))return!1;let{maxAggregateStringCodeUnits:N,maxTotalBlockArgs:z}=An,ee=(te,he=!1)=>{if(typeof te!=="string")return!0;if(te.length>An.maxStringCodeUnits||he&&te.length>An.maxFixtureCommandCodeUnits||te.length>N)return!1;return N-=te.length,!0};if(!ee(D.name)||!ee(D.version)||!ee(D.description)||!ee(D.author)||!ee(D.migrated_from))return!1;if(Array.isArray(D.allowed_commands)){for(let te of D.allowed_commands)if(!ee(te))return!1}if(Array.isArray(D.rules))for(let te of D.rules){if(!te||typeof te!=="object")continue;let he=te;if(!ee(he.name)||!ee(he.command)||!ee(he.subcommand)||!ee(he.reason)||!ee(he.intent))return!1;let je=he.match&&typeof he.match==="object"?he.match:{};for(let at of[he.block_args,je.command_path,je.any_args,je.exclude_args]){if(!Array.isArray(at))continue;if(at.length>An.maxBlockArgsPerRule||at.length>z)return!1;z-=at.length;for(let lt of at)if(!ee(lt))return!1}}if(Array.isArray(D.tests))for(let te of D.tests){if(!te||typeof te!=="object")continue;let he=te;if(!ee(he.command,!0)||!ee(he.expect)||!ee(he.rule))return!1}return!0}function ya(D,N){return Array.isArray(D)&&D.length>N}var ba=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var pe=64,fe="Rule config exceeds CC Safety Net's safe source limit.";function It(D){return Pt(D).toLowerCase()}function Pt(D){return D.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??D}function an(D,N){let z=new Set,ee=!1;for(let te of D){if(te==="--"){ee=!0;continue}if(ee)continue;if(te.startsWith("-")&&!te.startsWith("--")&&te.length>1)for(let he=1;he<te.length;he++){let je=te[he];if(!je||!/[a-zA-Z]/.test(je))break;let at=`-${je}`;if(z.add(at),N?.shortOptsWithValue?.has(at))break}}return z}var py={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Ca=new Set(["--init-file","--rcfile"]);function Sa(D,N,z,ee){let te=!1,he=0,je=!1,at=!1,lt=!1;for(let ct=1;ct<N.length;ct++){let dt=N[ct];if(dt===void 0)break;if(D==="ksh"&&dt==="o"&&ct+1<N.length){if(ee==="argv"){let ft=N.slice(ct+1);if(N[0]==="-"&&(ft==="c"||ft[0]==="-"&&ft.endsWith("c")))je=!0}break}if(D==="ksh"&&dt==="o"&&ct+1===N.length&&(z?.startsWith("-")||z?.startsWith("+")))break;if(D==="zsh"&&dt==="o"&&ct+1<N.length)break;if(ee==="startup"&&dt==="i")te=N[0]==="-";if(ee==="argv"&&N[0]==="-"&&dt==="c")je=!0;if(ee==="argv"&&dt==="n")lt=N[0]==="-";if(ee==="argv"&&dt==="s")at=N[0]==="-";if(!py[D]?.includes(dt))continue;if(ct+1===N.length)he++;break}return{interactive:te,followingValues:he,commandSelected:je,stdinMode:at,syntaxCheck:lt}}function bn(D){let N=Pt(D[0]??"").toLowerCase(),z=!1,ee=!1,te=!1;for(let he=1;he<D.length;he++){let je=D[he];if(je===void 0)break;if(je==="--"){let lt=z&&D[he+1]!==void 0?he+1:null;return{command:lt===null?null:D[lt]??null,commandIndex:lt,scriptIndex:!z&&!ee&&D[he+1]!==void 0?he+1:null,readsStdinAsCommands:!z&&(ee||D[he+1]===void 0),syntaxCheck:te}}if(je==="-"||je[0]!=="-"&&je[0]!=="+")return{command:z?je:null,commandIndex:z?he:null,scriptIndex:!z&&!ee&&je!=="-"?he:null,readsStdinAsCommands:!z&&(ee||je==="-"),syntaxCheck:te};if(je.startsWith("--")){let lt=je.split("=",1)[0]??je;if(N==="bash"&&Ca.has(lt)&&!je.includes("="))he++;continue}let at=Sa(N,je,D[he+1],"argv");if(at.commandSelected)z=!0;if(at.syntaxCheck)te=!0;if(at.stdinMode)ee=!0;he+=at.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!z,syntaxCheck:te}}function Io(D,N){if(N.escaped)return N.escaped=!1,!0;if(D==="\\"&&!N.inSingle)return N.escaped=!0,!0;if(D==="'"&&!N.inDouble)return N.inSingle=!N.inSingle,!0;if(D==='"'&&!N.inSingle)return N.inDouble=!N.inDouble,!0;return!1}function Ai(D){let N={inSingle:!1,inDouble:!1,escaped:!1};for(let z of gy(D))Io(z,N);return N.inSingle||N.inDouble}function gy(D){let N="",z={inSingle:!1,inDouble:!1,escaped:!1},ee=!1,te=!0;for(let he=0;he<D.length;he++){let je=D[he];if(!je)break;if(ee){if(je===`
+`||je==="\r")N+=je,ee=!1,z.escaped=!1;continue}if(je==="#"&&!z.inSingle&&!z.inDouble&&te){ee=!0;continue}if(N+=je,!z.inSingle&&!z.inDouble&&!z.escaped)te=/[\s;&|()<>]/.test(je);Io(je,z)}return N}var va=new Set(["rm","find","xargs","parallel"]),hy=new Set(["git","busybox",...va,...Ht,...Au,...Rn]),yy=new Set(["python","node","ruby","perl"]);function Le(D){let N=It(D);return hy.has(N)||Tn(N)}function Tn(D){return yy.has(by(D))}function by(D){let N=Pt(D).toLowerCase();return wi.test(N)?"python":N}var it={version:1,rules:[],overrides:{},transparent_wrappers:[]};function m(D){try{let N=n(Cy(D));if(N===null)return{config:null,errors:[]};if(!N.trim())return{config:null,errors:["Config file is empty"]};let z=JSON.parse(N),ee=Ve(z);if(ee.errors.length>0)return{config:null,errors:ee.errors};return{config:{version:1,rules:z.rules??[],overrides:z.overrides??{},transparent_wrappers:z.transparent_wrappers??[]},errors:[]}}catch(N){if(N instanceof r)return{config:null,errors:[N.message]};let z=N instanceof Error?N.message:String(N);return{config:null,errors:[N instanceof SyntaxError?"Invalid JSON":z]}}}function Cy(D){return typeof D==="string"?re(D):D}var e=(D,N)=>({path:D,message:N,kind:"typed"}),Xt=(D,N)=>({path:D,message:N,kind:"custom"});function Te(D){let N=new Set;return D.flatMap((z,ee)=>{let te=Kr(z)?z.name:void 0;if(typeof te!=="string")return[];if(N.has(te.toLowerCase()))return[Xt(["rules",ee,"name"],`duplicate rule name "${te}"`)];return N.add(te.toLowerCase()),[]})}var we=`must be one of ${ba.join(", ")}`,Sy=/^[^/]+\/[^/]+$/,vy=["version","rules","overrides","transparent_wrappers"];function Ve(D){let N=Ey(D);return{errors:ie(qe(N,vy,(z)=>z.kind==="custom"),": "," "),sources:Iy(D,N)}}function Ey(D){if(!Kr(D))return[e([],"Config must be an object")];let N=Array.isArray(D.rules)&&D.rules.length>pe;return[...D.version===1?[]:[e(["version"],"must be 1")],...xy(D.rules,N),...wy(D.overrides),...Ay(D.transparent_wrappers),...N?[]:_y(D.rules),...Kr(D.overrides)?Object.keys(D.overrides).filter((z)=>!Sy.test(z)).map((z)=>Xt(["overrides",z],"must use <rulebook-name>/<rule-name>")):[],...Ty(D.transparent_wrappers)]}function xy(D,N){if(D===void 0)return[];if(!Array.isArray(D))return[e(["rules"],"must be an array of rulebook source strings"),...Ou(D,pe)?[e(["rules"],fe)]:[]];if(N)return[{path:["rules"],message:fe,kind:"limit"}];return D.flatMap((z,ee)=>{if(typeof z!=="string")return[e(["rules",ee],"must be a rulebook source string"),...Ry(z,1)?[e(["rules",ee],"must be a non-empty rulebook source string")]:[]];return z===""?[e(["rules",ee],"must be a non-empty rulebook source string")]:[]})}function Ou(D,N){let z=Mu(D);return z!==void 0&&!(z<=N)}function Ry(D,N){let z=Mu(D);return z!==void 0&&!(z>=N)}function Mu(D){if(D===null||D===void 0)return;let N=D.length;return N===void 0?void 0:Number(N)}function _y(D){if(!Array.isArray(D))return[];let N=new Set;return D.flatMap((z,ee)=>{if(typeof z!=="string"||z==="")return[];if(z.trim()==="")return[Xt(["rules",ee],"must be a non-empty rulebook source string")];let te=Ru(z);if(te)return[Xt(["rules",ee],te)];if(N.has(z))return[Xt(["rules",ee],`duplicate rulebook source "${z}"`)];return N.add(z),[]})}function wy(D){if(D===void 0)return[];if(!Kr(D))return[e(["overrides"],"must be an object if provided")];return Object.keys(D).flatMap((N)=>{let z=D[N];if(z==="off")return[];if(!Kr(z))return[e(["overrides",N],'must be "off" or an object')];return[...Py(z.reason,["overrides",N,"reason"]),...z.intent===void 0||Ce(z.intent)?[]:[e(["overrides",N,"intent"],we)]]})}function Py(D,N){if(typeof D!=="string")return[e(N,"required non-empty string"),...Ou(D,T)?[e(N,`must be at most ${T} characters`)]:[]];if(D==="")return[e(N,"required non-empty string")];return D.length>T?[e(N,`must be at most ${T} characters`)]:[]}function Ay(D){if(D===void 0)return[];if(!Array.isArray(D))return[e(["transparent_wrappers"],"must be an array of command strings")];return D.flatMap((N,z)=>{if(typeof N!=="string")return[e(["transparent_wrappers",z],"must be a command string")];return w.test(N)?[]:[e(["transparent_wrappers",z],"must match command pattern")]})}function Ty(D){if(!Array.isArray(D))return[];let N=new Set;return D.flatMap((z,ee)=>{if(typeof z!=="string"||!w.test(z))return[];if(N.has(z))return[Xt(["transparent_wrappers",ee],`duplicate command "${z}"`)];if(Le(z))return[Xt(["transparent_wrappers",ee],`reserved command "${z}" cannot be a wrapper`)];return N.add(z),[]})}function Iy(D,N){let z=Kr(D)?D.rules:void 0;if(!Array.isArray(z))return new Set;if(N.some((te)=>te.path.length===1&&te.path[0]==="rules"))return new Set;let ee=new Set(N.filter((te)=>te.path[0]==="rules"&&typeof te.path[1]==="number").map((te)=>te.path[1]));return new Set(z.filter((te,he)=>typeof te==="string"&&!ee.has(he)))}function qe(D,N,z){let ee=D.map((je)=>je.path[1]),te=[...new Set(ee.filter((je)=>typeof je==="string"))],he=(je,at)=>[je.path.length===0?-1:N.indexOf(String(je.path[0])),typeof at==="number"?at:te.indexOf(String(at)),z(je)?0:1];return D.map((je,at)=>({issue:je,rank:he(je,ee[at])})).sort((je,at)=>je.rank[0]-at.rank[0]||je.rank[1]-at.rank[1]||je.rank[2]-at.rank[2]).map((je)=>je.issue)}function ie(D,N,z){return[...new Set(D.map((ee)=>{let te=Ea(ee.path);if(ee.kind==="unknownKeys")return`${te?`${te}.`:""}unknown field "${ee.message}"`;if(ee.kind==="key"||ee.kind==="limit"||ee.path.length===0)return ee.message;return`${te}${ee.path.length===1?z:N}${ee.message}`}))]}function Ea(D){return D.map((N,z)=>{if(typeof N==="number")return`[${N}]`;return z===0?String(N):`.${String(N)}`}).join("")}function Ce(D){return ba.includes(D)}function Kr(D){return!!D&&typeof D==="object"&&!Array.isArray(D)}function se(D){let N=My(D);if(N.errors.length>0)throw Error(N.errors.join("; "));return D}var ky=`required non-empty string up to ${T} characters`,Du="must be a non-empty array of unique non-empty strings",Oy="required non-empty array of non-empty strings";function My(D){if(!rr(D))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!ku(D))return{errors:[Tu],ruleNames:new Set};let N=[...D.rulebook_version===1||D.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ie(Dy(D,D.rulebook_version===2),": ",": ")];return{errors:N.length>An.maxValidationErrors?[...N.slice(0,An.maxValidationErrors),Iu]:N,ruleNames:new Set(_e(D).map((z)=>z.toLowerCase()))}}function _e(D){let N=rr(D)?D.rules:void 0;return(Array.isArray(N)?N:[]).flatMap((z)=>{let ee=rr(z)?z.name:void 0;return typeof ee==="string"?[ee]:[]})}function Dy(D,N){return[...typeof D.name==="string"&&l.test(D.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof D.version==="string"&&D.version!==""?[]:[e(["version"],"required non-empty string")],...Ny(D.allowed_commands),...Ly(D.rules,N),...zy(D.tests),...By(D),...$y(D)]}function Ny(D){if(!Array.isArray(D))return[e(["allowed_commands"],"required array")];let N=new Set;return[...D.flatMap((z,ee)=>typeof z==="string"&&w.test(z)?[]:[e(["allowed_commands",ee],"must match command pattern")]),...D.flatMap((z,ee)=>{if(typeof z!=="string"||!w.test(z))return[];if(N.has(z))return[Xt(["allowed_commands",ee],`duplicate command "${z}"`)];return N.add(z),[]})]}function Ly(D,N){if(!Array.isArray(D))return[e(["rules"],"required array")];return[...D.flatMap((z,ee)=>{if(!rr(z))return[e(["rules",ee],"must be an object")];return N?Gy(z,["rules",ee]):Wy(z,["rules",ee])}),...Te(D)]}function Wy(D,N){return[...Nu(D.name,N),...Lu(D.command,N),...D.subcommand===void 0||typeof D.subcommand==="string"&&w.test(D.subcommand)?[]:[e([...N,"subcommand"],"must match command pattern")],...Ti(D.block_args,[...N,"block_args"],"required non-empty array",!1),...Wu(D.reason,N),...Gu(D.intent,N)]}function Gy(D,N){return[...Nu(D.name,N),...Lu(D.command,N),...Wu(D.reason,N),...Gu(D.intent,N),...Fy(D.match,[...N,"match"]),...D.subcommand===void 0?[]:[e([...N,"subcommand"],"not supported in rulebook_version 2")],...D.block_args===void 0?[]:[e([...N,"block_args"],"not supported in rulebook_version 2")]]}function Nu(D,N){if(typeof D!=="string")return[e([...N,"name"],"required string")];return l.test(D)?[]:[e([...N,"name"],"must match rule name pattern")]}function Lu(D,N){return typeof D==="string"&&w.test(D)?[]:[e([...N,"command"],"required string matching command pattern")]}function Wu(D,N){return typeof D==="string"&&D!==""&&D.length<=T?[]:[e([...N,"reason"],ky)]}function Gu(D,N){return D===void 0||Ce(D)?[]:[e([...N,"intent"],we)]}function Fy(D,N){if(!rr(D))return[e(N,"required object")];return[...Ti(D.command_path,[...N,"command_path"],Oy,!1),...D.any_args===void 0?[]:Ti(D.any_args,[...N,"any_args"],Du,!0),...D.exclude_args===void 0?[]:Ti(D.exclude_args,[...N,"exclude_args"],Du,!0)]}function Ti(D,N,z,ee){if(!Array.isArray(D))return[e(N,z)];let te=D.flatMap((he,je)=>{if(typeof he!=="string")return[e([...N,je],"must be a non-empty string")];return he===""?[Xt([...N,je],"must be a non-empty string")]:[]});if(D.some((he)=>typeof he!=="string"))return te;return[...te,...D.length===0?[Xt(N,z)]:[],...ee&&new Set(D).size!==D.length?[Xt(N,"must not contain duplicate values")]:[]]}function zy(D){if(D===void 0)return[];if(!Array.isArray(D))return[e(["tests"],"must be an array if provided")];return D.flatMap((N,z)=>{if(!rr(N))return[e(["tests",z],"must be an object")];return[...typeof N.command==="string"&&N.command.trim()!==""?[]:[e(["tests",z,"command"],"required non-empty string")],...N.expect==="blocked"||N.expect==="allowed"?[]:[e(["tests",z,"expect"],'must be "blocked" or "allowed"')],...N.rule===void 0||typeof N.rule==="string"?[]:[e(["tests",z,"rule"],"must be a string if provided")],...N.expect==="blocked"&&typeof N.rule!=="string"?[Xt(["tests",z,"rule"],"required string for blocked fixtures")]:[]]})}function By(D){if(!Array.isArray(D.tests))return[];let N=new Set(_e(D));return[...new Set(D.tests.flatMap((z)=>rr(z)&&z.expect==="blocked"&&typeof z.rule==="string"?[z.rule]:[]))].filter((z)=>!N.has(z)).map((z)=>Xt(["tests"],`blocked fixture references unknown rule "${z}"`))}function $y(D){if(!Array.isArray(D.allowed_commands)||!Array.isArray(D.rules))return[];let N=new Set(D.allowed_commands.filter((z)=>typeof z==="string"));return D.rules.flatMap((z,ee)=>{let te=rr(z)?z.command:void 0;if(typeof te!=="string"||N.has(te))return[];return[Xt(["rules",ee,"command"],`"${te}" must be listed in allowed_commands`)]})}function rr(D){return!!D&&typeof D==="object"&&!Array.isArray(D)}function Y(D,N){let z=J(D,N),ee;try{ee=yu(z.userConfigTarget,z.projectConfigTarget)}catch(mt){if(mt instanceof r)return Xy(z,mt.message);throw mt}let te=m(z.userConfigTarget),he=ee?{config:null,errors:[]}:m(z.projectConfigTarget),je=zu(z.userConfigPath,te.errors),at=zu(z.projectConfigPath,he.errors),lt=new Set,ct=te.config?xa(te.config,xr(z.userConfigPath),"user",z.userScope,lt):Bu(),dt=he.config?xa(he.config,xr(z.projectConfigPath),"project",z.projectScope,lt):Bu(),ft=te.config?.overrides??{},ut=he.config?.overrides??{};return{rules:[...Fu(ct.rules,ft),...Fu(dt.rules,ut)],transparent_wrappers:Yy(te.config,he.config),rulebooks:[...ct.rulebooks,...dt.rulebooks],errors:[...je,...at,...ct.errors,...dt.errors],warnings:[...ct.warnings,...dt.warnings,...ct.canValidateOverrides?Ra(ft,ct.knownRuleIds,z.userConfigPath):[],...ct.canValidateOverrides?Zy(ut,ct.knownRuleIds,z.projectConfigPath):[],...dt.canValidateOverrides?Ra(ut,dt.knownRuleIds,z.projectConfigPath):[]],userConfig:te.config??void 0,projectConfig:he.config??void 0,...z}}function U(D,N){let z=Uy(D,N);if(!z)return[];return[...z.scope.errors,...z.scope.warnings,...Hy(z.config,z.scope,D)]}function Uy(D,N){let z=N??v(xr(xr(D)),"rules policy"),ee=m(i(z,D)).config;if(!ee)return null;return{config:ee,scope:xa(ee,xr(D),"project",z)}}function Hy(D,N,z){return N.canValidateOverrides?Ra(D.overrides??{},N.knownRuleIds,z):[]}function xa(D,N,z,ee=v(xr(xr(N)),z==="user"?"user policy":"project policy"),te=new Set){let he=[],je=[],at=D.rules.flatMap((ct)=>{let dt=Vy(ct,N,ee);if(dt.errors.length>0||!dt.rulebook)return he.push(...dt.errors),[];let ft=dt.rulebook;if(te.has(ft.name))return je.push(`duplicate active rulebook name "${ft.name}" for ${ct}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return te.add(ft.name),[{rules:jy(ft),rulebook:{source:z,spec:ct,name:ft.name,version:ft.version,rules:ft.rules.map((ut)=>`${ft.name}/${ut.name}`)}}]}),lt=at.flatMap((ct)=>ct.rules);return{rules:lt,rulebooks:at.map((ct)=>ct.rulebook),knownRuleIds:new Set(lt.map((ct)=>ct.name)),errors:he,warnings:je,canValidateOverrides:he.length===0}}function jy(D){if(D.rulebook_version===2)return D.rules.map((N)=>({name:`${D.name}/${N.name}`,command:N.command,block_args:[],match:N.match,reason:N.reason,intent:N.intent}));return D.rules.map((N)=>({...N,name:`${D.name}/${N.name}`,match:void 0}))}function Vy(D,N,z){let ee=Pe(D),te=O(N,ee),he=qy(te,z);if("error"in he)return{rulebook:null,errors:[he.error]};if(he.content===null)return{rulebook:null,errors:[`missing rulebook file ${te} for ${D}; ${Ky(D)}`]};let je=me(he.content);if("problem"in je)return{rulebook:null,errors:[`invalid rulebook ${te}: ${je.problem}; fix that file`]};if(je.rulebook.name!==ee)return{rulebook:null,errors:[`rulebook name "${je.rulebook.name}" in ${te} must match source "${D}"; fix that file`]};return{rulebook:je.rulebook,errors:[]}}function Pe(D){return S(D)?I(D).name:D}function Ky(D){return S(D)?`run ${Pu} to vendor ${D}`:"create that file or remove that source from the rules config"}function qy(D,N){try{return{content:n(i(N,D))}}catch(z){if(z instanceof r)return{error:z.message};throw z}}function me(D){let N;try{N=JSON.parse(D)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:se(N)}}catch(z){return{problem:z instanceof Error?z.message:"invalid rulebook"}}}function Yy(D,N){return[...new Set([...D?.transparent_wrappers??[],...N?.transparent_wrappers??[]])]}function Fu(D,N){return D.flatMap((z)=>{let ee=N[z.name];if(ee==="off")return[];if(ee&&typeof ee==="object")return[{...z,intent:ee.intent??z.intent,reason:ee.reason}];return[z]})}function Ra(D,N,z){return Object.keys(D).filter((ee)=>!N.has(ee)).map((ee)=>`unknown override key "${ee}" in ${z}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Zy(D,N,z){return Object.keys(D).filter((ee)=>N.has(ee)).map((ee)=>`project override cannot target user-scoped rule "${ee}" in ${z}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function zu(D,N){return N.map((z)=>z.startsWith("Unable to access ")?z:`${D}: ${z}`)}function Xy(D,N){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[N],warnings:[],userConfigPath:D.userConfigPath,projectConfigPath:D.projectConfigPath}}function Bu(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as lb,readFileSync as cb}from"node:fs";var $u=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],_a=new Set($u.map((D)=>D.id)),G=$u,Jy=new Map(G.map((D)=>[D.id,D.intent]));function vt(D,N){return{id:D,reason:N,intent:Jy.get(D)??"manual_only"}}var wa=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Ii={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Qy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],eb=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Pa=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...eb.flatMap((D)=>Qy.map((N)=>({id:["secret.home",D.idSlug,N.slice(1)].join("."),category:"Home path",label:[D.label,N].join(""),description:["Blocks home ",D.label,N," credential backup files."].join(""),suffixParts:[...D.directoryParts,[D.basename,N].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var ki=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Uu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],tb=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Aa=Uu.map((D)=>({id:`secret.variant.${D.slug}.separator`,category:"Variant",label:`${D.label}-* / ${D.label}_*`,description:`Blocks ${D.label} variants with dash or underscore suffixes.`,prefix:D.prefix})),Ta=Uu.flatMap((D)=>tb.map((N)=>({id:`secret.variant.${D.slug}.${N.slice(1)}`,category:"Variant",label:`${D.label}${N}`,description:`Blocks ${D.label}${N} private credential variants.`,prefix:D.prefix,suffix:N}))),ko={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Ia=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((D)=>({id:`secret.ext.${D}`,category:"Extension",label:`.${D}`,description:`Blocks files with the .${D} extension.`,extension:D})),ka=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Ke=[...wa,Ii,...Pa,...Aa,...Ta,ko,...Ia,...ka,...ki].map((D)=>({id:D.id,category:D.category,label:D.label,...D.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in D?{paths:D.paths}:{description:D.description}})),Oi=new Set(ki.flatMap((D)=>D.category==="Coding CLI config"?[D.id]:[])),Oa=new Set(Ke.map((D)=>D.id));import{isAbsolute as Ma,join as nb,normalize as rb,sep as Mi}from"node:path";var Di=process.platform==="win32",Hu=/[*?]/;function Da(D){let N=D.trim(),z=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Di?N.replaceAll("\\","/"):N);if(!z)return null;let ee=z[1]??"",te=z[2]??"";if(Hu.test(ee)||te==="."||te==="..")return null;return{root:ee||"/",name:te}}function Oo(D,N){if(D==="~")return N;if(D.startsWith("~/"))return`${N}${D.slice(1)}`;return D}function Na(D,N){if(typeof D!=="string"||D.trim()==="")return"must be a non-empty path string";let z=Oo(D.trim(),N);if(!Ma(z))return"must be an absolute path or start with ~/";return Mo(z,N)}function La(D,N){let z=ju(D,N);if(z===null)return"must be a non-empty path string";if(!Ma(z))return null;if(Mo(z,N)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var ob="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",ib="cannot cover the guard's own configuration";function ju(D,N){if(typeof D!=="string"||D.trim()==="")return null;let z=D.trim(),ee=Di?z.replaceAll("\\","/"):z;return Oo(ee.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),N)}function Wa(D,N){let z=ju(D,N);if(z===null)return"must be a non-empty path string";let ee=Da(z)?.root??z;if(Hu.test(ee))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Ma(ee))return null;if(Mo(ee,N)!==null)return ob;return sb(ee,N)?ib:null}function sb(D,N){let z=Ni(D),ee=Ni(nb(N,".cc-safety-net"));return z===ee||z.startsWith(`${ee}${Mi}`)}function Mo(D,N){let z=Ni(D),ee=Ni(N);if(z===ee)return"cannot be the home directory";let te=z.endsWith(Mi)?z:`${z}${Mi}`;if(ee.startsWith(te))return"cannot contain the home directory";return null}function Ni(D){let N=rb(D);if(Di)N=N.replace(/\//g,"\\").toLowerCase();if(N.length>(Di?3:1)&&N.endsWith(Mi))N=N.slice(0,-1);return N}var Vu=30,Li=1,Wi=365;function Ku(D){if(typeof D!=="number"||!Number.isInteger(D))return 30;if(D<1)return 1;return D>365?365:D}var qu=new Set(G.filter((D)=>D.catastrophic).map((D)=>D.id));function wt(D,N){if(!D)return null;if(qu.has(D.id))return D;if(N?.destructiveCommandProtectionEnabled===!1)return null;let z=N?.effectiveDestructiveCommandRules[D.id];return z&&!z.enabled?null:D}function Jt(D,N,z){if(qu.has(N))return!0;if(D?.destructiveCommandProtectionEnabled===!1)return!1;return D?.effectiveDestructiveCommandRules[N]?.enabled??z}function H(D,N){return Object.freeze(Object.fromEntries(G.map((z)=>{let ee=z.activationCapability?N[z.activationCapability]:void 0,te=ee?.enabled??!0,he=D.destructiveCommandRuleOverrides[z.id],je=z.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...he?{override:he}:{}}:D.destructiveCommandProtectionEnabled?he?{enabled:he==="on",inheritedEnabled:te,changesInherited:he==="on"!==te,source:"rule_override",...z.activationCapability?{activationCapability:z.activationCapability}:{},override:he}:{enabled:te,inheritedEnabled:te,changesInherited:!1,source:ee?.source??"built_in_default",...z.activationCapability?{activationCapability:z.activationCapability}:{}}:{enabled:!1,inheritedEnabled:te,changesInherited:!1,source:"master_disabled",...z.activationCapability?{activationCapability:z.activationCapability}:{},...he?{override:he}:{}};return[z.id,Object.freeze(je)]})))}function Yu(D,N){return Object.freeze({...D,effectiveDestructiveCommandRules:H(D,N)})}var Zu={standard:0,strict:1,paranoid:2};function Z(D,N){return{policy:{version:1,safety:{level:N.safety?.level??D.safety.level,overrides:{...D.safety.overrides,...N.safety?.overrides}},workflow:{worktree_mode:N.workflow?.worktree_mode??D.workflow.worktree_mode},destructive_command_protection:{enabled:N.destructive_command_protection?.enabled??D.destructive_command_protection.enabled,overrides:{...D.destructive_command_protection.overrides,...N.destructive_command_protection?.overrides},allow_paths:Ga(D.destructive_command_protection.allow_paths,N.destructive_command_protection?.allow_paths)},secret_protection:{enabled:N.secret_protection?.enabled??D.secret_protection.enabled,overrides:{...D.secret_protection.overrides,...N.secret_protection?.overrides},deny_paths:Ga(D.secret_protection.deny_paths,N.secret_protection?.deny_paths),allow_paths:Ga(D.secret_protection.allow_paths,N.secret_protection?.allow_paths)},audit:D.audit},weakenings:ab(D,N)}}function Ga(D,N){return[...new Set([...D,...N??[]])]}function ab(D,N){let z=N.safety?.level,ee=Si[D.safety.level];return[...z&&Zu[z]<Zu[D.safety.level]?[`project policy lowers level: ${D.safety.level} -> ${z}`]:[],...jr.flatMap((te)=>N.safety?.overrides?.[te]===!1&&(D.safety.overrides[te]??ee[te])?[`project policy disables ${te}`]:[]),...N.workflow?.worktree_mode===!0&&!D.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...N.destructive_command_protection?.enabled===!1&&D.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...N.secret_protection?.enabled===!1&&D.secret_protection.enabled?["project policy disables secret protection"]:[],...Xu(N.destructive_command_protection?.overrides,(te)=>D.destructive_command_protection.enabled&&D.destructive_command_protection.overrides[te]!=="off"),...Xu(N.secret_protection?.overrides,(te)=>D.secret_protection.enabled&&(D.secret_protection.overrides[te]==="on"?!0:D.secret_protection.overrides[te]!=="off"&&!Oi.has(te))),...D.destructive_command_protection.enabled?Ju(D.destructive_command_protection.allow_paths,N.destructive_command_protection?.allow_paths).map((te)=>`project policy adds destructive allow path: ${te}`):[],...D.secret_protection.enabled?Ju(D.secret_protection.allow_paths,N.secret_protection?.allow_paths).map((te)=>`project policy adds secret allow path: ${te}`):[]]}function Xu(D,N){return Object.entries(D??{}).flatMap(([z,ee])=>ee==="off"&&N(z)?[`project policy disables rule ${z}`]:[])}function Ju(D,N){return(N??[]).filter((z)=>!D.includes(z))}var Ba=new Set(["standard","strict","paranoid"]),X={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Vu}};function nd(D,N){let z=gb(u(D,N),D.home),ee=Ie(b(N.cwd),D.home),te=ae(ee.parsed,D.home),he=Object.keys(te.policy).length>0?Z(z.gui??X,te.policy):void 0,je=[...z.errors,...ee.errors,...te.diagnostics],at=(z.fallback==="defaults"&&he?"salvaged":z.fallback)??(z.gui?void 0:ee.fallback)??(je.length>0?"salvaged":void 0),lt=te.policy.safety?.level?"project":z.levelPresent?"user":"default";return{...he?za(he.policy):z.policy,errors:je,...at?{fallback:at}:{},...ee.exists?{policyScopes:{levelScope:lt,weakenings:he?.weakenings??[]}}:{}}}var ub="project policy audit settings are ignored; audit is user scope only";function ae(D,N){if(!Cn(D))return{policy:{},diagnostics:[]};let z=Cn(D.safety)?D.safety:{},ee=Cn(D.workflow)?D.workflow:{},te=Cn(D.destructive_command_protection)?D.destructive_command_protection:{},he=Cn(D.secret_protection)?D.secret_protection:{},je={...Ba.has(z.level)?{level:z.level}:{},...Cn(z.overrides)?Qu({overrides:rd(z.overrides,jr,["safety","overrides"],Rr)}):{}},at={...typeof te.enabled==="boolean"?{enabled:te.enabled}:{},...te.overrides!==void 0?{overrides:Gi(te.overrides,_a,id,Rr)}:{},...te.allow_paths!==void 0?{allow_paths:Yr(te.allow_paths,Na,N,["destructive_command_protection","allow_paths"],Rr)}:{}},lt={...typeof he.enabled==="boolean"?{enabled:he.enabled}:{},...he.overrides!==void 0?{overrides:Gi(he.overrides,Oa,sd,Rr)}:{},...he.deny_paths!==void 0?{deny_paths:Yr(he.deny_paths,La,N,["secret_protection","deny_paths"],Rr)}:{},...he.allow_paths!==void 0?{allow_paths:Yr(he.allow_paths,Wa,N,["secret_protection","allow_paths"],Rr)}:{}};return{policy:Qu({safety:je,workflow:typeof ee.worktree_mode==="boolean"?{worktree_mode:ee.worktree_mode}:{},destructive_command_protection:at,secret_protection:lt}),diagnostics:D.audit===void 0?[]:[ub]}}function rd(D,N,z,ee){return Object.fromEntries(N.flatMap((te)=>{let he=D[te];if(typeof he==="boolean")return[[te,he]];if(he!==void 0)ee(e([...z,te],$a));return[]}))}function Qu(D){return Object.fromEntries(Object.entries(D).flatMap((N)=>Object.keys(N[1]).length>0?[N]:[]))}var Rr=()=>{return},$a="must be a boolean",Ua="must be an object if provided",od=`must be an integer between ${Li} and ${Wi}`,id={path:["destructive_command_protection","overrides"],label:"destructive command"},sd={path:["secret_protection","overrides"],label:"secret protection"},Je=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Ye(D,N){let z=[];return{policy:ad(D,N,(te)=>{z.push(te)}),issues:z}}function C(D,N){return ad(D,N,Rr)}function ad(D,N,z){if(!Cn(D))return z(e([],"Config must be an object")),W();if(D.version!==1)z(e(["version"],"must be 1"));let ee=qr(D.safety,["safety"],["level","overrides"],z),te=qr(ee.overrides,["safety","overrides"],jr,z),he=qr(D.workflow,["workflow"],["worktree_mode"],z),je=qr(D.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],z),at=qr(D.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],z),lt=qr(D.audit,["audit"],["retention_days"],z);return ld(D,Je,[],z),{version:1,safety:{level:db(ee.level,z),overrides:rd(te,jr,["safety","overrides"],z)},workflow:{worktree_mode:Fa(he.worktree_mode,["workflow","worktree_mode"],!1,z)},destructive_command_protection:{enabled:Fa(je.enabled,["destructive_command_protection","enabled"],!0,z),overrides:Gi(je.overrides,_a,id,z),allow_paths:Yr(je.allow_paths,Na,N,["destructive_command_protection","allow_paths"],z)},secret_protection:{enabled:Fa(at.enabled,["secret_protection","enabled"],!0,z),overrides:Gi(at.overrides,Oa,sd,z),deny_paths:Yr(at.deny_paths,La,N,["secret_protection","deny_paths"],z),allow_paths:Yr(at.allow_paths,Wa,N,["secret_protection","allow_paths"],z)},audit:{retention_days:fb(lt.retention_days,z)}}}function qr(D,N,z,ee){if(D===void 0)return{};if(!Cn(D))return ee(e(N,Ua)),{};return ld(D,z,N,ee),D}function ld(D,N,z,ee){for(let te of Object.keys(D).filter((he)=>!N.includes(he)))ee({path:z,message:te,kind:"unknownKeys"})}function db(D,N){if(D===void 0)return"standard";if(Ba.has(D))return D;return N(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Fa(D,N,z,ee){if(typeof D==="boolean")return D;if(D!==void 0)ee(e(N,$a));return z}function fb(D,N){if(!(D===void 0||typeof D==="number"&&Number.isInteger(D)&&D>=Li&&D<=Wi))N(e(["audit","retention_days"],od));return Ku(D)}function Gi(D,N,z,ee){if(D===void 0)return{};if(!Cn(D))return ee(e(z.path,Ua)),{};return Object.fromEntries(Object.entries(D).flatMap(([te,he])=>{if(!N.has(te))return ee({path:[...z.path,te],message:`unknown ${z.label} rule id "${te}"`,kind:"key"}),[];if(he==="on"||he==="off")return[[te,he]];return ee(e([...z.path,te],'must be "on" or "off"')),[]}))}function Yr(D,N,z,ee,te){if(D===void 0)return[];if(!Array.isArray(D))return te(e(ee,"must be an array of paths")),[];return D.flatMap((he,je)=>{let at=N(he,z);if(at===null)return[he];return te(typeof he==="string"?Xt([...ee,je],at):e([...ee,je],at)),[]})}function Cn(D){return!!D&&typeof D==="object"&&!Array.isArray(D)}function W(){return structuredClone(X)}function Ae(D,N){let z=R({safety:De(D.safety)},N),ee=H({destructiveCommandProtectionEnabled:D.destructive_command_protection.enabled,destructiveCommandRuleOverrides:D.destructive_command_protection.overrides},z.capabilities),te=Object.values(ee),he=te.filter((je)=>je.source!=="catastrophic");return{selectedPreset:D.safety.level,effectiveLevel:z.effectiveLevel,capabilities:z.capabilities,rules:ee,counts:{enabled:he.filter((je)=>je.enabled).length,disabled:he.filter((je)=>!je.enabled).length,effectiveCustomizations:te.filter((je)=>je.changesInherited).length}}}function Ie(D,N){if(!lb(D))return{exists:!1,policy:W(),errors:[]};try{let z=cb(D,"utf-8");if(!z.trim())return{exists:!0,policy:W(),errors:[`${D}: Config file is empty`],fallback:"defaults"};let ee=JSON.parse(z),te=Ye(ee,N);if(te.issues.length===0)return{exists:!0,parsed:ee,policy:te.policy,errors:[]};return{exists:!0,parsed:ee,policy:te.policy,errors:te.issues.map((he)=>`${D}: ${pb(he)}`),fallback:Cn(ee)?"salvaged":"defaults"}}catch(z){let ee=z instanceof Error?z.message:String(z);return{exists:!0,policy:W(),errors:[`${D}: ${z instanceof SyntaxError?"Invalid JSON":ee}`],fallback:"defaults"}}}var mb=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ua,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[$a,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[od,`not an integer between ${Li} and ${Wi}`]]);function pb(D){let N=Ea(D.path);if(D.kind==="unknownKeys")return`${N===""?"":`${N}.`}${D.message}: unknown field`;if(D.kind==="key")return`${N}: unknown rule id`;let z=mb.get(D.message)??D.message;return N===""?z:`${N}: ${z}`}function gb(D,N){let z=Ie(D,N);if(!z.exists){let ee=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Cn(ee))return{policy:td(),errors:[]};let te=C(ee,N);return{policy:za(te),gui:te,errors:[],levelPresent:ed(ee)}}if(z.parsed===void 0)return{policy:td(),errors:z.errors,...z.fallback?{fallback:z.fallback}:{}};return{policy:za(z.policy),gui:z.policy,errors:z.errors,...z.fallback?{fallback:z.fallback}:{},levelPresent:ed(z.parsed)}}function ed(D){let N=Cn(D)&&Cn(D.safety)?D.safety:{};return Ba.has(N.level)}function Oe(D){let N=Object.entries(D),z=new Set(N.flatMap(([ee,te])=>te==="on"?[ee]:[]));return[...new Set([...[...Oi].filter((ee)=>!z.has(ee)),...N.flatMap(([ee,te])=>te==="off"?[ee]:[])])]}function td(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Oe({}),denyPaths:[],allowPaths:[]}}}function za(D){return{safety:De(D.safety),worktreeMode:D.workflow.worktree_mode,destructiveCommandProtectionEnabled:D.destructive_command_protection.enabled,destructiveCommandRuleOverrides:D.destructive_command_protection.overrides,destructiveCommandAllowPaths:D.destructive_command_protection.allow_paths,secretProtection:{enabled:D.secret_protection.enabled,disabledRules:Oe(D.secret_protection.overrides),denyPaths:D.secret_protection.deny_paths,allowPaths:D.secret_protection.allow_paths}}}function De(D){let N={...D.overrides.fail_closed!==void 0?{failClosed:D.overrides.fail_closed}:{},...D.overrides.paranoid_rm!==void 0?{paranoidRm:D.overrides.paranoid_rm}:{},...D.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:D.overrides.paranoid_interpreters}:{}};return{level:D.level,...Object.keys(N).length>0?{overrides:N}:{}}}function E(D,N){let z=Y(D,N),ee=nd(D,N),te={rules:z.rules,transparentWrappers:z.transparent_wrappers,safety:ee.safety,worktreeMode:ee.worktreeMode,destructiveCommandProtectionEnabled:ee.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:ee.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:ee.destructiveCommandAllowPaths,secretProtection:{enabled:ee.secretProtection.enabled??!0,disabledRules:ee.secretProtection.disabledRules??[],denyPaths:ee.secretProtection.denyPaths,allowPaths:ee.secretProtection.allowPaths??[]}},he={...z.userConfig?.overrides,...z.projectConfig?.overrides},je=Object.freeze(Object.fromEntries(te.rules.map((at)=>{let lt=z.rulebooks.find((dt)=>dt.rules.includes(at.name)),ct=he[at.name];return[at.name,Object.freeze({id:at.name,...lt?{rulebook:Object.freeze({name:lt.name,version:lt.version}),...Cb(lt.spec)?{source:lt.spec}:{}}:{},...ct&&typeof ct==="object"?{override:Object.freeze({type:"reason",reason:ct.reason})}:{}})]})));return Ee(te,hb(z,ee),je,ee.policyScopes)}function Ne(D){if(D.state==="ready")return{state:D.state};return{state:D.state,reason:D.reason}}function hb(D,N){let z=bb(N);if(D.errors.length===0&&D.warnings.length===0&&!z)return;return{diagnostics:[...D.errors,...D.warnings,...N.errors],reason:Sb(D.errors.length>0?yb(D.errors):void 0,D.warnings.length>0?ja(D.warnings.join("; ")):void 0,z)}}function yb(D){return`${ja(D.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function bb(D){if(D.errors.length===0)return;let N=D.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${D.errors.join("; ")}. Enforcing ${N}; the invalid values are not active. Fix the policy file manually`}function Cb(D){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(D)}function Ee(D,N,z=Object.freeze({}),ee){let te=Ha(structuredClone(D)),he=ee?{policyScopes:Ha(structuredClone(ee))}:{};if(!N)return Object.freeze({state:"ready",policy:te,diagnostics:Object.freeze([]),ruleMetadata:z,...he});return Object.freeze({state:"degraded",policy:te,diagnostics:Object.freeze([...N.diagnostics]),reason:N.reason,ruleMetadata:z,...he})}function Ha(D){if(typeof D!=="object"||D===null)return D;for(let N of Object.values(D))Ha(N);return Object.freeze(D)}function Sb(...D){return ja(D.filter((N)=>!!N).join("; "))}function ja(D){return/[.!?]$/.test(D)?D:`${D}.`}function Fe(D){let N=D.effectiveCapabilities,z=D.strict??N.fail_closed.enabled,ee=D.paranoidRm??N.paranoid_rm.enabled,te=D.paranoidInterpreters??N.paranoid_interpreters.enabled,he={fail_closed:Va(N.fail_closed,D.strict,"strict"),paranoid_rm:Va(N.paranoid_rm,D.paranoidRm,"paranoidRm"),paranoid_interpreters:Va(N.paranoid_interpreters,D.paranoidInterpreters,"paranoidInterpreters")};return{policy:Yu(D.policySnapshot.policy,he),effectiveCapabilities:he,effectiveLevel:ca({failClosed:z,paranoidRm:ee,paranoidInterpreters:te}),strict:z,paranoidRm:ee,paranoidInterpreters:te,worktreeMode:D.worktreeMode??!1}}function Va(D,N,z){if(N===void 0||N===D.enabled)return D;return{enabled:N,source:"capability_override",sources:[...D.sources,`analysis options.${z}`]}}import{dirname as __,isAbsolute as w_,join as P_,parse as A_,resolve as T_,sep as I_}from"node:path";function Do(D,N){if(D!=="powershell")return N[0]?.provenance==="command-substitution";let z=N[0]?.text==="&"||N[0]?.text==="."?1:0,ee=N[z]?.provenance;return ee!==void 0&&ee!=="literal"}var vb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Fi(D,N){return D?.provenance==="literal"&&!D.quoted&&D.raw===N&&D.text===N}function No(D){let N=Fi(D.words[0],"time")?1:0,z=N===1&&Fi(D.words[N],"-p")?N+1:N,ee=N===1&&Fi(D.words[z],"--")?z+1:z,te=Fi(D.words[ee],"!")?ee+1:ee,he=D.words.slice(te).find((je)=>!vb.test(je.text));return he?.provenance==="literal"?he.text:void 0}var or=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function zi(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Eb(D){return Object.freeze({...D,span:Object.freeze(D.span),words:Object.freeze(D.words),redirections:Object.freeze(D.redirections.map((N)=>Object.freeze({...N,span:Object.freeze(N.span),...N.heredoc?{heredoc:Object.freeze({...N.heredoc,bodySpan:Object.freeze(N.heredoc.bodySpan),terminatorSpan:Object.freeze(N.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(D.nested.map((N)=>ln(N)))})}function Bi(D,N,z){D.push(z),N.reset()}function $i(D){let N=[];return{parts:N,push:(z,ee,te)=>{if(ee<=z)return;N.push({raw:D.slice(z,ee),span:{start:z,end:ee},provenance:te})}}}function Ka(D){let N=D.parts??[{raw:D.raw,span:D.span,provenance:D.provenance}];return Object.freeze({kind:"word",...D,span:Object.freeze(D.span),parts:Object.freeze(N.map((z)=>Object.freeze({...z,span:Object.freeze(z.span)})))})}function Zr(D,N,z,ee,te,he,je){return Ka({text:ee,raw:D.slice(N,z),span:{start:N,end:z},provenance:te,quoted:he,...je?{parts:je}:{}})}function ln(D){return Object.freeze({...D,span:Object.freeze(D.span),issues:Object.freeze(D.issues.map((N)=>Object.freeze({...N}))),nodes:Object.freeze(D.nodes.map((N)=>{if(N.kind==="command")return Eb(N);if(N.kind==="group"||N.kind==="function")return Object.freeze({...N,span:Object.freeze(N.span),body:ln(N.body)});return Object.freeze({...N,span:Object.freeze(N.span)})}))})}function qa(D,N,z){if(N>=z||ud(D[N]??""))return null;let ee="",te=!1,he=!1,je=N;while(je<z&&!ud(D[je]??"")){let at=D[je]??"";if(at==="'"){te=!0;let lt=cd(D,je+1,z,"'");ee+=lt.text,he||=!lt.closed,je=lt.next;continue}if(at==='"'){te=!0;let lt=cd(D,je+1,z,'"');ee+=lt.text,he||=!lt.closed,je=lt.next;continue}if(at==="\\"){te=!0;let lt=D[je+1];if(!lt||lt===`
+`||lt==="\r"){he=!0;break}ee+=lt,je+=2;continue}if(at==="`"||D.startsWith("$(",je)||D.startsWith("${",je)||D.startsWith("<(",je)||D.startsWith(">(",je))he=!0;ee+=at,je++}return{delimiter:ee,quoted:te,next:je,ambiguous:he}}function Ya(D,N,z,ee){let te=[],he=N;for(let je of ee){let at=he,lt=!1;while(he<z){let ct=xb(D,he,z);if((je.stripTabs?ct.text.replace(/^\t+/,""):ct.text)===je.delimiter){je.attach({body:je.stripTabs?Rb(D.slice(at,he)):D.slice(at,he),delimiter:je.delimiter,quotedDelimiter:je.quotedDelimiter,bodySpan:{start:at,end:he},terminatorSpan:{start:he,end:ct.contentEnd}}),he=ct.next,lt=!0;break}if(ct.next<=he)break;he=ct.next}if(lt)continue;return te.push({code:"unterminated-heredoc",message:`heredoc delimiter ${je.delimiter} was not found`}),{next:z,issues:te,terminated:!1}}return{next:he,issues:te,terminated:!0}}function cd(D,N,z,ee){let te="",he=N;while(he<z&&D[he]!==`
+`&&D[he]!=="\r"){let je=D[he]??"";if(je===ee)return{text:te,next:he+1,closed:!0};if(ee==='"'&&je==="\\"&&D[he+1]){let at=D[he+1]??"";te+=["$","`",'"',"\\"].includes(at)?at:`\\${at}`,he+=2;continue}te+=je,he++}return{text:te,next:he,closed:!1}}function ud(D){return D!=="\r"&&(/[\s;&|<>)]/u.test(D)||D==="`")}function xb(D,N,z){let ee=N;while(ee<z&&D[ee]!==`
+`)ee++;let te=ee>=z?z:ee+1;return{text:D.slice(N,ee),contentEnd:ee,next:te}}function Rb(D){return D.replace(/(^|\r\n?|\n)\t+/g,"$1")}var pd=new Set(["&&","||","|","|&"]),_b=new Set(["!","do","elif","else","if","then","until","while"]);function gd(D,N){let z={start:0,end:D.length};if(D.length>N.maxInputLength)return ln({kind:"program",dialect:"posix",source:D,span:z,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${N.maxInputLength} UTF-16 code units`}],nodes:[]});let ee=ji(D,0,D.length,N,{used:0,max:N.maxWords},0);return ln({kind:"program",dialect:"posix",source:D,span:z,status:qi(ee.issues,ee.limited),issues:ee.issues,nodes:ee.nodes})}function ji(D,N,z,ee,te,he,je){let at=[],lt=[],ct=zi(),dt=[],ft=()=>{if(ct.words.length===0&&ct.redirections.length===0)return;let mt={start:ct.start,end:ct.end},pt=ct.words.map((gt)=>gt.text);Bi(at,ct,{kind:"command",dialect:"posix",source:D.slice(mt.start,mt.end),span:mt,words:ct.words,redirections:ct.redirections,nested:ct.nested,displayText:lt.length>0&&at.length===0?D.slice(N,z):pt.join(" ")})},ut=N;while(ut<z){let mt=D[ut];if(!mt)break;if(je&&mt===je)return ft(),md(at,lt),{nodes:at,issues:lt,next:ut+1,closed:!0,limited:!1,pendingHeredocs:dt};if(Ki(mt)){if(mt===`
+`||mt==="\r"){ft();let _t=mt==="\r"&&D[ut+1]===`
+`?ut+2:ut+1,Et=at.at(-1);if(Et?.kind!=="connector"||!pd.has(Et.operator))at.push(Object.freeze({kind:"connector",operator:D.slice(ut,_t),span:Object.freeze({start:ut,end:_t})}));if(dt.length>0){let At=Ya(D,_t,z,dt.splice(0));lt.push(...At.issues),ut=At.next;continue}ut=_t;continue}ut++;continue}if(mt==="#"){while(ut<z&&D[ut]!==`
+`&&D[ut]!=="\r")ut++;continue}let pt=ct.start===-1?Vb(D,ut,z):void 0;if(pt){if(Xa(at,lt),he>=ee.maxDepth)return Xr(at,lt,ut,"depth-limit",ee.maxDepth);if(!Za(te))return Xr(at,lt,ut,"word-limit",ee.maxWords);let _t=ji(D,pt.braceIndex+1,z,ee,te,he+1,"}"),Et=_t.next,At={start:pt.braceIndex+1,end:_t.closed?Et-1:Et},Dt=dd(D,At,_t);if(at.push({kind:"function",name:pt.name,span:{start:ut,end:Et},body:Dt}),lt.push(..._t.issues),_t.pendingHeredocs.length>0||Wo(_t.nodes))lt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(dt.push(..._t.pendingHeredocs),_t.limited)return Hi(at,lt,_t.next);if(!_t.closed)lt.push({code:"unclosed-function-body",message:"function body is not closed"});ut=Et;continue}let gt=Vi(D,ut);if(gt){if(ft(),!xd(at.at(-1)))lt.push({code:"unexpected-connector",message:`connector ${gt} has no preceding command`});at.push(Object.freeze({kind:"connector",operator:gt,span:Object.freeze({start:ut,end:ut+gt.length})})),ut+=gt.length;continue}if(mt===")"){ft(),lt.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),at.push({kind:"unknown",source:mt,span:{start:ut,end:ut+1}}),ut++;continue}if((mt==="("||mt==="{"&&Mb(D,ut,z))&&ct.start===-1){if(Xa(at,lt),he>=ee.maxDepth)return Xr(at,lt,ut,"depth-limit",ee.maxDepth);let _t=mt==="("?")":"}",Et=ji(D,ut+1,z,ee,te,he+1,_t),At=Et.next,Dt={start:ut+1,end:Et.closed?At-1:At},qt=dd(D,Dt,Et);if(at.push({kind:"group",style:mt==="("?"subshell":"brace",span:{start:ut,end:At},body:qt}),lt.push(...Et.issues),Et.pendingHeredocs.length>0||Wo(Et.nodes))lt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(dt.push(...Et.pendingHeredocs),Et.limited)return Hi(at,lt,Et.next);if(!Et.closed)lt.push({code:mt==="("?"unclosed-subshell":"unclosed-brace-group",message:`${mt} group is not closed`});ut=At;continue}let ht=(mt==="<"||mt===">")&&D[ut+1]!=="("?Tb(D,ut):null;if(ht){let _t=ct.words.at(-1),Et=_t&&_t.span.end===ut&&/^[0-9]+$/.test(_t.raw)?Number(_t.raw):void 0;if(Et!==void 0)ct.words.pop();let At=Et===void 0?ut:_t?.span.start??ut;ct.start=ct.start===-1?ut:ct.start;let Dt=ut+ht.length;while(Dt<z&&/[ \t]/.test(D[Dt]??""))Dt++;let qt=D[Dt],jn=Dt>ut+ht.length&&qt==="#",mn=!qt||Ki(qt)||!!Vi(D,Dt)||qt===je||qt===")"||jn||(qt==="<"||qt===">")&&D[Dt+1]!=="(",hr=ht==="<<"||ht==="<<-",Wt=hr?qa(D,Dt,z):void 0,Ot=Wt?{word:Zr(D,Dt,Wt.next,Wt.delimiter,"literal",Wt.quoted),nested:[],issues:[],next:Wt.next,limited:!1}:!mn?Ja(D,Dt,z,ee,te,he):void 0;if(Ot){if(lt.push(...Ot.issues),Ot.limited)return Hi(at,lt,Ot.next);if(!Za(te))return Xr(at,lt,Ot.next,"word-limit",ee.maxWords)}let nn=Ot?.next??ut+ht.length,Vt={kind:"redirection",operator:ht,span:{start:At,end:nn},...Et===void 0?{}:{fd:Et},...Ot?{target:Ot.word}:{}};if(ct.redirections.push(Vt),hr&&!Wt)lt.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(Wt){if(Wt.ambiguous||Wt.delimiter.length===0)lt.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Kt=ct.nested;dt.push({delimiter:Wt.delimiter,quotedDelimiter:Wt.quoted,stripTabs:ht==="<<-",attach:(pn)=>{if(Vt.heredoc=pn,pn.quotedDelimiter)return;Kt.push(...Pb(D,pn.bodySpan.start,pn.bodySpan.end,ee,te,he+1))}})}if(!hr&&!Ot)lt.push({code:"missing-redirection-target",message:`redirection ${ht} requires a target word`});if(Ot)ct.nested.push(...Ot.nested);ct.end=nn,ut=nn;continue}let yt=ct.start===-1;if(yt)Xa(at,lt);let Ct=Ja(D,ut,z,ee,te,he);if(lt.push(...Ct.issues),Ct.limited)return Hi(at,lt,Ct.next);let bt=Lb(ct.words)?Bb(D,Ct.word,te.max-te.used,ee.maxDepth,ee.maxInputLength):void 0;if(bt?.limitCode)return Xr(at,lt,Ct.next,bt.limitCode,bt.limitCode==="word-limit"?ee.maxWords:bt.limitCode==="depth-limit"?ee.maxDepth:ee.maxInputLength);let xt=bt?.words??[Ct.word];for(let _t of xt){if(!Za(te))return Xr(at,lt,Ct.next,"word-limit",ee.maxWords);ct.words.push(_t)}if(ct.start=ct.start===-1?ut:ct.start,ct.end=Ct.next,ct.nested.push(...Ct.nested),yt&&Rd(Ct.word))ft();ut=Ct.next>ut?Ct.next:ut+1}return ft(),md(at,lt),lt.push(...Kb(dt)),{nodes:at,issues:lt,next:ut,closed:je===void 0,limited:!1,pendingHeredocs:[]}}function dd(D,N,z){return{kind:"program",dialect:"posix",source:D.slice(N.start,N.end),span:N,status:qi(z.issues,z.limited),issues:z.issues,nodes:z.nodes}}function Ja(D,N,z,ee,te,he){let je="",at=N,lt=!1,ct="literal",dt=[],ft=[],ut=!1;while(at<z){let mt=D[at],pt=(mt==="<"||mt===">")&&D[at+1]==="(";if(!mt||Ki(mt)||(mt===";"||mt==="|"||mt==="&")&&Vi(D,at)||(mt==="<"||mt===">")&&!pt)break;if(mt===")")break;if(mt==="'"){lt=!0;let ht=D.indexOf("'",at+1);if(ht===-1||ht>=z){je+=D.slice(at+1,z),ft.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),at=z;break}je+=D.slice(at+1,ht),at=ht+1;continue}if(mt==='"'){lt=!0;let ht=wb(D,at,z,ee,te,he);if(je+=ht.text,dt.push(...ht.nested),ft.push(...ht.issues),ut||=ht.limited,ct=Lo(ct,ht.provenance),at=ht.next,ut)break;continue}if(D.startsWith("$'",at)){lt=!0;let ht=Ib(D,at+2,z);if(je+=ht.text,ft.push(...ht.issues),!ht.closed)ft.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});at=ht.next;continue}if(mt==="\\"){let ht=D[at+1];if(!ht){ft.push({code:"trailing-escape",message:"escape has no following character"}),at++;break}if(ht===`
+`){at+=2;continue}je+=ht,at+=2;continue}let gt=mt==="$"||mt==="<"||mt===">"||mt==="`"?Yi(D,at,z,ee,te,he):null;if(gt){let ht=hd(gt,dt,ft);if(ut||=ht.limited,ct=Lo(ct,ht.provenance),at=ht.next,ut)break;continue}if(mt==="$"){let ht=Cd(D,at,z,je,ct);je=ht.text,ct=ht.provenance,at=ht.next;continue}if(mt==="*"||mt==="?"||mt==="[")ct=Lo(ct,"glob");je+=mt,at++}return{word:Zr(D,N,at,je,ct,lt,ct==="literal"?void 0:Ob(D,N,at)),nested:dt,issues:ft,next:at,limited:ut}}function wb(D,N,z,ee,te,he){let je="",at="literal",lt=[],ct=[],dt=!1,ft=N+1;while(ft<z){let ut=D[ft];if(ut==='"')return{text:je,provenance:at,nested:lt,issues:ct,next:ft+1,limited:dt};if(ut==="\\"&&D[ft+1]){let pt=D[ft+1]??"";if(pt===`
+`){ft+=2;continue}if(pt==="\r"&&D[ft+2]===`
+`){ft+=3;continue}je+=["$","`",'"',"\\"].includes(pt)?pt:`\\${pt}`,ft+=2;continue}if(D.startsWith("$((",ft)){let pt=Qa(D,ft+3,z,"))"),gt=pt===-1?z:pt+2;if(je+=D.slice(ft,gt),pt===-1)ct.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});ft=gt;continue}let mt=Yi(D,ft,z,ee,te,he);if(mt){let pt=hd(mt,lt,ct);if(ft=pt.next,dt||=pt.limited,at=Lo(at,pt.provenance),dt)return{text:je,provenance:at,nested:lt,issues:ct,next:ft,limited:dt};continue}if(ut==="$"){let pt=Cd(D,ft,z,je,at);je=pt.text,at=pt.provenance,ft=pt.next;continue}je+=ut??"",ft++}return ct.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:je,provenance:at,nested:lt,issues:ct,next:z,limited:dt}}function Yi(D,N,z,ee,te,he){let je=D.startsWith("$((",N),at=D.startsWith("$(",N)&&!je,lt=D.startsWith("<(",N)||D.startsWith(">(",N),ct=D[N]==="`";if(!je&&!at&&!lt&&!ct)return null;let dt=je?3:ct?1:2,ft=je?"))":ct?"`":")",ut=Qa(D,N+dt,z,ft),mt=ut===-1?z:ut,pt=ut===-1?z:ut+ft.length;if(he>=ee.maxDepth)return{program:jb(D,N+dt,mt,"depth-limit"),next:pt,provenance:je?"arithmetic":"command-substitution"};if(je){let Ct=[],bt=[],xt=!1,_t=N+dt;while(_t<mt){let Et=Yi(D,_t,mt,ee,te,he+1);if(!Et){_t++;continue}if(Ct.push(...Et.program.nodes),bt.push(...Et.program.issues),xt||=Et.program.status==="limited",_t=Et.next,xt)break}if(ut===-1)bt.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:ln({kind:"program",dialect:"posix",source:D.slice(N+dt,mt),span:{start:N+dt,end:mt},status:qi(bt,xt),issues:bt,nodes:Ct}),next:pt,provenance:"arithmetic"}}let gt=ji(D,N+dt,mt,ee,te,he+1),ht=ut===-1?[{code:"unclosed-command-substitution",message:`${D.slice(N,N+dt)} substitution is not closed`}]:[],yt=(ct||lt)&&Wo(gt.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:ln({kind:"program",dialect:"posix",source:D.slice(N+dt,mt),span:{start:N+dt,end:mt},status:qi([...gt.issues,...ht,...yt],gt.limited),issues:[...gt.issues,...ht,...yt],nodes:gt.nodes}),next:pt,provenance:"command-substitution"}}function Pb(D,N,z,ee,te,he){let je=[],at=N;while(at<z){let lt=D[at];if(lt==="\\"){at+=2;continue}let ct=lt==="$"||lt==="`"?Yi(D,at,z,ee,te,he):null;if(!ct){at++;continue}if(je.push(ct.program),at=ct.next,ct.program.status==="limited")break}return je}function hd(D,N,z){return N.push(D.program),z.push(...D.program.issues),{provenance:D.provenance,next:D.next,limited:D.program.status==="limited"}}function Qa(D,N,z,ee){if(ee==="`"){for(let at=N;at<z;at++){if(D[at]==="\\"){at++;continue}if(D[at]==="`")return at}return-1}let te=1,he={single:!1,double:!1},je=[];for(let at=N;at<z;at++){let lt=D[at];if((lt===`
+`||lt==="\r")&&je.length>0){let dt=lt==="\r"&&D[at+1]===`
+`?at+2:at+1,ft=Ya(D,dt,z,je.splice(0));if(!ft.terminated)return-1;at=ft.next-1;continue}let ct=yd(D,at,N,z,he);if(ct!==null){at=ct;continue}if(!he.double&&D.startsWith("$((",at)){let dt=Ab(D,at+3,z);if(dt===-1)return-1;at=dt+1;continue}if(ee===")"&&!he.double&&lt==="<"&&D[at+1]==="<"&&D[at+2]!=="<"){let dt=D[at+2]==="-",ft=at+(dt?3:2);while(ft<z&&/[ \t]/.test(D[ft]??""))ft++;let ut=qa(D,ft,z);if(ut){je.push({delimiter:ut.delimiter,quotedDelimiter:ut.quoted,stripTabs:dt,attach:()=>{return}}),at=ut.next-1;continue}}if(D.startsWith("$(",at)&&!D.startsWith("$((",at)){te++,at++;continue}if(lt==="("&&!he.double)te++;if(lt===")"&&!he.double){if(te--,te===0)return ee==="))"&&D[at+1]!==")"?-1:at}}return-1}function Ab(D,N,z){let ee=1,te={single:!1,double:!1};for(let he=N;he<z;he++){let je=D[he],at=yd(D,he,N,z,te);if(at!==null){he=at;continue}if(D.startsWith("$(",he)&&!D.startsWith("$((",he)){ee++,he++;continue}if(je==="("&&!te.double)ee++;if(je!==")"||te.double)continue;if(ee--,ee===0)return D[he+1]===")"?he:-1}return-1}function yd(D,N,z,ee,te){let he=D[N];if(he==="\\"&&!te.single)return N+1;if(!te.double&&he==="'")te.single=!te.single;if(!te.single&&he==='"')te.double=!te.double;if(te.single)return N;if(te.double||he!=="#"||!qb(D,N,z))return null;let je=N;while(je+1<ee&&D[je+1]!==`
+`&&D[je+1]!=="\r")je++;return je}function Vi(D,N){let z=D[N];if(z===";")return";";if(z==="&")return D[N+1]==="&"?"&&":"&";if(z==="|")return D[N+1]==="|"?"||":D[N+1]==="&"?"|&":"|";return null}function Tb(D,N){let z=D[N];if(z===">"){if(D[N+1]===">")return">>";if(D[N+1]==="&")return">&";return D[N+1]==="|"?">|":">"}if(z!=="<")return null;if(D.startsWith("<<<",N))return"<<<";if(D.startsWith("<<-",N))return"<<-";if(D[N+1]==="<")return"<<";if(D[N+1]==="&")return"<&";if(D[N+1]===">")return"<>";return"<"}function Ki(D){let N=D.charCodeAt(0);if(N===32||N>=9&&N<=13)return!0;if(N<128)return!1;return/\s/u.test(D)}function bd(D,N,z){if(D[N+1]==="{"){let te=D.indexOf("}",N+2);return te===-1||te>=z?z:te+1}let ee=N+1;while(ee<z&&/[A-Za-z0-9_?@#$!*-]/.test(D[ee]??""))ee++;return ee===N+1?N+1:ee}function Ib(D,N,z){let ee="",te=[],he=N;while(he<z){let je=D[he];if(je==="'")return{text:ee,next:he+1,closed:!0,issues:te};if(je!=="\\"){ee+=je??"",he++;continue}let at=kb(D,he+1,z);if(ee+=at.text,at.invalidCodePoint!==void 0)te.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${at.invalidCodePoint}`});he=at.next}return{text:ee,next:z,closed:!1,issues:te}}function kb(D,N,z){let ee=D[N];if(!ee||N>=z)return{text:"\\",next:N};let te=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(te.has(ee))return{text:te.get(ee)??ee,next:N+1};if(ee==="x")return Ui(D,N+1,z,16,2,N+1);if(ee==="u")return Ui(D,N+1,z,16,4,N+1);if(ee==="U")return Ui(D,N+1,z,16,8,N+1);if(/[0-7]/.test(ee))return Ui(D,N,z,8,3,N+1);return{text:ee,next:N+1}}function Ui(D,N,z,ee,te,he){let je=ee===16?/[0-9a-fA-F]/:/[0-7]/,at="",lt=N;while(lt<z&&at.length<te&&je.test(D[lt]??""))at+=D[lt],lt++;if(!at)return{text:D[he-1]??"",next:he};let ct=Number.parseInt(at,ee);return ct>1114111||ct>=55296&&ct<=57343?{text:"�",next:lt,invalidCodePoint:ct}:{text:String.fromCodePoint(ct),next:lt}}function qi(D,N=!1){if(N)return"limited";if(D.some((z)=>z.code==="invalid-ansi-c-code-point"||z.code==="missing-heredoc-delimiter"||z.code==="ambiguous-heredoc-delimiter"||z.code==="unterminated-heredoc"||z.code==="unsupported-heredoc-context"))return"invalid";return D.length>0?"partial":"complete"}function Cd(D,N,z,ee,te){let he=bd(D,N,z);return{text:ee+D.slice(N,he),provenance:Lo(te,"variable"),next:he}}function Ob(D,N,z){let ee=$i(D),te=N,he=!1,je=!1,at=N;while(at<z){let lt=D[at];if(lt==="\\"&&!he){at+=2;continue}if(!je&&lt==="'"){he=!he,at++;continue}if(!he&&lt==='"'){je=!je,at++;continue}if(he){at++;continue}let ct=D.startsWith("$((",at),dt=D.startsWith("$(",at)&&!ct,ft=!je&&(D.startsWith("<(",at)||D.startsWith(">(",at)),ut=lt==="`";if(ct||dt||ft||ut){let mt=ct?3:ut?1:2,pt=ct?"))":ut?"`":")",gt=Qa(D,at+mt,z,pt),ht=gt===-1?z:gt+pt.length;ee.push(te,at,"literal"),ee.push(at,ht,ct?"arithmetic":"command-substitution"),at=ht,te=ht;continue}if(lt==="$"){let mt=bd(D,at,z);if(mt>at+1){ee.push(te,at,"literal"),ee.push(at,mt,"variable"),at=mt,te=mt;continue}}if(!je&&(lt==="*"||lt==="?"||lt==="[")){ee.push(te,at,"literal"),ee.push(at,at+1,"glob"),at++,te=at;continue}at++}return ee.push(te,z,"literal"),ee.parts}function Lo(D,N){if(N==="command-substitution"||D==="command-substitution")return"command-substitution";if(N==="arithmetic"||D==="arithmetic")return"arithmetic";if(N==="variable"||D==="variable")return"variable";if(N==="glob"||D==="glob")return"glob";return D}function Mb(D,N,z){return N+1>=z||Ki(D[N+1]??"")||Vi(D,N+1)!==null}var Db=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Nb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Lb(D){let N=0;while(N<=D.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(D[N]?.text??""))N++;if(N===D.length)return!0;let z=Wb(D,N);if(z===void 0||z===null)return!1;N=z}return!1}function Wb(D,N){let z=D[N]?.text.toLowerCase();if(z==="command")return Gb(D,N);if(z==="env")return Fb(D,N);if(z==="sudo")return zb(D,N);return}function Gb(D,N){if(D[N+1]?.text==="-v")return null;for(let z=N+1;z<D.length;z++){let ee=D[z]?.text??"";if(ee==="--")return z+1;if(ee==="-p"||ee==="-v"||ee==="-V"||/^-[pvV]+$/.test(ee))continue;return z}return D.length}function Fb(D,N){for(let z=N+1;z<D.length;z++){let ee=D[z]?.text??"";if(ee==="--")return z+1;if(Db.has(ee)){if(D[z+1]===void 0)return null;z++;continue}if(ee.startsWith("-u=")||ee.startsWith("--unset=")||ee.startsWith("-C")&&ee.length>2||ee.startsWith("--chdir=")||ee.startsWith("-S")&&ee.length>2||ee.startsWith("--split-string=")||ee.startsWith("-P"))continue;if(ee.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(ee))continue;return z}return D.length}function zb(D,N){for(let z=N+1;z<D.length;z++){let ee=D[z]?.text??"";if(ee==="--")return z+1;if(Nb.has(ee)){if(D[z+1]===void 0)return null;z++;continue}if(ee.startsWith("-"))continue;return z}return D.length}function Sd(D,N,z,ee){if(D.provenance!=="literal"||!D.raw.includes("{"))return;let te=vd(D.raw,N,z,ee,!0);if(!te)return;if("limited"in te)return{limited:!0};let he=te.values.map((je)=>Ed(je,z));if(he.some((je)=>je===null))return{limited:!0};return{words:[...new Set(he.filter((je)=>je!==null&&je!==""))]}}function Bb(D,N,z,ee,te){if(N.provenance!=="literal"||!N.raw.includes("{"))return;let he=vd(N.raw,z,ee,te,!1);if(!he)return;if("limited"in he){if(he.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:he.limited==="length"?"brace-expansion-limit":"word-limit"}}let je=he.values.map((at)=>Ed(at,ee));if(je.some((at)=>at===null))return;return{words:je.filter((at)=>at!==null&&at!=="").map((at)=>Zr(D,N.span.start,N.span.end,at,"literal",!1))}}function vd(D,N,z,ee,te){let he=[D],je=D.length,at=0;while(!0){let lt=he.findIndex((mt)=>fd(mt,te));if(lt===-1)break;if(++at>z)return{limited:"expansions"};let ct=he[lt]??"",dt=fd(ct,te);if(!dt||dt.kind==="range")return{limited:"expansions"};let ft=dt.start+ct.length-dt.end,ut=dt.alternatives.reduce((mt,pt)=>mt+ft+pt.length,0);if(je-ct.length+ut>ee)return{limited:"length"};if(he.length-1+dt.alternatives.length>N)return{limited:"words"};he.splice(lt,1,...$b(ct,dt)),je+=ut-ct.length}return at===0?void 0:{values:he}}function fd(D,N){let z=[],ee,te=null,he=!1;for(let je=0;je<D.length;je++){let at=D[je];if(he){he=!1;continue}if(at==="\\"&&te!=="'"){he=!0;continue}if(at===te){te=null;continue}if(te===null&&(at==="'"||at==='"')){te=at;continue}if(te!==null)continue;if(at==="{"){z.push({start:je,commas:[]});continue}if(at===","&&z.length>0){z.at(-1)?.commas.push(je);continue}if(at!=="}"||z.length===0)continue;let lt=z.pop();if(!lt)continue;let ct=lt.commas.length>0?{kind:"alternatives",start:lt.start,end:je+1,commas:lt.commas}:N&&Hb(D.slice(lt.start+1,je))?{kind:"range",start:lt.start,end:je+1}:void 0;if(ct&&(!ee||ct.start<ee.start))ee=ct}if(!ee||ee.kind==="range")return ee;return{kind:ee.kind,start:ee.start,end:ee.end,alternatives:Ub(D,ee)}}function $b(D,N){return N.alternatives.map((z)=>`${D.slice(0,N.start)}${z}${D.slice(N.end)}`)}function Ub(D,N){let z=[N.start,...N.commas,N.end-1];return z.slice(0,-1).map((ee,te)=>D.slice(ee+1,z[te+1]))}function Hb(D){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(D)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(D)}function Ed(D,N){let z=`x${D}`,ee=Ja(z,0,z.length,{maxInputLength:z.length,maxWords:1,maxDepth:N},{used:0,max:1},0);if(ee.limited||ee.issues.length>0||ee.next!==z.length||ee.word.provenance!=="literal")return null;return ee.word.text.slice(1)}function jb(D,N,z,ee){return ln({kind:"program",dialect:"posix",source:D.slice(N,z),span:{start:N,end:z},status:"limited",issues:[{code:ee,message:"command structure exceeds parser limit"}],nodes:[]})}function Xr(D,N,z,ee,te){return{nodes:D,issues:[...N,{code:ee,message:`command structure exceeds parser limit ${te}`}],next:z,closed:!1,limited:!0,pendingHeredocs:[]}}function Hi(D,N,z){return{nodes:D,issues:N,next:z,closed:!1,limited:!0,pendingHeredocs:[]}}function Za(D){return D.used++,D.used<=D.max}function Vb(D,N,z){let ee=D.slice(N,z),te=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(ee)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(ee),he=te?.[1];if(!te||!he)return;return{name:he,braceIndex:N+te[0].lastIndexOf("{")}}function Wo(D){return D.some((N)=>{if(N.kind==="command")return N.redirections.some((z)=>z.heredoc)||N.nested.some((z)=>Wo(z.nodes));return(N.kind==="group"||N.kind==="function")&&Wo(N.body.nodes)})}function Kb(D){return D.map((N)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${N.delimiter} was not found`}))}function xd(D){return D?.kind==="command"||D?.kind==="group"||D?.kind==="function"}function md(D,N){let z=D.at(-1);if(z?.kind!=="connector"||!pd.has(z.operator))return;N.push({code:"missing-command-after-connector",message:`connector ${z.operator} requires a following command`})}function Rd(D){return D?.provenance==="literal"&&!D.quoted&&D.raw===D.text&&_b.has(D.text)}function Xa(D,N){let z=D.at(-1);if(!xd(z))return;if(z?.kind==="command"&&Rd(z.words[0]))return;N.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function qb(D,N,z){return N===z||/[\s;&|()]/u.test(D[N-1]??"")}var wd=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Yb=new Set(["gc","cat","type","cp","mv","rm"]),Pd=["-rec","-for","-path","-literalpath","-whatif"],Zb=/^\$env:\w/i,Xb=/^(?:\$\{?\w+\}?|~)\\./;function Ad(D,N){let z=D.toLowerCase().replaceAll("`","");if(![...wd].some((te)=>z.includes(te))&&!(z.includes("rm")&&Pd.some((te)=>z.includes(te)))&&!z.includes("<#")&&!Jb(z))return!1;let ee=rl(D,N);if(Td(ee))return!1;return ee.issues.some((te)=>te.code==="unclosed-block-comment"||te.code==="comment-depth-limit")||nl(ee).some(Qb)}function Td(D){return D.nodes.some((N)=>{if(N.kind==="group")return Td(N.body);if(N.kind!=="command")return!1;return N.redirections.some((z)=>z.operator==="<<")})}function Jb(D){if(D.includes("$env:"))return!0;return D.includes("\\")&&(D.includes("$")||D.includes("~"))}function Qb(D){let N=D[0]==="&"||D[0]==="."?1:0,z=D[N]?.toLowerCase();if(z&&wd.has(z))return!0;let ee=D.slice(N+1);if(z&&Yb.has(z)&&ee.some(eC))return!0;if(z!=="rm")return!1;return ee.some((te)=>{let he=te.toLowerCase().split(":",1)[0]??"";return Pd.some((je)=>he.startsWith(je))})}function eC(D){return Zb.test(D)||Xb.test(D)}function rl(D,N){let z={start:0,end:D.length};if(D.length>N.maxInputLength)return ln({kind:"program",dialect:"powershell",source:D,span:z,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${N.maxInputLength} UTF-16 code units`}],nodes:[]});let ee=ol(D,0,D.length,N,0);return ln({kind:"program",dialect:"powershell",source:D,span:z,status:iC(ee.issues,ee.limited),issues:ee.issues,nodes:ee.nodes})}function ol(D,N,z,ee,te,he=!1){let je=[],at=[],lt=zi(),ct=0,dt=!1,ft=()=>{if(lt.words.length===0&&lt.redirections.length===0)return;let mt={start:lt.start,end:lt.end};Bi(je,lt,{kind:"command",dialect:"powershell",source:D.slice(mt.start,mt.end),span:mt,words:lt.words,redirections:lt.redirections,nested:lt.nested,displayText:lt.words.map((pt)=>pt.text).join(" ")})},ut=N;while(ut<z){let mt=D[ut];if(!mt)break;if(he&&mt==="}")return ft(),{nodes:je,issues:at,next:ut+1,closed:!0,words:ct,limited:dt};let pt=oC(D,ut,z,ee.maxDepth);if(pt){if(pt.issue)at.push(pt.issue);if(pt.limited)return ft(),{nodes:je,issues:at,next:pt.next,closed:!1,words:ct,limited:!0};ut=pt.next;continue}if(/\s/.test(mt)){if(mt==="\r"||mt===`
+`){ft();let yt=mt==="\r"&&D[ut+1]===`
+`?ut+2:ut+1;je.push(el(D,ut,yt)),ut=yt;continue}ut++;continue}let gt=Od(D,ut);if(gt){ft(),je.push(el(D,ut,ut+gt.length)),ut+=gt.length;continue}if(mt==="{"){if(ft(),te>=ee.maxDepth)return at.push(kd(ee.maxDepth)),{nodes:je,issues:at,next:z,closed:!1,words:ct,limited:!0};let yt=ol(D,ut+1,z,ee,te+1,!0),Ct=yt.closed?yt.next-1:yt.next,bt=ln({kind:"program",dialect:"powershell",source:D.slice(ut+1,Ct),span:{start:ut+1,end:Ct},status:yt.limited?"limited":yt.issues.length>0?"partial":"complete",issues:yt.issues,nodes:yt.nodes});if(je.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:ut,end:yt.next}),body:bt})),at.push(...yt.issues),!yt.closed)at.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ct+=yt.words,dt||=yt.limited,ut=yt.next;continue}if(mt==="}"){ft(),je.push(el(D,ut,ut+1)),ut++;continue}if(mt===">"||mt==="<"){lt.start=lt.start===-1?ut:lt.start;let yt=D[ut+1]===mt?ut+2:ut+1,Ct=yt;while(/[ \t]/.test(D[Ct]??""))Ct++;let bt=Ct<z?_d(D,Ct,z,ee,te):void 0,xt=bt?.next??yt;if(lt.redirections.push(Object.freeze({kind:"redirection",operator:D.slice(ut,yt),span:Object.freeze({start:ut,end:xt}),...bt?{target:bt.word}:{}})),bt)at.push(...bt.issues),lt.nested.push(...bt.nested),ct+=bt.words,dt||=bt.limited;lt.end=xt,ut=xt;continue}if(mt===","){lt.start=lt.start===-1?ut:lt.start,lt.words.push(Ka({text:",",raw:",",span:{start:ut,end:ut+1},provenance:"literal",quoted:!1})),lt.end=++ut;continue}let ht=_d(D,ut,z,ee,te);if(lt.start=lt.start===-1?ut:lt.start,lt.end=ht.next,lt.words.push(ht.word),at.push(...ht.issues),lt.nested.push(...ht.nested),ct+=1+ht.words,dt||=ht.limited,ct>ee.maxWords)return at.push({code:"word-limit",message:`command exceeds ${ee.maxWords} words`}),ft(),{nodes:je,issues:at,next:ht.next,closed:!1,words:ct,limited:!0};ut=ht.next>ut?ht.next:ut+1}return ft(),{nodes:je,issues:at,next:ut,closed:!he,words:ct,limited:dt}}function _d(D,N,z,ee,te){let he="",je="literal",at=!1,lt=[],ct=[],dt=0,ft=!1,ut=(pt)=>{let gt=tC(D,pt,z,ee,te);return he+=D.slice(pt,gt.next),ct.push(gt.program),lt.push(...gt.program.issues),dt+=tl(gt.program),ft||=gt.program.status==="limited",je="command-substitution",gt.next},mt=N;while(mt<z){let pt=D[mt];if(!pt||/\s/.test(pt)||Od(D,mt)||pt===">"||pt==="<"||pt==="#")break;if(pt===",")break;if(pt==="`"){let gt=D[mt+1];if(!gt){lt.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),mt++;break}he+=gt,mt+=2;continue}if(D.startsWith("$(",mt)){mt=ut(mt);continue}if(pt==="'"){at=!0,mt++;let gt=!1;while(mt<D.length){if(D[mt]==="'"&&D[mt+1]==="'"){he+="'",mt+=2;continue}if(D[mt]==="'"){gt=!0,mt++;break}he+=D[mt]??"",mt++}if(!gt)lt.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(pt==='"'){at=!0,mt++;let gt=!1;while(mt<z){let ht=D[mt];if(ht==="`"&&D[mt+1]){he+=D[mt+1],mt+=2;continue}if(ht==='"'){gt=!0,mt++;break}if(D.startsWith("$(",mt)){mt=ut(mt);continue}if(ht==="$")je=D[mt+1]==="("?"command-substitution":"variable";he+=ht??"",mt++}if(!gt)lt.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(pt==="$")je=D[mt+1]==="("?"command-substitution":"variable";if(pt==="@"&&mt===N)je="variable";he+=pt,mt++}return{word:Zr(D,N,mt,he,je,at,je==="literal"?void 0:nC(D,N,mt)),next:mt,issues:lt,nested:ct,words:dt,limited:ft}}function tC(D,N,z,ee,te){let he=Id(D,N+2,z),je=he===-1?z:he,at=he===-1?z:he+1;if(te>=ee.maxDepth)return{program:ln({kind:"program",dialect:"powershell",source:D.slice(N+2,je),span:{start:N+2,end:je},status:"limited",issues:[kd(ee.maxDepth)],nodes:[]}),next:at};let lt=ol(D,N+2,je,ee,te+1),ct=he===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:ln({kind:"program",dialect:"powershell",source:D.slice(N+2,je),span:{start:N+2,end:je},status:lt.limited?"limited":lt.issues.length+ct.length>0?"partial":"complete",issues:[...lt.issues,...ct],nodes:lt.nodes}),next:at}}function Id(D,N,z){let ee=1,te=!1,he=!1;for(let je=N;je<z;je++){let at=D[je];if(at==="`"){je++;continue}if(!he&&at==="'"){if(te&&D[je+1]==="'"){je++;continue}te=!te;continue}if(!te&&at==='"'){he=!he;continue}if(te)continue;if(D.startsWith("$(",je)){ee++,je++;continue}if(!he&&at==="(")ee++;if(at!==")")continue;if(ee--,ee===0)return je}return-1}function tl(D){let N=0;for(let z of D.nodes){if(z.kind==="group")N+=tl(z.body);if(z.kind==="command"){N+=z.words.length;for(let ee of z.nested)N+=tl(ee)}}return N}function nC(D,N,z){let ee=$i(D),te=N,he=!1,je=N;while(je<z){let at=D[je];if(at==="`"){je+=2;continue}if(at==="'"){if(he&&D[je+1]==="'"){je+=2;continue}he=!he,je++;continue}if(he){je++;continue}if(D.startsWith("$(",je)){let lt=Id(D,je+2,z),ct=lt===-1?z:lt+1;ee.push(te,je,"literal"),ee.push(je,ct,"command-substitution"),je=ct,te=ct;continue}if(at==="$"||at==="@"&&je===N){let lt=rC(D,je+1,z);ee.push(te,je,"literal"),ee.push(je,lt,"variable"),je=lt,te=lt;continue}je++}return ee.push(te,z,"literal"),ee.parts}function rC(D,N,z){if(D[N]==="{"){let te=D.indexOf("}",N+1);return te===-1||te>=z?z:te+1}let ee=N;while(ee<z&&/[A-Za-z0-9_:?]/.test(D[ee]??""))ee++;return ee}function kd(D){return{code:"depth-limit",message:`command structure exceeds parser limit ${D}`}}function nl(D){return D.nodes.flatMap((N)=>{if(N.kind==="group")return nl(N.body);if(N.kind!=="command")return[];return[[...N.words,...N.redirections.flatMap((z)=>z.target?[z.target]:[])].sort((z,ee)=>z.span.start-ee.span.start).filter((z)=>z.text!==""&&z.raw!==",").map((z)=>z.text),...N.nested.flatMap(nl)]})}function Od(D,N){for(let z of["&&","||",";","|"])if(D.startsWith(z,N))return z;return null}function oC(D,N,z,ee){if(D[N]==="#"&&D[N+1]!==">"){let je=N+1;while(je<z&&D[je]!=="\r"&&D[je]!==`
+`)je++;return{next:je,limited:!1}}if(!D.startsWith("<#",N))return null;let te=1,he=N+2;while(he<z){if(D.startsWith("<#",he)){if(te++,te>ee)return{next:z,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${ee}`},limited:!0};he+=2;continue}if(D.startsWith("#>",he)){if(te--,he+=2,te===0)return{next:he,limited:!1};continue}he++}return{next:z,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function iC(D,N){if(N)return"limited";if(D.some((z)=>z.code==="unclosed-block-comment"))return"invalid";return D.length>0?"partial":"complete"}function el(D,N,z){return Object.freeze({kind:"connector",operator:D.slice(N,z),span:Object.freeze({start:N,end:z})})}function h(D,N="auto",z=or){if(N==="powershell"||N==="auto"&&Ad(D.slice(0,z.maxInputLength),z))return rl(D,z);return gd(D,z)}function t(D){return D.provenance==="command-substitution"?D.raw:D.text}function Q(D,N){return D==="posix"?N:Ut(N.map((z)=>z.text))}function Zi(D,N){return D&&D.provenance!=="unknown"?D.provenance==="literal":!/[$`*?[\]]/.test(N)}function Ut(D){return D.map((N)=>({kind:"word",text:N,raw:N,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function il(D,N){return{value:D,work:N}}function St(D,N){if(D.work)D.work.units=Math.min(Number.MAX_SAFE_INTEGER,D.work.units+1);return D.value[N]}function jt(D){return D.value.length}function Go(D,N,z=1){if(D)D.units=Math.min(Number.MAX_SAFE_INTEGER,D.units+N.length*z)}function Sn(D,N){Go(D,N)}function _r(D){if(!D)return!1;let N=D.charCodeAt(0);return N>=48&&N<=57||N>=65&&N<=90||N===95||N>=97&&N<=122}function zt(D){if(!D)return!1;let N=D.charCodeAt(0);return N===9||N===10||N===11||N===12||N===13||N===32||N===160||N===65279||N===5760||N>=8192&&N<=8202||N===8232||N===8233||N===8239||N===8287||N===12288}function sl(D){return D===`
+`||D==="\r"||D==="\u2028"||D==="\u2029"}function Bt(D,N,z){if(N+z.length>jt(D))return!1;for(let ee=0;ee<z.length;ee++)if(St(D,N+ee)!==z[ee])return!1;return!0}function Kn(D,N,z){return!_r(St(D,N-1))&&Bt(D,N,z)&&!_r(St(D,N+z.length))}function qn(D,N){return _r(St(D,N-1))!==_r(St(D,N))}function Qt(D){return D===`
+`||D===";"||D==="&"||D==="|"}function Jr(D){return D==="|"||D===";"}function Xi(D,N,z){let ee=il(D,z);if(N==="rm")return sC(ee);if(N==="dd")return lC(ee);return Gd(ee,!0)}function Ji(D,N,z){let ee=il(D,z);if(N==="rm")return cC(ee);if(N==="reset-hard")return Ld(ee,"--ha","rd");if(N==="reset-merge")return Ld(ee,"--me","rge");if(N==="clean")return mC(ee);if(N==="checkout")return gC(ee);if(N==="push-force")return hC(ee);if(N==="push-refspec")return yC(ee);if(N==="push-delete")return bC(ee);if(N==="branch")return CC(ee);if(N==="tag")return EC(ee);if(N==="restore")return xC(ee);return Gd(ee,!1)}function sC(D){let N=!1,z=!1,ee=!1,te=-1;for(let he=0;he<=jt(D);he++){let je=St(D,he);if(!N){let lt=St(D,he+2);if(Kn(D,he,"rm")&&zt(lt)&&lt!==`
+`)N=!0,he++;continue}let at=aC(D,he);if(je===`
+`||at!==-1){if(N=!1,z=!1,ee=!1,te=-1,at!==-1)he=at-1;continue}if(je===";"||je==="&"||je==="|"||he===jt(D)){if(te>=0){let lt=Md(D,te,he);z||=lt.recursive,ee||=lt.force}if(z&&ee)return!0;N=!1,z=!1,ee=!1,te=-1;continue}if(zt(je)){if(te<0)continue;if(Bt(D,te,"--")&&he-te===2){N=!1,z=!1,ee=!1,te=-1;continue}let lt=Md(D,te,he);if(z||=lt.recursive,ee||=lt.force,z&&ee)return!0;te=-1;continue}if(te<0)te=he}return!1}function aC(D,N){if(St(D,N)!=="\\"||St(D,N-1)==="\\")return-1;if(Bt(D,N,String.raw`\n`))return N+2;if(Bt(D,N,String.raw`\x0a`)||Bt(D,N,String.raw`\x0A`))return N+5;if(Bt(D,N,String.raw`\u000a`)||Bt(D,N,String.raw`\u000A`))return N+7;return Bt(D,N,String.raw`\012`)?N+4:-1}function Md(D,N,z){if(Dd(D,N,z,"recursive"))return{recursive:!0,force:!1};if(Dd(D,N,z,"force"))return{recursive:!1,force:!0};if(St(D,N)!=="-"||St(D,N+1)==="-")return{recursive:!1,force:!1};let ee=!1,te=!1;for(let he=N+1;he<z;he++){let je=St(D,he);ee||=je==="r"||je==="R",te||=je==="f"||je==="F"}return{recursive:ee,force:te}}function Dd(D,N,z,ee){let te=z-N-2;if(te<1||te>ee.length||!Bt(D,N,"--"))return!1;for(let he=0;he<te;he++)if(St(D,N+he+2)!==ee[he])return!1;return!0}function lC(D){let N=!1;for(let z=0;z<jt(D);z++){if(Qt(St(D,z))){N=!1;continue}if(Kn(D,z,"dd")){N=!0,z++;continue}if(!N||!Kn(D,z,"of")||!Bt(D,z,"of=/dev/"))continue;let ee=z+8;if(ee<jt(D)&&!zt(St(D,ee))&&St(D,ee)!=="'"&&St(D,ee)!=='"')return!0}return!1}function cC(D){let N=!1,z=!1,ee=!1;for(let te=0;te<=jt(D);){let he=St(D,te);if(te===jt(D)||Qt(he)){N=!1,z=!1,ee=!1,te++;continue}let je=dC(D,te);if(je>=0){if(uC(D,je))return!0;let at=je,lt=!1;while(zt(St(D,at)))lt||=St(D,at)===`
+`,at++;if(lt)z=!1,ee=!1;N=!0,te=at;continue}if(!N){te++;continue}if(Bt(D,te,"--")&&(te===0||zt(St(D,te-1)))&&(!St(D,te+2)||zt(St(D,te+2))||Qt(St(D,te+2)))){N=!1,z=!1,ee=!1,te+=2;continue}if(z||=Bt(D,te,"--recursive")&&qn(D,te+11)||al(D,te,"recursive"),ee||=Bt(D,te,"--force")&&qn(D,te+7)||al(D,te,"force"),z&&ee)return!0;te++}return!1}function al(D,N,z){if(!Bt(D,N,"--"))return!1;let ee=0;while(ee<=z.length){let te=St(D,N+ee+2);if(!te||zt(te)||Qt(te))break;if(te!==z[ee])return!1;ee++}return ee>0&&qn(D,N+ee+2)}function uC(D,N){let z=N,ee=!1,te=!1;while(z<jt(D)){while(zt(St(D,z)))z++;let he=z;while(z<jt(D)&&!zt(St(D,z)))z++;if(St(D,he)!=="-"||z-he===2&&Bt(D,he,"--"))return!1;let je=Nd(D,he,"recursive"),at=Nd(D,he,"force");if(ee&&at||te&&je)return!0;if(ee||=je,te||=at,St(D,he+1)==="-")continue;let lt=fC(D,he,z);if(lt.combined||ee&&lt.forceAtBoundary||te&&lt.recursiveAtBoundary)return!0;ee||=lt.recursive,te||=lt.force}return!1}function Nd(D,N,z){return Bt(D,N,`--${z}`)&&qn(D,N+z.length+2)||al(D,N,z)}function dC(D,N){if(N>0&&_r(St(D,N-1)))return-1;let z=N;if(St(D,z)==="\\")z++;if(St(D,z)!=="r")return-1;if(z++,St(D,z)==="\\")z++;if(St(D,z)!=="m"||!zt(St(D,z+1)))return-1;return z+1}function fC(D,N,z){let ee=!1,te=!1,he=!1,je=!1,at=!1;if(St(D,N)!=="-")return{recursive:ee,force:te,recursiveAtBoundary:he,forceAtBoundary:je,combined:at};let lt="";for(let ct=N+1;ct<z;ct++){let dt=St(D,ct)??"",ft=(dt==="r"||dt==="f")&&qn(D,ct+1);ee||=dt==="r",te||=dt==="f",he||=dt==="r"&&ft,je||=dt==="f"&&ft,at||=(lt==="r"&&dt==="f"||lt==="f"&&dt==="r")&&ft,lt=dt}return{recursive:ee,force:te,recursiveAtBoundary:he,forceAtBoundary:je,combined:at}}function Ld(D,N,z){return zo(D,"reset",Jr,!0,(ee)=>St(D,ee)==="-"&&Qr(D,ee,N,z)?!0:ee)}function mC(D){return zo(D,"clean",Jr,!0,(N)=>{if(St(D,N)!=="-")return N;if(Qr(D,N,"--fo","rce"))return!0;let z=Fo(D,N,Jr);for(let ee=N+1;ee<z;ee++)if(St(D,ee)==="f")return!0;return z-1})}function Qi(D,N,z){if(!Kn(D,N,"git"))return null;let ee=N+3;if(!zt(St(D,ee)))return{commandEnd:-1,next:ee};while(zt(St(D,ee)))ee++;while(ee<jt(D)){if(Qt(St(D,ee)))return{commandEnd:-1,next:ee};let te=Fo(D,ee,Qt);if(Kn(D,ee,z))return{commandEnd:ee+z.length,next:te};if(St(D,ee)!=="-")return{commandEnd:-1,next:te};let he=te-ee===2&&Bt(D,ee,"--"),je=pC(D,ee,te);ee=te;while(zt(St(D,ee)))ee++;if(he)return{commandEnd:Kn(D,ee,z)?ee+z.length:-1,next:Fo(D,ee,Qt)};if(!je)continue;if(ee>=jt(D)||Qt(St(D,ee)))return{commandEnd:-1,next:ee};ee=Fo(D,ee,Qt);while(zt(St(D,ee)))ee++}return{commandEnd:-1,next:ee}}function pC(D,N,z){for(let ee of yn)if(z-N===ee.length&&Bt(D,N,ee))return!0;return!1}function gC(D){return Wd(D,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function hC(D){return zo(D,"push",Jr,!0,(N)=>{if(St(D,N)!=="-")return N;if(St(D,N+1)==="f"&&!_r(St(D,N+2))&&!Bt(D,N+2,"-with-lease"))return!0;let z=Fd(D,N,"--fo","rce");if(z>=0&&!Bt(D,z,"-with-lease"))return!0;return N})}function yC(D){return zo(D,"push",Qt,!1,(N)=>{if(zt(St(D,N))&&St(D,N+1)==="+"&&N+2<jt(D)&&!Qt(St(D,N+2))&&!zt(St(D,N+2)))return!0;if(St(D,N)===":"&&St(D,N+1)==="+")return!0;return N})}function bC(D){return zo(D,"push",Qt,!1,(N)=>{if(St(D,N)==="-"&&Qr(D,N,"--de","lete"))return!0;if(zt(St(D,N))&&St(D,N+1)===":"&&N+2<jt(D)&&!zt(St(D,N+2))&&!Qt(St(D,N+2)))return!0;return N})}function CC(D){let N=!1,z=!1,ee=!1;for(let te=0;te<=jt(D);te++){if(te===jt(D)||Qt(St(D,te))){if(z&&ee)return!0;N=!1,z=!1,ee=!1;continue}if(!N){let at=Qi(D,te,"branch");if(at){N=at.commandEnd>=0,te=Math.max(te,(N?at.commandEnd:at.next)-1);continue}}if(!N||St(D,te)!=="-")continue;let he=Fo(D,te,Qt),je=SC(D,te,he);if(z||=je.deletion,ee||=je.force,z&&ee)return!0;te=he-1}return!1}function SC(D,N,z){let ee=!1,te=!1;for(let he=N;he<z;he++){if(St(D,he)!=="-")continue;if(Qr(D,he,"--de","lete"))ee=!0;if(Qr(D,he,"--fo","rce"))te=!0;if(St(D,he+1)==="-")continue;let je=he+1,at=!1,lt=!1,ct=!1;while(je<z&&vC(St(D,je))){let dt=St(D,je);at||=dt==="d"||dt==="D",lt||=dt==="f",ct||=dt==="D",je++}if(!qn(D,je))continue;ee||=at,te||=lt||ct}return{deletion:ee,force:te}}function vC(D){if(!D)return!1;let N=D.charCodeAt(0);return N>=65&&N<=90||N>=97&&N<=122}function EC(D){return Wd(D,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Wd(D,N){let z=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let ee=0;ee<jt(D);ee++){let te=St(D,ee),he=z[z.length-1];if(!he)return!1;let je=he.escaped;if(he.escaped=!je&&he.quote!=="'"&&te==="\\",!je&&te==="'"&&he.quote!=='"')he.quote=he.quote==="'"?"":"'";if(!je&&te==='"'&&he.quote!=="'")he.quote=he.quote==='"'?"":'"';if(te==="$"&&St(D,ee+1)==="("&&(z.length===1||!je&&he.quote!=="'")){z.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),ee++;continue}if(!je&&!he.quote&&z.length>1&&te==="("){he.depth++;continue}if(!je&&!he.quote&&z.length>1&&te===")"){if(he.depth--,he.depth===0)z.pop();continue}if(zt(te))he.shortActive=!1,he.hasShortFlag=!1;if(!he.outerActive){let at=Qi(D,ee,N.command);if(at){he.outerActive=at.commandEnd>=0&&zt(St(D,at.commandEnd)),he.shortActive=!1,he.hasShortFlag=!1,ee=Math.max(ee,(he.outerActive?at.commandEnd:at.next)-1);continue}}if(he.outerActive&&te==="-"){if(Qr(D,ee,N.longPrefix,N.longOptional))return!0;he.shortActive||=!N.excludedShortStarts.includes(St(D,ee+1)??"")}if(he.hasShortFlag||=he.shortActive&&te===N.shortFlag,he.hasShortFlag&&qn(D,ee+1))return!0;if(Jr(te))he.outerActive=!1}return!1}function zo(D,N,z,ee,te){let he=!1;for(let je=0;je<jt(D);je++){let at=St(D,je),lt=z(at);if(!he&&!lt){let ct=Qi(D,je,N);if(ct){he=ct.commandEnd>=0&&(!ee||zt(St(D,ct.commandEnd))),je=Math.max(je,(he?ct.commandEnd:ct.next)-1);continue}}if(he){let ct=te(je);if(ct===!0)return!0;for(let dt=je;dt<=ct;dt++)if(z(St(D,dt)))he=!1;je=ct}if(lt)he=!1}return!1}function xC(D){let N=!1;for(let z=0;z<jt(D);z++){if(sl(St(D,z))){if(N)return!0;N=!1;continue}if(!N){let ee=Qi(D,z,"restore");if(ee){N=ee.commandEnd>=0,z=Math.max(z,(N?ee.commandEnd:ee.next)-1);continue}}if(N&&St(D,z)==="-"&&St(D,z+1)==="-"&&(Bt(D,z+2,"staged")||Bt(D,z+2,"help")))N=!1}return N}function Gd(D,N){let z=!1;for(let ee=0;ee<jt(D);ee++){let te=St(D,ee),he=N?sl(te):Qt(te);if(z&&zt(te)&&St(D,ee+1)==="-"&&Kn(D,ee+2,"delete"))return!0;if(he){z=!1;continue}if(Kn(D,ee,"find"))z=!0,ee+=3}return!1}function Fo(D,N,z){let ee=N;while(ee<jt(D)&&!zt(St(D,ee))&&!z(St(D,ee)))ee++;return ee}function Fd(D,N,z,ee){if(!Bt(D,N,z))return-1;let te=N+z.length;for(let he=0;he<ee.length&&St(D,te)===ee[he];he++)te++;return qn(D,te)?te:-1}function Qr(D,N,z,ee){return Fd(D,N,z,ee)>=0}function _n(D,N){Go(N,D,2);let z=D.toLowerCase(),ee=z.trimStart(),te=ee.startsWith("echo ")||ee.startsWith("rg "),he=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let je of he){if(je.skipForEchoRg&&te)continue;let at=je.caseSensitive?D:z;if(je.regex)Sn(N,at);if((je.regex?.test(at)??!1)||je.scan&&Ji(at,je.scan,N))return vt("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${je.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var RC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Bd(D,N,z){let ee=D.words[0];if(!N||!ee||D.words.length!==1||D.dialect!=="posix")return!1;if(!ee.quoted||ee.provenance!=="literal")return!1;let te=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(ee.text)?.[1];if(!te)return!1;Go(z,N.source,2);let he={anchored:new RegExp(`^\\$\\{?${te}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${te}(?![A-Za-z0-9_])`)};return $d(N.nodes,ee,he)}function $d(D,N,z){return D.every((ee)=>{if(ee.kind==="connector")return!0;if(ee.kind==="group"||ee.kind==="function")return $d(ee.body.nodes,N,z);if(ee.kind==="unknown")return!z.loose.test(ee.source);return _C(ee,N,z)})}function _C(D,N,z){if(D.nested.some((te)=>z.loose.test(te.source)))return!1;let ee=D.words.findIndex((te)=>!RC.test(te.text));return D.words.every((te,he)=>te===N||zd(te.raw,z.anchored,he!==ee))&&D.redirections.every((te)=>(!te.heredoc||te.heredoc.quotedDelimiter||!z.loose.test(te.heredoc.body))&&(!te.target||zd(te.target.raw,z.anchored,!0)))}function zd(D,N,z){let ee=!1,te=!1;for(let he=0;he<D.length;he++){let je=D[he];if(je==="\\"&&!ee){he++;continue}if(!te&&je==="'"){ee=!ee;continue}if(!ee&&je==='"'){te=!te;continue}if(ee||je!=="$")continue;if(!N.test(D.slice(he)))continue;if(!te||!z)return!1}return!0}import{isAbsolute as wC,resolve as Ud}from"node:path";function Bo(D,N,z,ee){let te=wC(D)?Ud(D):N?Ud(N,D):void 0;if(!te)return;try{return Mt(te,z,ee)}catch{return te}}function Hd(D){return!["/dev","/proc","/sys"].some((N)=>D===N||D.startsWith(`${N}/`))}var eo="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",$o="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",cl=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),PC=new Set(["-p","--print"]),AC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),TC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),IC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),kC=new Map([["python",new Set(["m"])]]),OC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),MC=new Set(["always","default","never"]),DC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),NC=/\\\r?\n/g,LC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function jd(D){return ts(D).code}function es(D){return ts(D).sources}function Vd(D){return LC.get(dl(D))??[]}function ts(D){let N=dl(D[0]??"");if(!cl.has(N))return{code:null,sources:[],optionsOpen:!1};let z=[],ee=[],te=!0;for(let he=1;he<D.length;he++){let je=D[he];if(je===void 0)break;if(je==="--")return In(N,z,ee,te,D[he+1]===void 0?void 0:he+1,D[he+1]);if(je===""||je==="-"||!je.startsWith("-"))return In(N,z,ee,te,he,je);if(N==="node"&&PC.has(je)){let ft=D[he+1];if(ft===void 0)return In(N,z,ee,te);if(ft.startsWith("-"))continue;z.push({tokenIndex:he+1,value:ft}),ee.push({tokenIndex:he+1,kind:"inline-code",value:ft}),he++;continue}if(GC(N,je)){let ft=D[he+1];if(ft===void 0)return In(N,z,ee,te);if(z.push({tokenIndex:he+1,value:ft}),ee.push({tokenIndex:he+1,kind:"inline-code",value:ft}),N==="python")return In(N,z,ee,te);he++;continue}let at=/^--eval=(.*)$/s.exec(je);if(FC(N)&&at){let ft=at[1]??"";z.push({tokenIndex:he,value:ft}),ee.push({tokenIndex:he,kind:"inline-code",value:ft});continue}if(N==="node"){let ft=WC(je);if(ft){if(ft.attached){if(te&&=ft.value!=="",ft.value!=="")ee.push({tokenIndex:he,kind:"module-file",value:ft.value});continue}let ut=D[he+1];if(ut===void 0||ut.startsWith("-"))return te=!1,In(N,z,ee,te);ee.push({tokenIndex:he+1,kind:"module-file",value:ut}),he++;continue}}if(N==="python"&&je.startsWith("--check-hash-based-pycs=")||N==="node"&&(je==="--conditions="||je==="--diagnostic-dir="||je==="--title=")||N==="ruby"&&(je==="--disable="||je==="--enable="))return In(N,z,ee,te);if(OC.get(N)?.has(je)){let ft=D[he+1];if(ft===void 0||ft.startsWith("-")&&!(N==="ruby"&&DC.has(je))||N==="python"&&!MC.has(ft))return In(N,z,ee,te);he++;continue}if(je.startsWith("--"))continue;let lt,ct=!1;for(let ft=1;ft<je.length;ft++){let ut=je[ft];if(ut===void 0)break;if(kC.get(N)?.has(ut)){let mt=je.slice(ft+1),pt=mt||D[he+1];if(pt!==void 0)ee.push({tokenIndex:mt?he:he+1,kind:"module-file",value:pt});return In(N,z,ee,te)}if(AC.get(N)?.has(ut)){lt=je.slice(ft+1)||D[he+1],ct=ft+1===je.length;break}if(N==="node"&&ut==="r"){if(te&&=je==="-r",je==="-r"){let mt=D[he+1];if(te&&=mt!==void 0&&!mt.startsWith("-"),te&&mt!==void 0)ee.push({tokenIndex:he+1,kind:"module-file",value:mt});he++}break}if(N==="ruby"&&ut==="r"){let mt=je.slice(ft+1),pt=mt||D[he+1];if(te&&=pt!==void 0,pt!==void 0)ee.push({tokenIndex:mt?he:he+1,kind:"module-file",value:pt});if(!mt)he++;break}if(N==="perl"&&(ut==="M"||ut==="m")){let mt=je.slice(ft+1);if(!mt){if(te=!1,ft+1===je.length)he++;break}ee.push({tokenIndex:he,kind:"module-file",value:mt});break}if(TC.get(N)?.has(ut)){if(ft+1===je.length)he++;break}if(IC.get(N)?.has(ut)&&ft+1<je.length)break}if(lt===void 0)continue;let dt=ct?he+1:he;if(z.push({tokenIndex:dt,value:lt}),ee.push({tokenIndex:dt,kind:"inline-code",value:lt}),N==="python")return In(N,z,ee,te);if(ct)he++}return In(N,z,ee,te,void 0,void 0,!0)}function In(D,N,z,ee,te,he,je=!1){let at=D==="node"?N.slice(-1):N,lt=new Set(at.map((dt)=>dt.tokenIndex)),ct=z.filter((dt)=>dt.kind!=="inline-code"||lt.has(dt.tokenIndex));if(ee&&N.length===0&&te!==void 0&&he!==void 0)ct.push({tokenIndex:te,kind:"main-script",value:he});return{code:(D==="node"?at[0]?.value:at.map((dt)=>dt.value).join(`
+`))||null,sources:ee?ct:[],optionsOpen:ee&&je}}function WC(D){for(let N of["--import","--loader","--experimental-loader","--require"]){if(D===N)return{attached:!1,value:""};if(D.startsWith(`${N}=`))return{attached:!0,value:D.slice(N.length+1)}}return}function ul(D,N){return dl(D)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(N)}function dl(D){let N=Pt(D).toLowerCase();return wi.test(N)?"python":N}function GC(D,N){return cl.get(D)?.has(N)??!1}function FC(D){return cl.get(D)?.has("--eval")??!1}function Uo(D,N,z=!1){let ee=$C(D,N);if(!ll(ee,N))return!1;Sn(N,ee);let te=BC(ee);if(ll(te,N))return!0;if(Sn(N,te),!Kd.test(te))return!1;return!z||zC(ee,N)}function zC(D,N){if(/`|%x|\bqx\b/.test(D))return!0;let ee=D.split(""),te=[];for(let lt=0;lt<D.length;lt++){let ct=D[lt];if(ct!=="'"&&ct!=='"')continue;let dt=D.startsWith(ct.repeat(3),lt)?ct.repeat(3):ct,ft=lt+dt.length,ut=ft;while(ut<D.length&&!D.startsWith(dt,ut))ut+=D[ut]==="\\"?2:1;if(ut>=D.length)return!0;te.push({start:ft,text:D.slice(ft,ut)}),ee.fill(" ",lt,ut+dt.length),lt=ut+dt.length-1}let he=ee.join(""),je=Array.from(he.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((lt)=>Kd.test(lt[1]??"")).map((lt)=>{let ct=lt.index+lt[0].length;return{start:ct,end:fl(he,ct)}});if(je.some((lt)=>ml(he,lt.start)))return!0;return te.some((lt)=>{let ct=/\b(?:system|exec|spawn|popen)\s*$/.test(he.slice(0,lt.start)),dt=je.some((ft)=>lt.start>=ft.start&&lt.start<ft.end);return(ct||dt)&&ll(lt.text,N)})}function fl(D,N){let z=1;for(let ee=N;ee<D.length;ee++){if(D[ee]==="(")z++;if(D[ee]===")")z--;if(z===0)return ee}return D.length}function ml(D,N){let z=0;for(let ee=N;ee<D.length;ee++){let te=D[ee]??"";if("([{".includes(te))z++;if(")]}".includes(te)&&z--===0)return!1;if(te===","&&z===0)return!1;if(/[A-Za-z_$]/.test(te))return!0}return!1}var Kd=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function BC(D){let N=[],z=0,ee=0;while(ee<D.length){let te=D[ee];if(te!=="'"&&te!=='"'){ee++;continue}let he=D.startsWith(te.repeat(3),ee)?te.repeat(3):te,je=ee+he.length;while(je<D.length&&!D.startsWith(he,je))je+=D[je]==="\\"?2:1;if(je>=D.length)break;N.push(D.slice(z,ee)," "),ee=je+he.length,z=ee}return N.push(D.slice(z)),N.join("")}function ll(D,N){if(Xi(D,"rm",N))return!0;for(let ee of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Sn(N,D),ee.test(D))return!0;if(Xi(D,"dd",N))return!0;for(let ee of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Sn(N,D),ee.test(D))return!0;if(Xi(D,"find",N))return!0;let z=D.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((ee)=>(Sn(N,D),z.some((te)=>Ji(te,ee))))}function $C(D,N){return Sn(N,D),D.replace(NC,"")}import{lstatSync as FS,readdirSync as zS}from"node:fs";import{basename as BS,isAbsolute as Cf,join as $S,relative as Sf}from"node:path";import{isAbsolute as ef,parse as JC}from"node:path";import{dirname as UC,isAbsolute as HC,parse as jC,sep as VC}from"node:path";function ir(D,N,z){if(nr(N))throw Error("Unsupported Windows namespace path");let ee=HC(N)?jC(N).root:"",te=ee||D;for(let he of qC(ee?N.slice(ee.length):N)){if(he===""||he===".")continue;if(he===".."){te=UC(te);continue}let je=KC(te,he),at=z.entryKind(je),lt=at==="symlink"?z.realpath(je):je;if(at==="missing"||lt===null)throw Error(`Cannot resolve path component: ${je}`);te=lt}return te}function KC(D,N){return D.endsWith("/")||D.endsWith("\\")?`${D}${N}`:`${D}${VC}${N}`}function qC(D){let N=process.platform==="win32"?/[\\/]+/:/\/+/;return D.split(N)}var pl=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],YC=new Set(pl),ZC=1024,qd=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Yd=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),XC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function ns(D){return YC.has(D)}function gl(D){return ns(D)||qd.has(D)||Yd.has(D)||Ro(D)}function Yn(D,N,z){return z?.has(D)?z.get(D):N.get(D)}function Zd(D,N){let z=Yn("GIT_CONFIG_COUNT",D,N);if(z===void 0)return{state:"absent"};if(z==="")return{state:"valid",count:0};if(!/^\d+$/.test(z))return{state:"invalid"};let ee=Number(z);return Number.isSafeInteger(ee)&&ee<=ZC?{state:"valid",count:ee}:{state:"invalid"}}function rs(D,N,z){let te=D.match(XC)?.[1];if(!te||!gl(te))return null;let he=D.indexOf("=");return{name:te,value:`${Yn(te,N,z)??""}${D.slice(he+1)}`}}function Xd(D){return Qd(D,Yd)}function Jd(D){return Qd(D,qd)}function Qd(D,N){if(!D)return!1;for(let z of D.keys())if(N.has(z))return!0;return!1}var nf=/^[A-Za-z_][A-Za-z0-9_]*=/;function wn(D){if(!nf.test(D))return null;let N=D.indexOf("=");return{name:D.slice(0,N),value:D.slice(N+1)}}function ge(D){let N=new Map,z=0;while(z<D.length){let ee=D[z];if(!ee)break;let te=wn(t(ee));if(!te)break;N.set(te.name,te.value),z++}return{words:D.slice(z),envAssignments:N}}function rf(D){let N=It(D);return D.includes("=")||N==="sudo"||N==="env"||N==="command"||N==="builtin"}function wr(D,N,z,ee){if(!rf(to(D)))return{words:D,envAssignments:new Map,cwd:z,rewritten:!1};let te=new Set(D),he=D,je=new Map,at=new Map(ee??[]),lt=[],ct=z;for(let ft=0;ft<a.wrapperPeelIterations.cap;ft++){let ut=tf(he),mt=ge(he);for(let[gt,ht]of mt.envAssignments)je.set(gt,ht),at.set(gt,ht);if(he=mt.words,he.length===0)break;while(he.length>0&&to(he).includes("=")&&!eS(he)){let gt=tS(to(he),at,N.env)??rs(to(he),N.env,at);if(gt)je.set(gt.name,gt.value),at.set(gt.name,gt.value);he=he.slice(1)}if(he.length===0)break;let pt=It(to(he));if(pt!=="sudo"&&pt!=="env"&&pt!=="command"&&pt!=="builtin")break;if(pt==="sudo"){let gt=rS(he,N.paths,ct);if(he=gt.words,gt.cwd!==void 0)ct=gt.cwd}if(pt==="env"){let gt=sS(he,ct,at,N);if(lt.push(...gt.envSplitValues??[]),he=gt.words,gt.cwd!==void 0)ct=gt.cwd;for(let[ht,yt]of gt.envAssignments)je.set(ht,yt),at.set(ht,yt)}if(pt==="command")he=aS(he);if(pt==="builtin")he=he.slice(kn(he,1)==="--"?2:1);if(tf(he)===ut)break}let dt=ge(he);for(let[ft,ut]of dt.envAssignments)je.set(ft,ut),at.set(ft,ut);return{words:dt.words,envAssignments:je,cwd:ct,envSplitValues:lt.length>0?lt:void 0,rewritten:QC(dt.words,te)}}function QC(D,N){return D.some((z)=>!N.has(z))}function tf(D){return D.map(t).join(" ")}function to(D){let N=D[0];return N?t(N):""}function kn(D,N){let z=D[N];return z?t(z):void 0}function eS(D){return nf.test(to(D))}function tS(D,N,z){if(!D.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${N.get("TMPDIR")??z.get("TMPDIR")??""}${D.slice(8)}`}}var nS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function rS(D,N,z){let ee=1,te=z;while(ee<D.length){let he=kn(D,ee);if(!he)break;if(he==="--")return{words:D.slice(ee+1),cwd:te};if(!he.startsWith("-"))break;if(he==="-D"||he==="--chdir"){let je=kn(D,ee+1);te=je?Ho(te,je,N):null,ee+=2;continue}if(he.startsWith("--chdir=")){te=Ho(te,he.slice(8),N),ee++;continue}if(he.startsWith("-D")&&he.length>2){te=Ho(te,he.slice(2),N),ee++;continue}if(he==="-i"||he==="--login"){te=null,ee++;continue}if(nS.has(he)){ee+=2;continue}ee++}return{words:D.slice(ee),cwd:te}}var oS=new Set(["-i","-0","--null"]),iS=new Set(["-u","--unset","-C","--chdir","-P"]);function sS(D,N,z,ee){let te=new Map,he=[],je=N,at=1,lt=(ct)=>({words:D.slice(ct),envAssignments:te,cwd:je,envSplitValues:he.length>0?he:void 0});while(at<D.length){let ct=kn(D,at);if(!ct)break;if(ct==="--")return lt(at+1);if(ct==="-i"||ct==="--ignore-environment"||ct==="-"){te.clear();for(let ft of z.keys())te.set(ft,"");te.set("TMPDIR",""),at++;continue}if(oS.has(ct)){at++;continue}if(ct==="-u"||ct==="--unset"){let ft=kn(D,at+1);if(ft!==void 0)te.set(ft,"");at+=2;continue}if(ct.startsWith("-u")&&ct.length>2&&!ct.startsWith("-u=")){te.set(ct.slice(2),""),at++;continue}if(ct.startsWith("--unset=")){te.set(ct.slice(8),""),at++;continue}let dt=ct==="-S"||ct==="--split-string"?{value:kn(D,at+1),consumed:2}:ct.startsWith("-S")&&ct.length>2?{value:ct.slice(2),consumed:1}:ct.startsWith("--split-string=")?{value:ct.slice(15),consumed:1}:null;if(dt){if(dt.value!==void 0)he.push(dt.value);return je=null,lt(at+dt.consumed)}if(iS.has(ct)){if(ct==="-C"||ct==="--chdir"){let ft=kn(D,at+1);je=ft?Ho(je,ft,ee.paths):null}at+=2;continue}if(ct.startsWith("-u=")){at++;continue}if(ct.startsWith("-C")&&ct.length>2||ct.startsWith("--chdir=")){let ft=ct.startsWith("--chdir=")?ct.slice(8):ct.startsWith("-C=")?ct.slice(3):ct.slice(2);je=Ho(je,ft,ee.paths),at++;continue}if(ct.startsWith("-P")){at++;continue}if(ct.startsWith("-")){at++;continue}if(!wn(ct))break;while(at<D.length){let ft=wn(kn(D,at)??"");if(!ft)break;te.set(ft.name,ft.value),at++}if(kn(D,at)==="--")at++;return lt(at)}return lt(at)}function Ho(D,N,z){if(N==="")return null;if(!D&&!ef(N))return null;let ee=ef(N)?JC(N).root:z.realpath(D??"/");if(ee===null)return null;try{return ir(ee,N,z)}catch{return null}}function aS(D){if(kn(D,1)==="-v")return[...Ut(["type"]),...D.slice(2)];let N=1;while(N<D.length){let z=kn(D,N);if(!z)break;if(z==="-p"||z==="-v"||z==="-V"){N++;continue}if(z==="--")return D.slice(N+1);if(z.startsWith("-")&&!z.startsWith("--")&&z.length>1){if(!/^[pvV]+$/.test(z.slice(1)))break;N++;continue}break}return D.slice(N)}var lS=/['"\\$`{}#]/;function os(D,N){if(D.some((ee)=>lS.test(ee)))return null;let z=[...D.flatMap((ee)=>ee.split(/\s+/).filter((te)=>te.length>0)),...N];return z.length<=64?z:null}function sr(D,N,z){return is(D,N,z).tokens}function cS(D){let N=[],z="",ee=0;while(ee<D.length){let te=D.charAt(ee);if(te==='"'||te==="'"){let he=D.indexOf(te,ee+1);if(he===-1)return D.split(/\s+/).map((je)=>je.replace(/["']/g,"")).filter((je)=>je.length>0);z+=D.slice(ee+1,he),ee=he+1;continue}if(/\s/.test(te)){if(z.length>0)N.push(z);z="",ee++;continue}z+=te,ee++}if(z.length>0)N.push(z);return N}function ar(D,N,z,ee=0){let te=is(D,N,z),he=(te.envSplitValues??[]).flatMap(cS);if(he.length===0)return te.tokens;let je=[...he,...te.tokens];if(ee>=8)return je;return ar(je,N,z,ee+1)}function is(D,N,z,ee){if(!rf(D[0]??""))return{tokens:[...D],envAssignments:new Map,cwd:z};let te=wr(Ut(D),N,z,ee);return{tokens:te.words.map(t),envAssignments:te.envAssignments,cwd:te.cwd,envSplitValues:te.envSplitValues}}var Cl=Symbol("adopt-as-operand"),uS=new Set(["env","sudo","command","builtin"]),dS=new Set(["&&","||","|&","|","&",";"]),fS=new Set(["<<","<<<",">|"]),mS=new Set(["|","|&"]),pS=/[*@#?$!_-]/,gS=/^\w+(?::\w+)*/,hS=Object.freeze([]),jo=Object.freeze({kind:"scope",edge:"enter"}),Vo=Object.freeze({kind:"scope",edge:"exit"}),yS=Object.freeze([]),bS=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Ko=new Set(["bash","sh","zsh","dash","ksh"]),CS=256,cf=new WeakMap;function uf(D,N){let z=N.status==="complete"?new Set(bl(N)):new Set,ee=ES(D,z);if(Ai(ee))return ss("unclosed-quote",ee,N);let te={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},he=Pr(N,{source:ee,suppressed:z,flags:te,depth:0,functions:new Map,powershell:N.dialect==="powershell"});if(te.limited)return ss("structural-limit",ee,N);if(te.invalid)return ss("invalid",ee,N);let je=ss("complete",ee,N,te.assignmentFallbacks);return cf.set(je,Object.freeze(he)),je}function ls(D,N,z,ee,te){let he=te.word??((ft)=>ft),je={cwd:N,variables:new Map,previous:null},at=[],lt=new Set,ct=null,dt=[];for(let ft of df(D)){if(ft.kind==="scope"){if(ft.edge==="enter"){dt.push({state:je,segment:[...at],shellWords:new Set(lt),pipeProducer:ct});continue}let ut=te.segment(at,je,ct,null,lt);if(ut)return ut;let mt=dt.pop();if(mt===void 0)throw Error("scope exit without a matching enter");je=mt.state,at=mt.segment,lt=mt.shellWords,ct=mt.pipeProducer;continue}if(ft.kind==="operator"){if(!ft.boundary)continue;let ut=te.segment(at,je,ct,ft.operator,lt);if(ut)return ut;je=SS(at,je,z,ee),ct=at.length>0&&mS.has(ft.operator)?at:null,at=[],lt=new Set;continue}if(ft.kind==="redirection"){if(ft.fd!==void 0)lt.add(at.length-1);if(ft.target===void 0)continue;let ut=te.redirection({operator:ft.operator,role:ft.role,targetOrder:ft.targetOrder,target:ft.target,...ft.body===void 0?{}:{body:ft.body,consumer:ft.consumer}},je);if(ut===Cl){lt.add(at.length),at.push(he(ft.target));continue}if(ut)return ut;continue}at.push(he(ft.text))}return te.segment(at,je,ct,null,lt)}function cs(D){return df(D).flatMap((N)=>{if(N.kind==="word")return[{kind:"word",text:N.text}];if(N.kind==="operator")return[{kind:"operator",boundary:N.boundary}];if(N.kind==="redirection")return[{kind:"redirection",target:N.target}];return[]})}function cn(D,N){return D.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(z,ee,te,he)=>{let je=N.get(ee);if(je===void 0)return z;let at=te.startsWith(":")?je!=="":!0;if(te.endsWith("-"))return at?je:cn(he,N);return at?cn(he,N):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(z,ee)=>N.get(ee)??z).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(z,ee)=>N.get(ee)??z)}function qo(D){return D.length>0&&D.every((N)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(N))}function SS(D,N,z,ee){let te=qo(D)?new Map([...N.variables,...vS(D,N.variables)]):N.variables,he=sr([...D],z),je=Pt(he[0]??"").toLowerCase()==="cd"?he[1]:void 0;if(!je)return{...N,variables:te};if(je==="-"){if(N.previous===null)return{...N,variables:te};return{cwd:N.previous,variables:te,previous:N.cwd}}return{cwd:rn(cn(je,te),N.cwd,z,ee),variables:te,previous:N.cwd}}function vS(D,N){return D.flatMap((z)=>{let ee=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(z),te=ee?.[2]?.startsWith("=")?ee[2].slice(1):void 0;return ee?.[1]!==void 0&&te!==void 0?[[ee[1],cn(te,N)]]:[]})}function df(D){return cf.get(D)??hS}function ES(D,N){return[...N].reduce((z,ee)=>z.slice(0,ee.start)+" ".repeat(ee.end-ee.start)+z.slice(ee.end),D)}function ss(D,N,z,ee=yS){return Object.freeze({status:D,source:N,program:z,assignmentFallbacks:Object.freeze(ee)})}function Pr(D,N){return D.nodes.flatMap((z,ee)=>xS(z,D,ee,N)).sort((z,ee)=>z.start-ee.start).flatMap((z)=>[...z.events])}function xS(D,N,z,ee){if(D.kind==="connector")return[{start:D.span.start,events:[On(AS(D.operator))]}];if(D.kind==="unknown")return[{start:D.span.start,events:[On(D.source)]}];if(D.kind==="function")return ee.functions.set(D.name,D.body),[];if(D.kind==="group"){let he=D.style!=="subshell",je=ee.source[D.span.end-1]===(he?"}":")"),at=he?ee:{...ee,functions:new Map(ee.functions)};return[{start:D.span.start,events:he?[as("{"),...Pr(D.body,at),...je?[as("}")]:[]]:[jo,On("("),...Pr(D.body,at),...je?[On(")")]:[],Vo]}]}let te=OS(D,ee.functions);if(te){if(ee.depth>=or.maxDepth||++ee.flags.expansions>CS)return ee.flags.limited=!0,[];return[{start:D.span.start,events:[...of(D,ee),as(";"),...Pr(te,{...ee,depth:ee.depth+1}),as(";")]},...sf(D,N,z,ee)]}return[{start:D.span.start,events:of(D,ee)},...sf(D,N,z,ee)]}function of(D,N){return[...D.words.map((z)=>({start:z.span.start,events:mf(z,D,N,!1)})),...D.redirections.map((z)=>({start:z.span.start,events:RS(z,D,N)}))].sort((z,ee)=>z.start-ee.start).flatMap((z)=>z.events)}function RS(D,N,z){let ee=D.operator==="<<-"?"<<":D.operator,te=D.target?mf(D.target,N,z,!0):[],he=te[0],je=he?.kind==="word"?he.text:void 0;return[...D.fd===void 0?[]:[Sl(String(D.fd))],Object.freeze({kind:"redirection",operator:ee,...D.fd===void 0?{}:{fd:D.fd},role:TS(ee),targetOrder:fS.has(ee)?"legacy-segment":"immediate",...je===void 0?{}:{target:je},...D.heredoc&&z.suppressed.has(D.heredoc.bodySpan)?{body:D.heredoc.body,consumer:gf(N)}:{}}),...je===void 0?te:te.slice(1)]}function sf(D,N,z,ee){let te=D.redirections.filter((he)=>he.operator==="<<"||he.operator==="<<-");return[...te.flatMap((he)=>{let je=he.heredoc;if(!je)return[];let at=[Sl(je.delimiter),.../[\r\n]/.test(ee.source[je.terminatorSpan.end]??"")?[On(";")]:[]];if(ee.suppressed.has(je.bodySpan))return[{start:je.bodySpan.start,events:at}];return[{start:je.bodySpan.start,events:[...ff(ee.source.slice(je.bodySpan.start,je.bodySpan.end),ee),...at]}]}),...te.some((he)=>!he.heredoc&&he.target)?_S(N,z,ee):[]]}function _S(D,N,z){let ee=D.nodes.slice(N+1).find((te)=>te.kind==="connector");if(!ee||ee.span.end>=D.span.end)return[];return[{start:ee.span.end,events:ff(z.source.slice(ee.span.end,D.span.end),z)}]}function ff(D,N){if(N.depth>=or.maxDepth)return N.flags.limited=!0,[];let z=h(D,"posix");if(z.status==="limited")return N.flags.limited=!0,[];let ee={invalid:!1,limited:!1,expansions:N.flags.expansions,assignmentFallbacks:N.flags.assignmentFallbacks},te=Pr(z,{source:D,suppressed:new Set,flags:ee,depth:N.depth+1,functions:new Map,powershell:!1});return N.flags.limited||=ee.limited,N.flags.expansions=ee.expansions,te}function mf(D,N,z,ee){let te=[],he={single:!1,double:!1},je="",at=!1,lt=()=>{let ct=at&&!ee?On("glob"):je!==""||D.quoted&&te.length===0?Sl(je):void 0;if(ct)te.push(ct);je="",at=!1};for(let ct of D.parts){if(ct.provenance!=="command-substitution"&&ct.provenance!=="arithmetic"){for(let mt of hl(ct.raw,he,z.flags,z.powershell)){if(typeof mt==="string"){lt(),te.push(On(mt));continue}je+=mt.text,at||=mt.glob}continue}let dt=N.nested.find((mt)=>mt.span.start>=ct.span.start&&mt.span.end<=ct.span.end);if(he.double){let mt=z.source.slice(ct.span.start,ct.span.end);je+=hl(mt,{single:!1,double:!0},z.flags,z.powershell).map((gt)=>typeof gt==="string"?gt:gt.text).join("");let pt=dt?Pr(dt,z).filter((gt)=>gt.kind==="redirection"&&gt.body!==void 0):[];if(pt.length>0)te.push(jo,...pt,Vo);continue}let ft=dt?Pr(dt,z):[];if(ct.raw.startsWith("`")){je+="${}",lt(),te.push(jo,...ft,Vo);continue}if(ct.raw.startsWith("<(")||ct.raw.startsWith(">(")){lt(),te.push(ct.raw.startsWith("<(")?On("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),jo,...ft,...ct.raw.endsWith(")")?[On(")")]:[],Vo);continue}let ut=ct.raw.startsWith("$((")?2:1;je+="${}",lt(),te.push(...Array.from({length:ut},()=>On("(")),...ut===1?[jo]:[],...ft,...ct.raw.endsWith(")".repeat(ut))?Array.from({length:ut},()=>On(")")):[],...ut===1?[Vo]:[])}return lt(),te}function hl(D,N,z,ee){let te=[],he="",je=!1,at=0;while(at<D.length){let lt=D[at]??"";if(!N.single&&!N.double&&(lt==="("||lt===")")){te.push({text:he,glob:je},lt),he="",je=!1,at++;continue}if(ee&&lt==="`"&&!N.single){he+=D[at+1]??"",at+=2;continue}if(N.single&&lt==="'"){N.single=!1,at++;continue}if(N.single){he+=lt,at++;continue}if(N.double){if(lt==='"'){N.double=!1,at++;continue}if(!ee&&lt==="\\"){let ct=D[at+1]??"";he+=['"',"\\","$"].includes(ct)?ct:`\\${ct}`,at+=2;continue}if(lt==="$"){let ct=af(D,at,N,z,ee);he+=ct.text,at=ct.next;continue}he+=lt,at++;continue}if(lt==="'"||lt==='"'){N.single=lt==="'",N.double=lt==='"',at++;continue}if(!ee&&lt==="\\"){let ct=D[at+1]??"";je||=ct==="*"||ct==="?",he+=ct,at+=2;continue}if(lt==="$"){let ct=af(D,at,N,z,ee);he+=ct.text,at=ct.next;continue}je||=lt==="*"||lt==="?",he+=lt,at++}return[...te,{text:he,glob:je}]}function af(D,N,z,ee,te){let he=D[N+1];if(he==="{"){let at=PS(D,N+2);if(at===-1)return ee.invalid=!0,{text:"",next:D.length};let lt=D.slice(N,at+1);return wS(lt,z,ee,te),{text:lt,next:at+1}}if(he!==void 0&&pS.test(he))return{text:`\${${he}}`,next:N+2};let je=(te?gS:/^\w*/).exec(D.slice(N+1))?.[0]??"";return{text:`\${${je}}`,next:N+1+je.length}}function wS(D,N,z,ee){let te=D.slice(2,-1),he=/^[A-Za-z_][A-Za-z0-9_]*/.exec(te)?.[0];if(!he)return;let je=te.slice(he.length),at=[":=","="].find((ct)=>je.startsWith(ct));if(!at)return;let lt=hl(je.slice(at.length),{...N},z,ee);z.assignmentFallbacks.push(...lt.flatMap((ct)=>typeof ct==="string"||!ct.text?[]:[ct.text]))}function PS(D,N){let z=1,ee=N;while(z>0&&ee<D.length){if(D[ee]==="{"&&D[ee-1]==="$")z++;if(D[ee]==="}")z--;ee++}return z===0?ee-1:-1}function AS(D){return/^[\r\n]+$/.test(D)?";":D}function On(D){return Object.freeze({kind:"operator",operator:D,boundary:dS.has(D)})}function as(D){return Object.freeze({kind:"operator",operator:D,boundary:!0})}function Sl(D){return Object.freeze({kind:"word",text:D})}function TS(D){if(D==="<<"||D==="<<<")return"here-data";if(D==="<"||D==="<&")return"file-read";return"file-write"}function Yo(D){return bS.has(D)||/^python\d/.test(D)}var IS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function pf(D,N){let z=N[0];if(z===void 0||!z.startsWith("-"))return N;let ee=IS.get(D)?.has(z)??!1;return pf(D,N.slice(ee?2:1))}function yl(D){let N=D[0];if(N===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(N))return yl(D.slice(1));if(!uS.has(N))return[...D];return yl(pf(N,D.slice(1)))}function gf(D){let N=No(D),z=D.words.findIndex((ee)=>ee.provenance==="literal"&&ee.text===N);return yl(z<0?[]:D.words.slice(z).map((ee)=>ee.text))}function kS(D){let N=gf(D)[0];if(N===void 0)return!1;let z=Pt(N).toLowerCase();return Yo(z)&&!Ko.has(z)}function bl(D){return D.nodes.flatMap((N,z)=>{if(N.kind==="group"||N.kind==="function")return bl(N.body);if(N.kind!=="command")return[];let ee=N.nested.flatMap((at)=>bl(at)),te=N.redirections.flatMap((at)=>at.heredoc?.quotedDelimiter?[at.heredoc.bodySpan]:[]);if(kS(N))return[...ee,...te];let he=D.nodes[z+1];if(he?.kind==="connector"&&(he.operator==="|"||he.operator==="|&")||!DS(N))return ee;return[...ee,...te]})}function OS(D,N){let z=No(D);return z===void 0?void 0:N.get(z)}function lr(D,N){return D!==void 0&&D.provenance==="literal"&&!D.quoted&&D.raw===D.text&&D.text===N}function MS(D){if(lr(D.words[0],"git"))return lr(D.words[1],"commit");if(!lr(D.words[0],"gh")||!lr(D.words[2],"create"))return!1;return lr(D.words[1],"pr")||lr(D.words[1],"issue")}function DS(D){return(lr(D.words[0],"cat")||lr(D.words[0],"tee")||MS(D))&&!D.words.some(lf)&&!D.redirections.some((z)=>lf(z.target))}function lf(D){return D?.parts.some((N)=>N.provenance==="command-substitution"&&N.raw.startsWith(">("))??!1}var hf=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),yf=new Set([...hf,"glob"]),NS=new Set([...yf,"pattern"]);class y extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Zo(D){let N=LS(),z=ne(D.input),ee=[];if((D.route.kind==="command"||D.route.kind==="unknown")&&z)ee.push({usage:"input-candidate",source:z});if(D.route.kind==="command"&&"command"in D&&D.command)ee.push({usage:"declared-command",source:D.command});let te=ee.reduce((he,je)=>{let at=he.findIndex((dt)=>dt.source===je.source);if(at!==-1){let dt=he[at];if(!dt)return he;return he[at]={...dt,usages:[...dt.usages,je.usage]},he}let lt=D.route.kind==="command"?D.route.shell:process.platform==="win32"?"powershell":"posix",ct=N.getCommandProgram(je.source,lt);return he.push({usages:[je.usage],source:je.source,program:ct,shell:N.getShellSyntax(je.source,ct)}),he},[]);return{invocation:{toolName:D.toolName,route:D.route,context:D.context},commands:te,paths:WS(D),store:N}}function un(D,N){return D.commands.find((z)=>z.usages.includes(N))}function Zn(D,N){if(!D.includes("$"))return D;return ta(D,N)}function LS(){let D=new Map,N=new Map,z=new WeakMap,ee=(he,je)=>{let at=`${je}\x00${he}`,lt=N.get(at);if(lt)return lt;let ct=h(he,je);return N.set(at,ct),ct};return{getShellSyntax:(he,je)=>{if(je&&je.source!==he)throw TypeError("Shell syntax source does not match command program source.");let at=je??ee(he,"posix");if(at.status==="limited"){let dt=z.get(at);if(dt)return dt;let ft={status:"structural-limit",source:he,program:at,assignmentFallbacks:[]};return z.set(at,ft),ft}let lt=D.get(he);if(lt)return lt;let ct=uf(he,at);return D.set(he,ct),ct},getCommandProgram:ee}}function WS(D){let N=D.route.kind==="grep"?yf:D.route.kind==="glob"?NS:hf;return[...eu(D.input,N),...D.route.kind==="patch"||typeof D.input==="string"?ru(D.input):[]]}var GS=new Set(["-S","--suffix"]);function no(D,N,z,ee,te){if(D.status==="structural-limit")throw new y;if(D.status!=="complete")return te.findMalformedTarget(D.source);return ls(D,N,z,ee,{segment:(he,je)=>te.findSegmentTarget(he,je),redirection:(he,je)=>he.role==="file-write"&&te.isRedirectionTarget(cn(he.target,je.variables),je)?he.target:null})}function us(D){let N=[],z=null,ee=!1;for(let te=0;te<D.length;te++){let he=D[te];if(he===void 0)break;if(!ee&&he==="--"){ee=!0;continue}if(!ee&&(he==="-t"||he==="--target-directory")){z=D[++te]??null;continue}if(!ee&&he.startsWith("--target-directory=")){z=he.slice(19);continue}if(!ee&&he.startsWith("-t")&&he.length>2){z=he.slice(2);continue}if(!ee&&GS.has(he)){te++;continue}if(!ee&&(he.startsWith("--suffix=")||he.startsWith("--backup=")))continue;if(!ee&&he.startsWith("-"))continue;N.push(he)}return z?{sources:N,destination:z}:{sources:N.slice(0,-1),destination:N.at(-1)??null}}var x="Git metadata and hooks are protected. Ask the user before modifying them.";function vf(D,N,z,ee){let te=D.invocation.context.executionCwd;if(!N)return null;if(D.invocation.route.kind==="patch"||D.invocation.route.kind==="path"||D.invocation.route.kind==="unknown"){if(Ci(D.invocation.toolName))return null;let at=D.paths.find((lt)=>bf(lt,te,N,z,ee,N.entries));return at?{target:at}:null}if(D.invocation.route.kind!=="command")return null;let he=un(D,"input-candidate");if(!he)return null;let je=no(he.shell,te,z,ee,{findSegmentTarget:(at,lt)=>qS(at,lt,N,z,ee),isRedirectionTarget:(at,lt)=>bf(at,lt.cwd,N,z,ee,N.markerFiles),findMalformedTarget:()=>null});return je?{target:je}:null}function Ar(D,N,z,ee,te,he,je=!1){if(!z)return!1;let at=fs(rn(D,N,te,he)),lt=at.replace(/(\/\.?\*+)+$/,"");if(lt!==at&&lt!==""){if(vl(lt,z))return!0;let ct=je||at.slice(lt.length).includes("/."),dt=(ft)=>ct?ds(ft,lt):US(ft,lt);if(z.markerFiles.some(dt))return!0;return ee&&El(z).some(dt)}if(vl(at,z))return!0;return ee&&El(z).some((ct)=>ds(ct,at))}function US(D,N){let z=Sf(N,D);if(z===""||z.startsWith("..")||Cf(z))return!1;return!z.split(/[\\/]/)[0]?.startsWith(".")}function HS(D,N,z,ee,te){return Ar(D,N,z,!0,ee,te)}function jS(D,N,z,ee,te){if(!z)return!1;return vl(fs(rn(D,N,ee,te)),z)}function bf(D,N,z,ee,te,he){let je=fs(rn(D,N,ee,te));return he.includes(je)||xf(je,z)}function Ef(D,N,z,ee,te){if(!z)return!1;return z.hooksDirectories.some((he)=>D.some((je)=>ds(he,fs(rn(je,N,ee,te)))))}function vl(D,N){return N.entries.includes(D)||N.directories.includes(D)||xf(D,N)}function xf(D,N){return N.hooksDirectories.some((z)=>ds(D,z))}var VS=50000;function Rf(D,N){let z=[...new Set(El(D))];if(z.some((te)=>N(BS(te))))return!0;let ee=0;while(z.length>0){let te=z.pop()??"",he=KS(te);if(!he)return!0;if(ee+=he.length,ee>VS)return!0;if(he.some((je)=>N(je.name)))return!0;z.push(...he.filter((je)=>je.isDirectory()).map((je)=>$S(te,je.name)))}return!1}function KS(D){try{let N=FS(D,{throwIfNoEntry:!1});if(!N)return[];if(!N.isDirectory())return N.isSymbolicLink()?null:[];return zS(D,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function El(D){return[...D.entries,...D.directories,...D.hooksDirectories]}function ds(D,N){let z=Sf(N,D);return z===""||!/^\.\.(?:[\\/]|$)/.test(z)&&!Cf(z)}function fs(D){return process.platform==="win32"?D.toLowerCase():D}function qS(D,N,z,ee,te){if(qo(D))return null;let he=ar([...D],ee);if(Pt(he[0]??"").toLowerCase()!=="mv")return null;let je=us(he.slice(1)),at=je.sources.find((lt)=>HS(cn(lt,N.variables),N.cwd,z,ee,te));if(at)return at;return je.destination&&jS(cn(je.destination,N.variables),N.cwd,z,ee,te)?je.destination:null}import{isAbsolute as hs,normalize as nv,parse as rv,posix as Of,resolve as Ir,sep as wl}from"node:path";import{isAbsolute as YS,join as _f,normalize as Af,parse as ZS,sep as wf}from"node:path";var XS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],JS=` 	
+`;function Xo(D,N){if(cr(D,N))return!0;if(!D.has("TMPDIR"))return!1;return!xl(D.get("TMPDIR")??"",N)}function Tr(D,N){if(D.has("TMPDIR"))return xl(D.get("TMPDIR")??"",N);let z=Rl(D,N);if(z===void 0)return!0;return xl(z,N)}function Rl(D,N){return If(D,N,"TMPDIR")}function xl(D,N){if(!D)return!1;if(ev(D))return!1;return ro(D,N)}function cr(D,N){let z=If(D,N,"IFS");return z!==void 0&&z!==""&&z!==JS}function ro(D,N){let z=ms(D,N.paths);if(z===null)return!1;return Tf(N).some((ee)=>oo(z,ee))}function gs(D,N){let z=ms(D,N.paths);if(z===null)return!1;return Tf(N).some((ee)=>ps(ee)===ps(z))}var Pf=new WeakMap;function Tf(D){let N=Pf.get(D);if(N)return N;let z=QS(D);return Pf.set(D,z),z}function QS(D){let N=XS.map((ee)=>ms(ee,D.paths)??Af(ee)),z=ms(D.tmpdir,D.paths);if(!z)return N;if(process.platform==="win32")return[...N,z];if(process.platform==="darwin"&&tv(z))return[...N,z];return N}function ev(D){return/[\s$`*?[]/.test(D)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(D)||/[+@!]\([^)]*\)/.test(D)}function If(D,N,z){return D.has(z)?D.get(z):N.env.get(z)}function tv(D){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(D)}function ms(D,N){try{let z=Af(D);if(!YS(z))return z;let ee=ZS(z).root,te=z.slice(ee.length).split(/[\\/]+/).filter(Boolean),he=ee;for(let je=0;je<te.length;je++){let at=_f(he,te[je]??"");if(N.entryKind(at)==="missing")return _f(at,...te.slice(je+1));let lt=N.realpath(at);if(lt===null)return null;he=lt}return he}catch{return null}}function oo(D,N){let z=ps(D),ee=ps(N);if(z===ee)return!0;let te=ee.endsWith(wf)?ee:`${ee}${wf}`;return z.startsWith(te)}function ps(D){return process.platform==="win32"?D.toLowerCase():D}var ov=process.platform==="win32",kf=64,iv=16384;function Jo(D,N,z,ee){if(D.kind==="temp_target")return null;let te=ee[D.kind];if(D.kind==="dynamic_target"&&!Jt(z,te.id,N.strict))return null;if(D.kind==="within_anchored_cwd"&&!Jt(z,te.id,N.paranoid))return null;return vt(te.id,te.reason)}function Qo(D){let N=Sd(D,kf,kf,iv);return{expandedTargets:N&&"words"in N?N.words:void 0,unsafeBraceExpansion:N!==void 0&&"limited"in N,targetIsLiteral:N===void 0&&D.provenance==="literal"&&(D.quoted||D.raw!==D.text),tmpdirWordSplittingProtected:sv(D)}}function sv(D){let N=D.parts.filter((z)=>z.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(z.raw));return N.length>0&&N.every((z)=>av(D.raw,z.span.start-D.span.start))}function av(D,N){let z=null,ee=!1;for(let te=0;te<N;te++){let he=D[te];if(ee){ee=!1;continue}if(he==="\\"&&z!=="'"){ee=!0;continue}if(z===he){z=null;continue}if(z===null&&(he==="'"||he==='"'))z=he}return z==='"'}function ur(D){let N=D.environment.home,z=D.environment.paths,ee=D.budget??gn();return{anchoredCwd:D.originalCwd??D.cwd??null,resolvedCwd:D.cwd??null,strict:D.strict??!1,paranoid:D.paranoid??!1,trustTmpdirVar:D.allowTmpdirVar??!0,posixShell:D.posixShell??!1,tmpdirWordSplittingUnsafe:D.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:D.trustedTmpdirValue??D.allowTmpdirVar??!0,environment:D.environment,allowRoots:mv(D.allowPaths,N,z,ee),protectedGitMetadata:D.protectedGitMetadata,budget:ee}}function Mn(D,N,z={}){let ee=z.targetIsLiteral??!1;if(!ee&&N.tmpdirWordSplittingUnsafe&&!z.tmpdirWordSplittingProtected&&gv(D))return{kind:"outside_anchored_cwd"};let te=!ee&&Df(D,N.posixShell);if(nr(D))return{kind:"outside_anchored_cwd"};if(Pl(D,ee))return{kind:"root_or_home_target"};if(cv(D,N,ee))return{kind:"root_or_home_target"};if(N.resolvedCwd&&Ar(D,N.resolvedCwd,N.protectedGitMetadata,!0,N.environment,N.budget,!N.posixShell))return{kind:"git_metadata_target"};if(uv(D,N.trustTmpdirVar,N.posixShell,te,ee,z.tmpdirWordSplittingProtected??!1,N.trustedTmpdirValue,N.environment))return{kind:"temp_target"};if(te)return{kind:"dynamic_target"};if(pv(D,N,ee))return{kind:"temp_target"};let he=N.anchoredCwd;if(he){if(!z.skipHomeCwd&&Cv(he,N.environment.home,N.environment.paths,N.budget))return{kind:"home_cwd_target"};if(!z.skipCwdSelf&&[N.resolvedCwd??he,he].some((je)=>Sv(D,N.resolvedCwd??he,N.environment.paths,N.budget,je)))return{kind:"cwd_self_target"};if(vv(D,he,N.resolvedCwd??he,te,ee,N.environment.paths,N.budget))return{kind:"within_anchored_cwd"}}if(lv(D,N,te))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function lv(D,N,z){let ee=D.trim();if(z||!N.resolvedCwd||!N.anchoredCwd||!ee)return!1;if(hs(ee)||ee.startsWith("~"))return!1;if(Al(ee))return!1;if(Nf(N.resolvedCwd,N.anchoredCwd,N.environment.paths,N.budget))return!1;return ro(Ir(N.resolvedCwd,ee),N.environment)}function Mf(D,N,z={}){let{containmentTarget:ee,...te}=z;if(Mn(D,N,te).kind!=="temp_target")return!1;let he=D.trim();if(fv(he))return!1;if(gs(he,N.environment))return!1;return![N.anchoredCwd,N.resolvedCwd].some((je)=>Nf(ee??he,je,N.environment.paths,N.budget))}function Pl(D,N=!1){let z=D.trim(),ee=Of.normalize(z),te=z.replace(/\\/g,"/"),he=ee==="/"?ee:ee.replace(/\/+$/,"");if(he==="/"||he.startsWith("/")&&he.slice(1).split("/").every((je)=>/^\*+$/.test(je)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(te)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(te))return!0;if(!N&&(ee==="~"||ee==="~/"||ee==="~/*"))return!0;if(!N&&(ee==="$HOME"||ee==="$HOME/"||ee==="$HOME/*"))return!0;if(!N&&(ee==="${HOME}"||ee==="${HOME}/"||ee==="${HOME}/*"))return!0;return!1}function cv(D,N,z){let ee=D.trim(),te=z?ee:ee==="*"?".":ee.endsWith("/*")?ee.slice(0,-2):ee;if(!te)return!1;try{let he=hs(te)?te:N.resolvedCwd?Ir(N.resolvedCwd,te):null;if(!he)return!1;let je=dn(Mt(he,N.environment.paths,N.budget));if(je===rv(je).root)return!0;return je===dn(Mt(N.environment.home,N.environment.paths,N.budget))}catch{return!1}}function dn(D){let N=nv(D);if(ov){if(N=N.replace(/\//g,"\\").toLowerCase(),N.length>3&&N.endsWith("\\"))N=N.slice(0,-1);return N}if(N.length>1&&N.endsWith("/"))N=N.slice(0,-1);return N}function uv(D,N,z,ee,te,he,je,at){let lt=D.trim();if(Al(lt))return!1;if(!ee&&ro(lt,at))return!0;return(N||he&&je)&&z&&!te&&dv(lt,z)}function dv(D,N){return["$TMPDIR","${TMPDIR}"].some((z)=>{if(D===z)return!0;if(!D.startsWith(`${z}/`))return!1;return!Df(D.slice(z.length+1),N)})}function fv(D){let N=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(D);if(!N)return!1;return Of.normalize(`/${N[1]??""}`)==="/"}function Al(D){return D.split(/[\\/]+/).includes("..")}function mv(D,N,z,ee){if(!D?.length)return[];return D.flatMap((te)=>{let he=Oo(te.trim(),N);if(!hs(he))return[];try{let je=Mt(he,z,ee);if(Mo(je,Mt(N,z,ee)))return[];return[dn(je)]}catch{return[]}})}function pv(D,N,z){if(N.allowRoots.length===0)return!1;let ee=D.trim();if(Al(ee))return!1;let te=z?ee:Oo(ee,N.environment.home),he=N.resolvedCwd??N.anchoredCwd,je=hs(te)?te:he?Ir(he,te):null;if(!je)return!1;try{let at=dn(Mt(je,N.environment.paths,N.budget));return N.allowRoots.some((lt)=>at===lt||at.startsWith(lt.endsWith(wl)?lt:`${lt}${wl}`))}catch{return!1}}function gv(D){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(D)}function Df(D,N=!1){return D.includes("$")||D.includes("`")||hv(D)||N&&yv(D)}function hv(D){let N=!1;for(let z of D){if(N){N=!1;continue}if(z==="\\"){N=!0;continue}if(z==="*"||z==="?"||z==="[")return!0}return!1}function yv(D){let N=!1;for(let z=0;z<D.length;z++){let ee=D[z];if(N){N=!1;continue}if(ee==="\\"){N=!0;continue}if(ee==="{"&&bv(D,z)||(ee==="+"||ee==="@"||ee==="!")&&D[z+1]==="(")return!0}return!1}function bv(D,N){let z=D.indexOf("}",N+1);if(z===-1)return!1;let ee=D.slice(N+1,z);return ee.includes(",")||ee.includes("..")}function Cv(D,N,z,ee){try{return dn(Mt(D,z,ee))===dn(Mt(N,z,ee))}catch{try{return dn(D)===dn(N)}catch{return!1}}}function Sv(D,N,z,ee,te=N){if(te===N&&(D==="."||D==="./"||D===".\\"))return!0;try{return dn(Mt(Ir(N,D),z,ee))===dn(Mt(te,z,ee))}catch{try{return dn(Ir(N,D))===dn(te)}catch{return!1}}}function vv(D,N,z,ee,te,he,je){let at=z??N;if(!te&&(D.startsWith("~")||D.startsWith("$HOME")||D.startsWith("${HOME}")))return!1;if(ee)return!1;if(D.startsWith("/")||/^[A-Za-z]:[\\/]/.test(D))try{return _l(D,N,he,je)}catch{return!1}if(D.startsWith("./")||D.startsWith(".\\")||!D.includes("/")&&!D.includes("\\"))try{return _l(Ir(at,D),N,he,je)}catch{return!1}if(D.startsWith("../"))return!1;try{return _l(Ir(at,D),N,he,je)}catch{return!1}}function _l(D,N,z,ee){try{return Lf(Mt(D,z,ee),Mt(N,z,ee))}catch{return!1}}function Nf(D,N,z,ee){if(!N)return!1;try{return Lf(Mt(N,z,ee),Mt(D,z,ee))}catch{return!0}}function Lf(D,N){let z=dn(D),ee=dn(N);return z.startsWith(`${ee}${wl}`)||z===ee}var Ev=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Wf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",xv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Gf="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Ff="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",Rv="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",_v="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",wv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Ff},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:x},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Gf},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:Rv},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Wf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:xv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Wf}};function zf(D,N,z,ee=ur({...z,allowPaths:z.policy?.destructiveCommandAllowPaths})){return Pv(D.words.map((te)=>({kind:"word",text:te.text,dynamic:te.provenance!=="literal"})),N,ee,z.policy)}function Pv(D,N,z,ee){let te=D.filter((lt)=>lt.kind==="word"),he=Tv(te),je=te[he];if(!je||!Ev.has(Gv(je.text)))return null;let at=Av(te.slice(he+1));if(at.whatIfProtected)return null;if(Jt(ee,"powershell.remove-item-pipeline-dynamic-target",z.strict)&&N&&(at.targets.length===0||at.recursive))return vt("powershell.remove-item-pipeline-dynamic-target",_v);for(let lt of at.targets)if(!nr(lt.text)&&Pl(Il(lt.text)))return vt(at.recursive&&at.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Ff);for(let lt of at.targets)if(z.resolvedCwd&&Ar(Il(lt.text),z.resolvedCwd,z.protectedGitMetadata,at.recursive,z.environment,z.budget,!0))return vt("powershell.remove-item-git-metadata",x);if(!at.recursive||!at.force)return null;if(Jt(ee,"powershell.remove-item-recursive-force-dynamic-target",z.strict)&&(at.hasDynamicTarget||at.targets.length===0))return vt("powershell.remove-item-recursive-force-dynamic-target",Gf);for(let lt of at.targets){let ct=Jo(Mn(Il(lt.text),z),z,ee,wv);if(ct)return ct}return null}function Av(D){let N=[],z=!1,ee=!1,te=!1,he=!1,je=!1;for(let at=0;at<D.length;at++){let lt=D[at];if(!lt||lt.kind!=="word")continue;if(Iv(lt))continue;if(je){N.push(Tl(lt)),he=he||lt.dynamic;continue}if(lt.text==="--"){je=!0;continue}let ct=Ov(lt.text);if(!ct){N.push(Tl(lt)),he=he||lt.dynamic;continue}if(Mv(ct.name)){let dt=ct.value?kv(ct.value,lt):D[++at];if(dt?.kind==="word"){N.push(Tl(dt)),he=he||dt.dynamic;continue}he=!0;continue}if(Dv(ct.name)){z=!0;continue}if(Nv(ct.name)){ee=!0;continue}if(Lv(ct.name))te=Wv(ct.value)}return{targets:N,recursive:z,force:ee,whatIfProtected:te,hasDynamicTarget:he}}function Tv(D){let N=D[0];if(N?.kind==="word"&&N.text==="&"||N?.text===".")return D.length>1?1:0;return 0}function Tl(D){return{text:D.kind==="word"?D.text:"",dynamic:D.kind==="word"&&D.dynamic}}function Iv(D){return D.kind==="word"&&D.text===","}function Il(D){let N=D.replace(/\\/g,"/"),z=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(N);return z?`$HOME${N.slice(z[0].length)}`:N}function kv(D,N){return{kind:"word",text:D,dynamic:N.kind==="word"&&(N.dynamic||D.includes("$"))}}function Ov(D){if(!D.startsWith("-")||D==="-")return null;let N=D.slice(1),z=N.indexOf(":");if(z===-1)return{name:N.toLowerCase()};return{name:N.slice(0,z).toLowerCase(),value:N.slice(z+1)}}function Mv(D){return"path".startsWith(D)||"literalpath".startsWith(D)}function Dv(D){return"recurse".startsWith(D)}function Nv(D){return D.length>=2&&"force".startsWith(D)}function Lv(D){return D==="wi"||"whatif".startsWith(D)}function Wv(D){if(D===void 0||D==="")return!0;let N=D.toLowerCase();return N==="$true"||N==="true"}function Gv(D){return D.toLowerCase()}var io="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",ys="Unsupported heredoc syntax",ei="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Bf="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var Fv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),zv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),Bv=new Set(["-o","--output","--query","--subscription"]),$v=new Set;function $f(D){if(D==="aws")return Fv;if(D==="gcloud")return zv;if(D==="az")return Bv;return $v}var Uv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Hv=new Set;function Uf(D){if(D==="git")return yn;if(D==="docker")return Uv;return Hv}function _(D,N){if(D.length===0||N.length===0)return null;let z=It(D[0]??""),ee=an(D);for(let te of N){if(!Kv(z,te.command))continue;if(te.match){if(jv(z,D,te.match))return Hf(te);continue}if(!qv(z,D,te.subcommand))continue;if(Zv(D,new Set(te.block_args),ee))return Hf(te)}return null}function Hf(D){return{id:`custom.${D.name}`,reason:`[${D.name}] ${D.reason}`,intent:D.intent??"manual_only"}}function jv(D,N,z){let ee=N.slice(1);if(z.exclude_args?.some((te)=>ee.includes(te)))return!1;if(z.any_args&&!z.any_args.some((te)=>ee.includes(te)))return!1;return Vv(ee,z.command_path,$f(D))}function Vv(D,N,z){let ee=0,te=!1;for(let he of D){if(ee>=N.length)return!0;if(te){te=!1;continue}if(he.startsWith("-")){te=!he.includes("=")&&z.has(he);continue}if(he!==N[ee])return!1;ee++}return ee>=N.length}function Kv(D,N){return D===It(N)}function qv(D,N,z){if(!z)return!0;return jf(N,1,z,Uf(D))}function jf(D,N,z,ee){let te=!1;for(let he=N;he<D.length;he++){let je=D[he];if(!je)continue;if(te){te=!1;continue}if(je==="--"){let at=D[he+1];if(at&&!at.startsWith("-"))return at===z;return!1}if(ee.has(je)){te=!0;continue}if(je.startsWith("-")){if(!je.includes("=")&&Yv(D,he,z,ee))return!0;continue}return je===z}return!1}function Yv(D,N,z,ee){let te=D[N+1];if(!te||te.startsWith("-"))return!1;return jf(D,N+2,z,ee)}function Zv(D,N,z){return D.some((ee)=>N.has(ee))||[...z].some((ee)=>N.has(ee))}var Xv=new Set(["-e","--source"]),Jv=new Set(["-F","-v","--assign","--field-separator"]),Vf=new Set(["-f","--file"]),Qv=new Set(["print","printf","return"]),Kf=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],eE="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function qf(D,N,z){let ee=!1;for(let te of tE(D)){let he=nE(te,z);if(!he)continue;for(let je of he.commands){let at=N(je);if(at)return at;if(je.includes("{}")||/[$`]/.test(je))ee=!0}ee||=he.dynamic}return ee?vt("awk.system-dynamic",eE):null}function Ol(D){let N=[],z=!1,ee=!1,te=!0,he=!0;for(let je=1;je<D.length;je++){let at=D[je];if(at===void 0)break;if(te&&at==="--"){te=!1;continue}if(te&&Xv.has(at)){z=!0;let lt=D[je+1];if(he&&=lt!==void 0,lt!==void 0)N.push({tokenIndex:je+1,kind:"inline-code",value:lt});je++;continue}if(te&&at.startsWith("--source=")){z=!0,N.push({tokenIndex:je,kind:"inline-code",value:at.slice(9)});continue}if(te&&at.startsWith("-e")&&at.length>2){z=!0,N.push({tokenIndex:je,kind:"inline-code",value:at.slice(2)});continue}if(te&&(Jv.has(at)||Vf.has(at))){let lt=D[je+1];if(he&&=lt!==void 0,Vf.has(at)){if(ee=!0,lt!==void 0)N.push({tokenIndex:je+1,kind:"program-file",value:lt})}je++;continue}if(te&&(at.startsWith("-F")||at.startsWith("-v")&&at.slice(2).includes("=")))continue;if(te&&at.startsWith("-f")&&at.length>2){ee=!0,N.push({tokenIndex:je,kind:"program-file",value:at.slice(2)});continue}if(te&&(at.startsWith("--assign=")||at.startsWith("--field-separator=")))continue;if(te&&at.startsWith("--file=")){ee=!0,N.push({tokenIndex:je,kind:"program-file",value:at.slice(7)});continue}if(te&&at.startsWith("-")&&at!=="-")continue;if(!z&&!ee)N.push({tokenIndex:je,kind:"main-program",value:at});return{sources:N,optionsOpen:!1}}return{sources:he?N:[],optionsOpen:te&&he}}function ni(D){return Ol(D).sources}function tE(D){return ni(D).filter((N)=>N.kind!=="program-file").map((N)=>N.value)}function nE(D,N){Sn(N,D);let z=D.includes("system")?Ml(D,N):null,ee=rE(D,N);if(!z&&!ee)return null;return{dynamic:!!z?.dynamic||!!ee?.dynamic,commands:[...z?.commands??[],...ee?.commands??[]]}}function Ml(D,N){Sn(N,D);let z=[],ee=!1,te=!1,he=0;while(he<D.length){let je=D[he];if(je==='"'||je==="'"){he=Cs(D,he,je)?.endIndex??he+1;continue}if(je==="#"){he=Yf(D,he+1);continue}if(je==="/"&&Zf(D,he)){he=Xf(D,he+1)??he+1;continue}if(!D.startsWith("system",he)){he++;continue}let at=he;if(he+=6,ti(D[at-1])||ti(D[he]))continue;let lt=bs(D,he);if(D[lt]!=="(")continue;lt=bs(D,lt+1);let ct=D[lt];if(ct!=='"'&&ct!=="'"){ee=!0,te=!0;continue}let dt=Cs(D,lt,ct);if(!dt){ee=!0,te=!0;continue}if(lt=bs(D,dt.endIndex),ee=!0,D[lt]!==")"){te=!0,he=dt.endIndex;continue}z.push(dt.value),he=lt+1}if(!ee)return null;return{dynamic:te,commands:z}}function rE(D,N){Sn(N,D);let z=[],ee=!1,te=!1,he=0,je=0,at=null,lt=null,ct=0;while(he<D.length){let dt=D[he];if(!dt)break;if(dt==='"'||dt==="'"){let mt=Cs(D,he,dt);if(mt&&ct===je)lt={...mt,startIndex:he};ct=mt?.endIndex??he+1,he=mt?.endIndex??he+1;continue}if(dt==="#"){he=Yf(D,he+1),je=he,at=null,lt=null,ct=he;continue}if(dt==="/"&&Zf(D,he)){let mt=Xf(D,he+1);ct=mt??he+1,he=mt??he+1;continue}if(`;
+{}`.includes(dt)){he++,je=he,at=null,lt=null,ct=he;continue}if(at===null&&(kl(D,he,"print")||kl(D,he,"printf")))at=he;if(dt!=="|"||D[he-1]==="|"||D[he+1]==="|"){if(!/\s/.test(dt))ct=he+1;he++;continue}let ft=D[he+1]==="&"?he+2:he+1,ut=bs(D,ft);if(kl(D,ut,"getline")){te=!0;let mt=sE(je,lt,ct);if(ee||=mt===null,mt!==null)z.push(mt);ct=ft,he=ft;continue}if(lE(je,at)){te=!0;let mt=iE(D,ut);if(!mt){ee=!0,ct=ft,he=ft;continue}if(!oE(D,mt.endIndex)){ee=!0,ct=mt.endIndex,he=mt.endIndex;continue}z.push(mt.value),ct=mt.endIndex,he=mt.endIndex;continue}ct=ft,he++}if(!te)return null;return{dynamic:ee,commands:z}}function ti(D){return!!D&&/[A-Za-z0-9_]/.test(D)}function bs(D,N){let z=N;while(/\s/.test(D[z]??""))z++;return z}function oE(D,N){let z=N;while(/[\t\f\v\r ]/.test(D[z]??""))z++;let ee=D[z];return!ee||`;
+}#`.includes(ee)}function Cs(D,N,z){let ee="",te=!1;for(let he=N+1;he<D.length;he++){let je=D[he];if(!je)break;if(te){let at=aE(D,he);if(!at)return null;ee+=at.value,he=at.endIndex,te=!1;continue}if(je==="\\"){te=!0;continue}if(je===z)return{value:ee,endIndex:he+1};ee+=je}return null}function iE(D,N){let z=D[N];if(z!=='"'&&z!=="'")return null;return Cs(D,N,z)}function sE(D,N,z){if(!N)return null;return N.startIndex>=D&&N.endIndex===z?N.value:null}function aE(D,N){let z=D[N];if(!z)return null;if(z==="x"){let te=D.slice(N+1,N+3);if(!/^[0-9A-Fa-f]{2}$/.test(te))return null;return{value:String.fromCharCode(Number.parseInt(te,16)),endIndex:N+2}}if(/[0-7]/.test(z)){let te=/^[0-7]{1,3}/.exec(D.slice(N));if(!te)return null;return{value:String.fromCharCode(Number.parseInt(te[0],8)),endIndex:N+te[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[z]??z,endIndex:N}}function kl(D,N,z){return D.startsWith(z,N)&&!ti(D[N-1])&&!ti(D[N+z.length])}function lE(D,N){return N!==null&&N>=D}function Yf(D,N){let z=D.indexOf(`
+`,N);return z===-1?D.length:z+1}function Zf(D,N){let z=cE(D,N);if(z===-1)return!0;if("{([,;!~=".includes(D[z]??""))return!0;let ee=z;while(ti(D[ee-1]))ee--;return Qv.has(D.slice(ee,z+1))}function cE(D,N){for(let z=N-1;z>=0;z--)if(!/\s/.test(D[z]??""))return z;return-1}function Xf(D,N){let z=!1;for(let ee=N;ee<D.length;ee++){let te=D[ee];if(!te)break;if(z){z=!1;continue}if(te==="\\"){z=!0;continue}if(te==="/")return ee+1}return null}var uE="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",dE="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",fE="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Jf(D){return D==="dd"||D==="shred"||D==="mkfs"||D.startsWith("mkfs.")}function Qf(D,N){let z=N.slice(1);if(D==="dd"&&z.some((ee)=>/^of=\/dev\/.+/.test(ee)))return vt("dd.device-write",uE);if((D==="mkfs"||D.startsWith("mkfs."))&&z.some((ee)=>ee.startsWith("/dev/")))return vt("mkfs.device",dE);if(D==="shred"&&z.length>0)return vt("shred.target",fE);return null}var mE=new Set(["sudo","env","command","builtin"]),pE=new Set(["exec","nice","nohup","setsid","stdbuf","time","timeout"]);function Ss(D,N){let z=D[0];if(!z||!em(Pt(z),N))return null;let ee=Pt(z),te=D[1]==="--"?2:1,he=gE(D,te,ee,N),je=he[0];if(je===void 0)return null;return{wrapper:ee,tokens:D.slice(je),childIndex:je,alternativeChildIndices:he.slice(1)}}function gE(D,N,z,ee){let te=D[1]==="--",he=[];for(let je=N;je<D.length;je++){let at=D[je];if(!at)continue;let lt=Pt(at)!==z&&hE(at,ee);if(lt)he.push(je);if(!lt&&Pi.has(It(at)))break;if(te)break}return he}function hE(D,N){let z=Pt(D),ee=It(D);return ee==="git"||z==="busybox"||kr(D)||va.has(z)||Jf(ee)||em(z,N)||Ht.has(ee)||D==="$SHELL"||Tn(ee)||Rn.has(ee)||N.rules.some((te)=>te.command===z)}function em(D,N){return pE.has(D)||N.transparentWrappers.includes(D)}function kr(D){return mE.has(D.toLowerCase())}function Or(D,N){return{embedded:!1,cwd:D.cwd,originalCwd:N.originalCwd,effectiveCwd:D.cwd,envAssignments:D.envAssignments,allowTmpdirVar:N.allowTmpdirVar,worktreeMode:N.worktreeMode,wrappedByTransparent:!1}}function Dn(D,N){let z=N.policy??{rules:[],transparentWrappers:[]};return vs([...D],N.environment,N.cwd,N.cwd,new Map,new Map(N.envAssignments??[]),z,{iterations:0},!1)}function*vs(D,N,z,ee,te,he,je,at,lt){let ct=is(D,N,z,he);for(let[mt,pt]of ct.envAssignments)he.set(mt,pt),te.set(mt,pt);let{tokens:dt,cwd:ft}=ct;if(ct.envSplitValues){let mt=os(ct.envSplitValues,dt);if(!mt)throw new s("derivedCommandShape");Dl(at),yield*vs(mt,N,ft,ee,te,he,je,at,lt);return}if(kr(dt[0]??""))throw new s("wrapperPeelIterations");let ut=Ss(dt,je);if(ut){for(let mt of[ut.childIndex,...ut.alternativeChildIndices])Dl(at),yield*vs(mt===ut.childIndex?ut.tokens:dt.slice(mt),N,ft,ee,new Map(te),new Map(he),je,at,!0);return}if(bE(dt)){Dl(at),yield*vs(dt.slice(1),N,ft,ee,te,he,je,at,lt);return}yield yE(dt,ft,ee,te,he,lt)}function yE(D,N,z,ee,te,he){return{tokens:D,cwd:N===null?void 0:N??z,wrapperCwd:N,wrapperEnvAssignments:ee,envAssignments:te,head:Pt(D[0]??"").toLowerCase(),wrappedByTransparent:he}}function Dl(D){if(D.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");D.iterations++}function bE(D){return Pt(D[0]??"").toLowerCase()==="busybox"&&D.length>1}function Nl(D,N){let z=[],ee=N;while(ee<D.length){let te=D[ee];if(te===void 0||te===":::")break;z.push(te),ee++}return{markerIndex:ee<D.length&&D[ee]===":::"?ee:-1,templateTokens:z}}function Nn(D){let N=!1,z=!1;for(let ee of D){if(ee==="--")break;if(ee==="-r"||ee==="-R"||Ll(ee,"recursive")){N=!0;continue}if(ee==="-f"||Ll(ee,"force")){z=!0;continue}if(ee.startsWith("-")&&!ee.startsWith("--")){if(ee.includes("r")||ee.includes("R"))N=!0;if(ee.includes("f"))z=!0}}return N&&z}function Es(D){let N=D.indexOf("--");return D.slice(1,N===-1?void 0:N).some((z)=>Ll(z,"recursive")||/^-[A-Za-z]+$/.test(z)&&/[rR]/.test(z.slice(1)))}function Ll(D,N){return D.length>2&&D.startsWith("--")&&N.startsWith(D.slice(2))}var CE=["--init-file","--rcfile"],SE=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Ln(D){for(let N=1;N<D.length;N++){let z=D[N];if(!z)continue;if(z==="-c")return tm(D,N,!0);if(z.startsWith("-")&&z.includes("c")&&!z.startsWith("--")){let ee=tm(D,N,!1);if(ee!==null)return ee}}return null}function Xn(D){let N=Pt(D[0]??"").toLowerCase();if(N==="zsh"||N==="ksh")return bn(D).syntaxCheck;let z=!1;for(let ee of D.slice(1)){if(ee==="--")return z;if(ee.startsWith("+")&&!ee.startsWith("++")){if(ee.slice(1).includes("n"))z=!1;continue}if(!ee.startsWith("-")||ee.startsWith("--"))return z;let te=ee.slice(1);if(te.includes("n"))z=!0;if(te.includes("c"))return z}return z}function tm(D,N,z){if(D[N+1]==="--")return D[N+2]||null;let ee=D[N+1];if(!ee||!z&&ee.startsWith("-"))return null;return ee}function nm(D){let N=Pt(D[0]??"").toLowerCase(),z=vE(D,N),ee=SE.get(N)??null,te=z.argvSource?.kind!=="absent";return{argvSource:N==="bash"?z.argvSource:null,argvSourceApplies:N==="bash"&&z.interactive&&z.argvSource?.kind==="literal",envName:ee,envSourceApplies:te&&(ee==="BASH_ENV"?!z.interactive:ee==="ENV"&&z.interactive)}}function vE(D,N){let z=bn(D),ee=z.commandIndex??z.scriptIndex??D.length,te=[],he=!1,je=!0;for(let at=1;at<ee;at++){let lt=D[at];if(lt===void 0||lt==="--"||lt==="-"||lt[0]!=="-"&&lt[0]!=="+")break;if(lt.startsWith("--")){if(N==="bash"&&je?CE.find((ut)=>lt===ut):void 0){let ut=D[at+1];te.push(ut===void 0?{kind:"absent"}:{kind:"literal",value:ut}),at++;continue}let ft=lt.split("=",1)[0]??lt;if(N==="bash"&&Ca.has(ft)&&!lt.includes("="))at++;continue}if(N==="bash")je=!1;let ct=Sa(N,lt,D[at+1],"startup");if(ct.interactive)he=lt[0]==="-";at+=ct.followingValues}return{argvSource:te.at(-1)??null,interactive:he}}var EE="find -delete permanently removes files. Use -print first to preview.",xE="find -exec rm -rf is dangerous. Use explicit file list instead.",RE=new Set(["-exec","-execdir","-ok","-okdir"]),_E=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((D)=>[D,1]),["-fprintf",2]]);function rm(D,N){let z=D.map(t),ee=wE(D,z,N);if(ee)return ee;if(xs(z,1)&&!OE(D,z,N)){let je=wt(vt("find.delete",EE),N.policy);if(je)return je}let te=N.budget??gn(),he=0;while(he<z.length){let je=z[he],at=Jn(je??"");if(at>0){he+=at+1;continue}if(!Bn(je)){he++;continue}te.charge("derivedTokens",z.length-he-1);let lt=so(z,he);he=lt.nextIndex;let ct=DE(lt.tokens,N.environment);if(ct){let mt=wt(ct,N.policy);if(mt)return mt}let dt=je==="-execdir"||je==="-okdir",ft=N.analyzeTokens?N.analyzeTokens(lt.tokens,dt?null:N.cwd):N.analyzeNested?N.analyzeNested(lt.tokens.join(" "),{effectiveCwd:dt?void 0:N.cwd,envAssignments:N.envAssignments}):null,ut=ft?.id.startsWith("custom.")?ft:wt(ft,N.policy);if(ut)return ut}return null}function wE(D,N,z){if(!xs(N,1)&&!Wl(N,z.environment))return null;let te=ri(D)??Ut(["."]),he=ur({...z,allowPaths:z.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let je of te){let at=Qo(je);for(let lt of at.expandedTargets??[t(je)]){let ct=Mn(lt,he,{targetIsLiteral:at.expandedTargets!==void 0||at.targetIsLiteral,tmpdirWordSplittingProtected:at.tmpdirWordSplittingProtected});if(ct.kind==="root_or_home_target")return vt("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ct.kind==="git_metadata_target"&&!PE(D,he.protectedGitMetadata,z.environment))return vt("find.delete-git-metadata",x)}}if(kE(N)&&he.resolvedCwd&&Ef(te.map(t),he.resolvedCwd,he.protectedGitMetadata,he.environment,he.budget))return vt("find.delete-git-metadata",x);return null}function PE(D,N,z){if(!N)return!1;let ee=D.map(t),te=[],he=!1,je=ri(D)?.at(-1),at=je?D.indexOf(je)+1:1;while(at<ee.length){let lt=ee[at]??"";if(Bn(lt)){let ct=so(ee,at),dt=ar([...ct.tokens],z),ft=Es(dt),ut=Ht.has(Pt(dt[0]??"").toLowerCase()),mt=ct.tokens.some((gt)=>gt!=="{}"&&gt.includes("{}")),pt=(lt==="-execdir"||lt==="-okdir")&&dt.slice(1).some((gt)=>gt!=="{}"&&!gt.startsWith("-"));if(ft||ut||mt||pt)return!1;he=!0,at=ct.nextIndex;continue}if(lt==="-delete"){he=!0,at++;continue}if(lt==="-name"||lt==="-iname"){let ct=D[at+1];if(!(ct?.provenance==="literal"&&!/[[\\]/.test(ct.text)))return!1;if(!he)te.push(TE(ct.text,lt==="-iname"));at+=2;continue}if(!AE.has(lt))return!1;at+=1+Jn(lt)}return te.length>0&&!Rf(N,(lt)=>te.every((ct)=>ct.test(lt)))}var AE=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function TE(D,N){let z=D.replace(/[*?]|[.+^${}()|\]/]/g,(ee)=>ee==="*"?".*":ee==="?"?".":`\\${ee}`);return new RegExp(`^${z}$`,N?"isu":"su")}var IE=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Wl(D,N){let z=0;while(z<D.length){if(!Bn(D[z])){z++;continue}let ee=so(D,z),te=ar([...ee.tokens],N),he=Pt(te[0]??"").toLowerCase(),je=Ht.has(he)&&IE.test((Ln(te)??"").replace(/["'\\]/g,""));if((he==="rm"||he==="rmdir"||je)&&te.some((lt)=>lt.includes("{}")))return!0;z=ee.nextIndex}return!1}function kE(D){return D.some((N,z)=>{if(!["-name","-iname"].includes(N))return!1;return D[z+1]?.toLowerCase()==="hooks"})}function OE(D,N,z){if(N.includes("-L")||N.includes("-f")||N.includes("-follow"))return!1;let ee=ri(D);if(!ee)return!1;let te=z.envAssignments??new Map,he=Rl(te,z.environment),je=z.trustedTmpdirValue??Tr(te,z.environment),at=z.allowTmpdirVar??!Xo(te,z.environment),lt={environment:z.environment,protectedGitMetadata:z.protectedGitMetadata,cwd:z.cwd,originalCwd:z.originalCwd,strict:z.strict,allowTmpdirVar:at&&je&&Boolean(he),allowPaths:z.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:z.tmpdirWordSplittingUnsafe??cr(te,z.environment),trustedTmpdirValue:je,budget:z.budget},ct=ur(lt),dt=ur({...lt,cwd:z.originalCwd??z.cwd}),ft=z.originalCwd&&z.environment.paths.realpath(z.originalCwd),ut=z.cwd&&z.environment.paths.realpath(z.cwd),mt=ft&&ut&&!oo(ut,ft)?z.cwd:void 0;return ee.every((pt)=>{let gt=Qo(pt);if(gt.unsafeBraceExpansion)return!1;return(gt.expandedTargets??[t(pt)]).every((ht)=>{let yt=/^\.\/*$/.test(ht)?mt:void 0,Ct=yt??ht;return Mf(Ct,yt?dt:ct,{containmentTarget:ME(Ct,he),targetIsLiteral:gt.expandedTargets!==void 0||gt.targetIsLiteral,tmpdirWordSplittingProtected:gt.tmpdirWordSplittingProtected})})})}function ME(D,N){if(!N)return D;return D.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>N)}function ri(D){let N=(te)=>{let he=D[te];return he?t(he):void 0},z=1;while(N(z)==="-H"||N(z)==="-P")z++;if(N(z)==="--")z++;let ee=[];while(z<D.length){let te=N(z),he=D[z];if(!te||!he||te.startsWith("-")||["!","(",")"].includes(te))break;ee.push(he),z++}return ee.length>0?ee:null}function DE(D,N){let z=sr([...D],N);if(z.length===0)return null;let ee=Pt(z[0]??"");if(ee==="busybox"&&z.length>1)z=z.slice(1),ee=Pt(z[0]??"");if(ee==="rm"&&Nn(z))return vt("find.exec-rm-recursive-force",xE);return null}function so(D,N){let z=N+1;while(z<D.length&&D[z]!==";"&&!(D[z]==="+"&&D[z-1]==="{}"))z++;return{tokens:D.slice(N+1,z),nextIndex:Math.min(z+1,D.length)}}function xs(D,N){let z=N;while(z<D.length){let ee=D[z];if(!ee){z++;continue}if(Bn(ee)){z=so(D,z).nextIndex;continue}let te=Jn(ee);if(te>0){z+=te+1;continue}if(ee==="-delete")return!0;z++}return!1}function Jn(D){return _E.get(D)??(/^-newer[A-Za-z]{2}$/.test(D)?1:0)}function Bn(D){return D!==void 0&&RE.has(D)}import{resolve as cR}from"node:path";function*Gl(D){for(let N of D.nodes)yield*LE(N)}function NE(D){return Object.freeze([...Gl(D)])}function st(D){return Object.freeze(NE(D).map((N)=>Object.freeze(N.words.map((z)=>z.text))))}function oi(D){let N=h(D,"posix");if(N.status!=="complete"||N.nodes.length!==1)return null;let z=N.nodes[0];if(z?.kind!=="command")return null;if(z.redirections.length>0||z.nested.length>0)return null;if(z.words.some((ee)=>ee.provenance==="command-substitution"))return null;return z.words.map((ee)=>ee.text)}function*LE(D){if(D.kind==="command"){yield D;for(let N of D.nested)yield*Gl(N);return}if(D.kind==="group")yield*Gl(D.body)}var WE=5,Fl="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function en(D){let N=D.indexOf("--");if(N===-1)return{index:-1,before:D,after:[]};return{index:N,before:D.slice(0,N),after:D.slice(N+1)}}function im(D,N,z){let ee=Rs(D,N,z),te=GE(ee.entries);if(te.size===0)return{blockedReason:ee.blockedReason,expanded:!1,tokens:D};let he=D,je=!1;for(let at=0;at<WE;at++){let{subcommand:lt,rest:ct}=vn(he),dt=lt?.toLowerCase();if(!dt||!te.has(dt))return{blockedReason:ee.blockedReason,expanded:je,tokens:he};let ft=te.get(dt),ut=UE(ft);if(ut===null||ut.length===0)return{blockedReason:Fl,expanded:!0,tokens:he};he=["git",...ut,...ct],je=!0}return{blockedReason:Fl,expanded:!0,tokens:he}}function sm(D,N,z){return Rs(D,N,z).entries.some((ee)=>ee.key.toLowerCase()==="core.sshcommand")}function vn(D){if(D.length===0)return{subcommand:null,rest:[]};let N=D[0];if((N?Pt(N).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let ee=1;while(ee<D.length){let te=D[ee];if(!te)break;if(te==="--"){let he=D[ee+1];if(he&&!he.startsWith("-"))return{subcommand:he,rest:D.slice(ee+2)};return{subcommand:null,rest:D.slice(ee+1)}}if(!te.startsWith("-"))return{subcommand:te,rest:D.slice(ee+1)};ee+=yn.has(te)?2:1}return{subcommand:null,rest:[]}}function GE(D){let N=new Map;for(let z of D){let ee=z.key.toLowerCase();if(!ee.startsWith("alias."))continue;let te=ee.slice(6);if(te!=="")N.set(te,z.value)}return N}function Rs(D,N,z){if(D.length===0)return{blockedReason:null,entries:[]};let ee=D[0];if((ee?Pt(ee).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let he=zE(N,z);return{blockedReason:he.blockedReason,entries:[...he.entries,...FE(D,N,z)]}}function FE(D,N,z){let ee=[],te=1;while(te<D.length){let he=D[te];if(!he||he==="--"||!he.startsWith("-"))return ee;if(he==="-c"){let je=zl(D[te+1]);if(je)ee.push(je);te+=2;continue}if(he.startsWith("-c")&&he.length>2){let je=zl(he.slice(2));if(je)ee.push(je);te++;continue}if(he==="--config-env"){let je=om(D[te+1],N,z);if(je)ee.push(je);te+=2;continue}if(he.startsWith("--config-env=")){let je=om(he.slice(13),N,z);if(je)ee.push(je);te++;continue}if(yn.has(he)){te+=2;continue}te++}return ee}function zE(D,N){let z=BE(D,N),ee=$E(D,N);return{blockedReason:z===null||ee===null?Fl:null,entries:[...z??[],...ee??[]]}}function BE(D,N){let z=Yn("GIT_CONFIG_PARAMETERS",D,N);if(z===void 0)return[];let ee=[],te=oi(z);if(!te)return null;for(let he of te){let je=zl(he);if(!je)return null;ee.push(je)}return ee}function $E(D,N){let z=Zd(D,N);if(z.state==="absent")return[];if(z.state==="invalid")return null;let ee=[];for(let te=0;te<z.count;te++){let he=Yn(`GIT_CONFIG_KEY_${te}`,D,N)?.trim(),je=Yn(`GIT_CONFIG_VALUE_${te}`,D,N);if(!he||je===void 0)return null;ee.push({key:he,value:je})}return ee}function zl(D){if(!D)return null;let N=D.indexOf("=");return{key:(N===-1?D:D.slice(0,N)).trim(),value:N===-1?void 0:D.slice(N+1)}}function om(D,N,z){let ee=D?.indexOf("=")??-1;if(!D||ee===-1)return null;return{key:D.slice(0,ee).trim(),value:Yn(D.slice(ee+1),N,z)}}function UE(D){let N=D?.trimStart();if(!N||N.startsWith("!"))return null;return oi(N)}var HE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",jE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",VE="git checkout --force discards uncommitted changes. Use 'git stash' first.",KE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",qE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",YE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",ZE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",XE="git switch --force discards uncommitted changes. Use 'git stash' first.",JE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",QE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",ex="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",tx="git reset --merge can lose uncommitted changes. Use 'git stash' first.",nx="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",rx="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",ox="git push --force destroys remote history. Use --force-with-lease for safer force push.",ix="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",sx="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",ax="git branch -D force-deletes without merge check. Use -d for safe delete.",lx="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",cx="git merge --abort discards merge conflict resolutions. Use 'git status' first.",ux="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",dx="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",fx="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",mx="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",px="git worktree remove --force can delete uncommitted changes. Remove --force flag.",gx=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),hx=new Set(["--recurse-submodules","--track","-t"]),Bl=new Set(["-b","-B","-U"]),$l=new Set(["-c","-C"]),yx=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function kt(D,N){let z=D.split("=",1)[0]??D;return z.length>=4&&N.startsWith(z)&&z.startsWith("--")&&z.slice(2).length>=2}var ao=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function lm(D,N){let{subcommand:z,rest:ee}=vn(D);if(!z)return null;switch(z.toLowerCase()){case"checkout":return dr(bx(ee,N));case"switch":return dr(Sx(ee));case"restore":return dr(Ex(ee));case"reset":return Rx(ee);case"clean":return dr(wx(ee));case"rm":return dr(Px(ee));case"push":return Mr(Ax(ee));case"branch":return Mr(kx(ee));case"stash":return Mr(Lx(ee));case"worktree":return Mr(Wx(ee));case"rebase":return dr(Ox(ee));case"merge":return dr(Mx(ee));case"tag":return Mr(Dx(ee));case"reflog":return Mr(Nx(ee));default:return null}}function dr(D){return D?{...D,localDiscard:!0}:null}function Mr(D){return D?{...D,localDiscard:!1}:null}function bx(D,N){let{index:z,before:ee}=en(D),te=an(ee,{shortOptsWithValue:Bl});if(ee.some((at)=>kt(at,"--force"))||te.has("-f"))return vt("git.checkout-force",VE);for(let at of D){if(at==="-b"||at==="-B"||at==="--orphan")return null;if(kt(at,"--pathspec-from-file"))return vt("git.checkout-pathspec-from-file",qE)}if(z!==-1){if(ee.some((lt)=>!lt.startsWith("-")))return vt("git.checkout-ref-path",KE);return vt("git.checkout-double-dash",HE)}let he=vx(D);if(he.length>=2)return vt("git.checkout-ambiguous",YE);let je=he[0];if(je===void 0||te.has("-d")||te.has("-t")||D.some((at)=>kt(at,"--detach")||kt(at,"--track")))return null;if(Cx(je)||N(je))return vt("git.checkout-double-dash",jE);return null}function Cx(D){return D==="."||D===".."||/^\.\.?[/\\]/.test(D)||/^([/\\]|[A-Za-z]:[/\\])/.test(D)||D.endsWith("/")||D.startsWith(":")||/[*?[]/.test(D)}function Sx(D){let{before:N}=en(D);if(N.some((ee)=>kt(ee,"--discard-changes")))return vt("git.switch-discard-changes",ZE);let z=an(N,{shortOptsWithValue:$l});if(N.some((ee)=>kt(ee,"--force"))||z.has("-f"))return vt("git.switch-force",XE);return null}function vx(D){let N=[],z=0;while(z<D.length){let ee=D[z];if(!ee)break;if(ee==="--")break;if(!ee.startsWith("-")){N.push(ee),z++;continue}if(gx.has(ee)){z+=2;continue}if(hx.has(ee)){let te=D[z+1],he=ee==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];z+=te&&!te.startsWith("-")&&he.includes(te)?2:1;continue}z++}return N}function Ex(D){let N=xx(D);if(N.isTerminal||!N.hasPathspec&&!N.hasPatch||!N.hasWorktree)return null;return N.hasExplicitLocation?vt("git.restore-worktree",QE):vt("git.restore-unstaged",JE)}function xx(D){let N=!1,z=!1,ee=!0,te=!1,he=(je)=>{if(!te)ee=!1,te=!0;if(je!==void 0)ee=je};for(let je=0;je<D.length;je++){let at=D[je];if(at===void 0)break;if(at==="--"){N||=je+1<D.length;break}if(at==="--pathspec-from-file"){N=!0,je++;continue}if(at.startsWith("--pathspec-from-file=")){N=!0;continue}if(at==="-h"||at==="--help"||at==="--version")return{hasPathspec:N,hasPatch:z,hasWorktree:ee,hasExplicitLocation:te,isTerminal:!0};if(at==="--staged"){he();continue}if(at==="--no-staged"){he();continue}if(at==="--worktree"){he(!0);continue}if(at==="--no-worktree"){he(!1);continue}if(at==="--patch"){z=!0;continue}if(at==="--no-patch"){z=!1;continue}if(yx.has(at)){je++;continue}if(at.startsWith("--"))continue;if(at==="-"){N=!0;continue}if(!at.startsWith("-")){N=!0;continue}for(let lt=1;lt<at.length;lt++){let ct=at.charAt(lt);if(ct==="h")return{hasPathspec:N,hasPatch:z,hasWorktree:ee,hasExplicitLocation:te,isTerminal:!0};if(ct==="S"){he();continue}if(ct==="W"){he(!0);continue}if(ct==="p"){z=!0;continue}if(ct==="s"||ct==="U"){if(lt===at.length-1)je++;break}}}return{hasPathspec:N,hasPatch:z,hasWorktree:ee,hasExplicitLocation:te,isTerminal:!1}}function Rx(D){let N=null;for(let z of D){if(kt(z,"--hard")){N=vt("git.reset-hard",ex);break}if(kt(z,"--merge")){N=vt("git.reset-merge",tx);break}}if(!N)return null;return _x(D)?Mr(N):dr(N)}function _x(D){for(let N of D){if(N==="--")return!1;if(!N.startsWith("-"))return!0}return!1}function wx(D){for(let z of D)if(z==="-n"||kt(z,"--dry-run"))return null;let N=an(D.filter((z)=>z!=="--"));if(D.some((z)=>kt(z,"--force"))||N.has("-f"))return vt("git.clean-force",nx);return null}function Px(D){let N=!1,z=!1,ee=!1;for(let te of en(D).before){if(kt(te,"--no-force")){N=!1;continue}if(kt(te,"--force")){N=!0;continue}if(kt(te,"--no-cached")){z=!1;continue}if(kt(te,"--cached")){z=!0;continue}if(kt(te,"--no-dry-run")){ee=!1;continue}if(kt(te,"--dry-run")){ee=!0;continue}let he=an([te]);N||=he.has("-f"),ee||=he.has("-n")}return N&&!z&&!ee?vt("git.rm-force",rx):null}function Ax(D){let{before:N,after:z}=en(D),ee=an(N);if(N.some((je)=>kt(je,"--mirror")))return vt("git.push-mirror",sx);if(N.some((je)=>kt(je,"--force"))||ee.has("-f")||am(N,z).some(Tx))return vt("git.push-force",ox);if(N.some((je)=>kt(je,"--delete"))||ee.has("-d")||am(N,z).some(Ix))return vt("git.push-delete",ix);return null}function am(D,N){return[...D.filter((z)=>z!==""&&!z.startsWith("-")),...N]}function Tx(D){return D.startsWith("+")||D.includes(":+")}function Ix(D){return D.length>1&&D.startsWith(":")}function kx(D){let{before:N}=en(D),z=an(N),ee=z.has("-D")||z.has("-d")||N.some((he)=>kt(he,"--delete")),te=z.has("-D")||z.has("-f")||N.some((he)=>kt(he,"--force"));if(ee&&te)return vt("git.branch-force-delete",ax);return null}function Ox(D){let{before:N}=en(D);return N.some((z)=>kt(z,"--abort"))?vt("git.rebase-abort",lx):null}function Mx(D){let{before:N}=en(D);return N.some((z)=>kt(z,"--abort"))?vt("git.merge-abort",cx):null}function Dx(D){let{before:N}=en(D);return an(N).has("-d")||N.some((ee)=>kt(ee,"--delete"))?vt("git.tag-delete",ux):null}function Nx(D){return D[0]==="delete"?vt("git.reflog-delete",dx):null}function Lx(D){for(let N of D){if(N==="drop")return vt("git.stash-drop",fx);if(N==="clear")return vt("git.stash-clear",mx)}return null}function Wx(D){let{before:N}=en(D);if(!N.includes("remove"))return null;let ee=an(N);if(N.some((te)=>kt(te,"--force"))||ee.has("-f"))return vt("git.worktree-remove-force",px);return null}import{dirname as oR,isAbsolute as iR,join as xm,resolve as sR}from"node:path";var Hl="TMPDIR",jl="IFS",um=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,dm=/^[A-Za-z_][A-Za-z0-9_]*$/,fm=new Set(["export","typeset","declare","readonly"]),Gx=new Set(["builtin","command","time"]),Fx=new Set(["do","then","else"]),zx=new Set(["do","then","case"]),cm=new Set(["done","fi","esac"]),Bx=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function mm(D,N){return D.map((z)=>z.provenance==="variable"&&Sm(z.text)?pm(z.text,N.shellAssignments):t(z))}function pm(D,N){return D.replace(Bx,(z,ee,te)=>N.get(ee??te??"")??z)}function $n(D,N){let z=D.parts.every((te)=>te.provenance!=="literal"||!/[$`]/.test(te.raw));if(D.provenance!=="variable"||!z)return null;let ee=pm(D.text,N);return/^[~-]/.test(ee)||/[\s$`*?[]/.test(ee)?null:ee}function gm(D,N){return{env:D,effectiveEnvAssignments:jx(D,N),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function hm(D){return{env:D.env,effectiveEnvAssignments:D.effectiveEnvAssignments?new Map(D.effectiveEnvAssignments):void 0,shellAssignments:new Map(D.shellAssignments),bodyDepth:D.bodyDepth,bodyAssignments:new Set(D.bodyAssignments)}}function Vl(D,N){let z=bm(D,N),ee=D[0]??"";if(zx.has(ee))N.bodyDepth+=1;if(ee==="elif"||cm.has(ee))N.bodyDepth=Math.max(0,N.bodyDepth-1);if(cm.has(ee)&&N.bodyDepth===0)N.bodyAssignments.forEach((at)=>{N.shellAssignments.delete(at)}),N.bodyAssignments.clear();z.assignments.filter((at)=>at.persists).forEach((at)=>{if(N.shellAssignments.set(at.name,at.value),N.bodyDepth>0)N.bodyAssignments.add(at.name);Kl(N,at)});let te=z.commandIndex;if(te!==-1&&fm.has(D[te]??""))D.filter((at)=>dm.test(at)&&Ul(at)).forEach((at)=>{Vx(N,at)});let he=te===-1?-1:Cm(D,te);if(he===-1||D[he]!=="unset")return;let je=qx(D,he);if(je===null)return;D.slice(je).forEach((at)=>{if(N.bodyDepth>0){N.shellAssignments.set(at,"");return}Kx(N,at)})}function ym(D,N){let z=bm(D,N).assignments;if(z.length===0)return N.effectiveEnvAssignments;let ee=new Map(N.effectiveEnvAssignments??[]);return z.forEach((te)=>{ee.set(te.name,te.value)}),ee}function bm(D,N){let z=Fx.has(D[0]??"")?1:0,ee=D.findIndex((at,lt)=>lt>=z&&!Sm(at)),te=ee!==-1&&fm.has(D[Cm(D,ee)]??""),he=Hx(N);return{assignments:D.flatMap((at,lt)=>{let ct=$x(at,he,N.env);if(!ct)return[];if(ee!==-1&&lt>ee&&!te&&!ns(ct.name))return[];return he.set(ct.name,ct.value),[{...ct,persists:ee===-1||te}]}),commandIndex:ee}}function Cm(D,N){let z=N;while(Gx.has(D[z]??"")){z+=1;while(D[z]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(D[z]??""))return N;z+=1}}return z}function Sm(D){return wn(D)!==null||um.test(D)}function $x(D,N,z){return wn(D)??Ux(D,N,z)}function Ux(D,N,z){let ee=rs(D,z,N);if(ee)return ee;let te=D.match(um)?.[1];if(!te)return null;let he=D.indexOf("=");return{name:te,value:`${N.has(te)?N.get(te):z.get(te)??""}${D.slice(he+1)}`}}function Ul(D){return D===Hl||D===jl||gl(D)}function Hx(D){return new Map([...D.effectiveEnvAssignments??[],...D.shellAssignments])}function jx(D,N){let z=[Hl,jl].map((ee)=>{let te=D.get(ee);return te===void 0?null:[ee,te]}).filter((ee)=>ee!==null);if(z.length===0)return N;return new Map([...z,...N??[]])}function Kl(D,N){let z=new Map(D.effectiveEnvAssignments??[]);z.set(N.name,N.value),D.effectiveEnvAssignments=z}function Vx(D,N){Kl(D,{name:N,value:D.shellAssignments.get(N)??D.effectiveEnvAssignments?.get(N)??D.env.get(N)??""})}function Kx(D,N){if(!Ul(N)&&!dm.test(N))return;if(D.shellAssignments.set(N,""),ns(N)&&D.env.has(N)){let ee=new Map(D.env);ee.delete(N),D.env=ee}if(!Ul(N)||N===Hl||N===jl||Ro(N)){Kl(D,{name:N,value:""});return}if(!D.effectiveEnvAssignments?.has(N))return;let z=new Map(D.effectiveEnvAssignments);z.delete(N),D.effectiveEnvAssignments=z.size===0?void 0:z}function qx(D,N){let z=N+1;while(z<D.length){let ee=D[z];if(!ee)return null;if(ee==="--")return z+1;if(ee==="-v"){z++;continue}if(ee.startsWith("-"))return null;return z}return z}import{resolve as Yx}from"node:path";function _s(D,N){return pl.some((z)=>N?.has(z)||D.has(z))}function lo(D,N,z){if(!N)return{gitCwd:null,hasExplicitGitContext:!1};let ee=z.realpath(Yx(N));if(ee===null||!z.isDirectory(ee))return{gitCwd:null,hasExplicitGitContext:!1};let te=ee,he=!1,je=1;while(je<D.length){let at=D[je];if(!at)break;if(at==="--")break;if(!at.startsWith("-"))break;if(at==="-C"){let lt=D[je+1];if(!lt)return{gitCwd:null,hasExplicitGitContext:he};let ct=vm(te,lt,z);if(!ct)return{gitCwd:null,hasExplicitGitContext:he};te=ct,je+=2;continue}if(at.startsWith("-C")&&at.length>2){let lt=vm(te,at.slice(2),z);if(!lt)return{gitCwd:null,hasExplicitGitContext:he};te=lt,je++;continue}if(at==="--git-dir"||at==="--work-tree"){he=!0,je+=2;continue}if(at.startsWith("--git-dir=")||at.startsWith("--work-tree=")){he=!0,je++;continue}je+=yn.has(at)?2:1}return{gitCwd:te,hasExplicitGitContext:he}}function vm(D,N,z){try{let ee=ir(D,N,z);return z.isDirectory(ee)?ee:null}catch{return null}}function Em(D,N,z){if(!N.localDiscard||!z.worktreeMode||_s(z.environment.env,z.envAssignments))return null;let ee=lo(D,z.cwd,z.environment.paths);if(!ee.gitCwd||ee.hasExplicitGitContext)return null;let te=z.environment.worktreeFacts(ee.gitCwd);if(!te)return null;if(ql(D,z,te))return null;return{kind:"worktree",originalReason:N.reason,gitCwd:ee.gitCwd}}function ql(D,N,z){let{subcommand:ee,rest:te}=vn(D),he=ee?.toLowerCase();if(N.dynamicArguments||Zx(te)||tR(D,N.environment.env,N.envAssignments,z)||Qx(te)||Xx(he,te))return!0;return he==="clean"&&eR(te)>1}function Zx(D){return D.some((N)=>/[$*?[]/.test(N))}function Xx(D,N){if(D==="checkout"){let{before:z}=en(N),ee=an(z,{shortOptsWithValue:Bl}),te=z.some((je)=>kt(je,"--force"))||ee.has("-f"),he=ee.has("-B")||z.some((je)=>je==="-B"||je.startsWith("-B"));return te&&he}if(D==="switch"){let{before:z}=en(N),ee=an(z,{shortOptsWithValue:$l}),te=z.some((je)=>kt(je,"--force"))||z.some((je)=>kt(je,"--discard-changes"))||ee.has("-f"),he=z.some((je)=>je==="-C"||je.startsWith("-C")||Jx(je))||ee.has("-C");return te&&he}return!1}function Jx(D){let N=D.split("=",1)[0]??D;return N==="--force-create"||N.length>=9&&"--force-create".startsWith(N)}function Qx(D){return D.some((N)=>N.startsWith("--recurse-sub"))}function eR(D){let N=0;for(let z of D){if(z==="--force"){N++;continue}if(z.startsWith("-")&&!z.startsWith("--")){for(let ee of z.slice(1))if(ee==="f")N++}}return N}function tR(D,N,z,ee){if(Yn("GIT_CONFIG_PARAMETERS",N,z)!==void 0)return!0;let te=Rs(D,N,z);if(te.blockedReason!==null)return!0;let he=te.entries.map((at)=>({key:at.key.toLowerCase(),value:at.value}));if(he.some((at)=>rR(at.key)))return!0;let je=he.filter((at)=>at.key==="submodule.recurse").at(-1);if(je)return je.value===void 0||nR(je.value);if(Jd(z))return!0;return ee.recursiveSubmodules}function nR(D){let N=D.toLowerCase();return N!=="false"&&N!=="no"&&N!=="off"&&N!=="0"}function rR(D){return D==="include.path"||D.startsWith("includeif.")&&D.endsWith(".path")}function Rm(D,N,z){let ee=D.map((lt)=>$n(lt,z.shellAssignments??new Map)??t(lt)),te=z.environment.paths,he=lo(ee,z.cwd,te),je=z.originalCwd?te.realpath(sR(z.originalCwd)):null;if(N.id.startsWith("git.push-")||je===null||he.gitCwd===null||he.hasExplicitGitContext||_s(z.environment.env,z.envAssignments))return null;let at=N.id==="git.worktree-remove-force"?lR(D,z.shellAssignments,te):_m(he.gitCwd,te);if(at===null||N.id!=="git.worktree-remove-force"&&!aR(at,ee,N,z)||!ro(at,z.environment)||gs(at,z.environment)||oo(je,at)||oo(at,je))return null;return{kind:"temp-root",originalReason:N.reason,gitCwd:he.gitCwd}}function aR(D,N,z,ee){let te=ee.environment.paths,he=xm(D,".git");if(te.entryKind(he)!=="present")return!1;if(te.isDirectory(he))return!0;if(!z.localDiscard)return!1;let at=ee.environment.worktreeFacts(D);return at!==null&&!ql(N,ee,at)}function lR(D,N,z){let ee=vn(D.map(t)).rest,{before:te,after:he}=en(ee.slice(ee.indexOf("remove")+1)),je=[...te.filter((dt)=>!dt.startsWith("-")),...he],at=je.length===1?je[0]??"":"",lt=D.find((dt)=>dt.text===at),ct=(lt&&$n(lt,N??new Map))??at;if(!iR(ct)||/[\s$`*?[]/.test(ct)||z.entryKind(ct)!=="present"||!z.isDirectory(ct))return null;return z.realpath(ct)}function _m(D,N){if(N.entryKind(xm(D,".git"))!=="missing")return D;let z=oR(D);return z===D?null:_m(z,N)}var uR="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",dR=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function ws(D,N){return wm(D,N)}function wm(D,N,z){let ee=D.map(t),te=im(ee,N.environment.env,N.envAssignments),he=te.blockedReason?wt(vt("git.alias-config",te.blockedReason),N.policy):null;if(he)return he;let je=te.tokens;if((Xd(N.envAssignments)||sm(ee,N.environment.env,N.envAssignments))&&fR(je))return vt("git.ssh-env",uR);let at=lm(je,(ct)=>{let dt=lo(ee,N.cwd,N.environment.paths).gitCwd;return dt!==null&&N.environment.paths.entryKind(cR(dt,ct))!=="missing"});if(!at)return null;if(te.expanded||te.blockedReason)return at;let lt=Em(ee,at,N)??Rm(D,at,N);if(!lt)return at;return z?.(lt),null}function Pm(D,N){let z=null;return{match:wm(D,N,(te)=>{z=te}),relaxation:z}}function fR(D){let{subcommand:N,rest:z}=vn(D),ee=N?.toLowerCase();if(!ee)return!1;if(dR.has(ee))return!0;if(ee==="archive")return en(z).before.some((te)=>kt(te,"--remote"));return ee==="remote"&&mR(z)}function mR(D){return D.find((N)=>!pR(N))?.toLowerCase()==="update"}function pR(D){return D==="-v"||kt(D,"--verbose")||kt(D,"--no-verbose")}import{isAbsolute as UR}from"node:path";function Am(D,N,z,ee){let te=D.slice(0,N),he=D.slice(N+z);return ee.startsWith(te)&&ee.endsWith(he)?ee.slice(te.length,ee.length-he.length):null}function Ps(D,N,z){let ee=(he)=>`${he.tokenIndex}\x00${he.kind}\x00${he.value}`,te=new Set(D.map(ee));return Array.from(N).some((he)=>z(he).some((je)=>!te.has(ee(je))))}var Tm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",gR="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",hR="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",km="rm -rf targeting root or home directory is extremely dangerous and always blocked.",yR="rm -rf in home directory is dangerous. Change to a project directory first.",Im={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:km},git_metadata_target:{id:"rm.git-metadata",reason:x},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:hR},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:yR},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Tm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:gR},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Tm}};function As(D,N){let z=ur({...N,allowPaths:N.policy?.destructiveCommandAllowPaths,posixShell:!0}),ee=D.map(t),te=Nn(ee),he=Es(ee),je=CR(D);for(let at of je){let lt=Qo(at.word);if(te&&lt.unsafeBraceExpansion){let ct=wt(Jo({kind:"outside_anchored_cwd"},z,N.policy,Im),N.policy);if(ct)return ct;continue}for(let ct of lt.expandedTargets??[at.text]){let dt=hn(ct),ft={targetIsLiteral:lt.expandedTargets!==void 0||lt.targetIsLiteral,tmpdirWordSplittingProtected:lt.tmpdirWordSplittingProtected};if(!he&&z.resolvedCwd&&Ar(dt,z.resolvedCwd,z.protectedGitMetadata,he,z.environment,z.budget))return vt("rm.git-metadata",x);if(he&&!te){let ut=Mn(dt,z,ft);if(ut.kind==="root_or_home_target")return vt("rm.recursive-force-root-or-home",km);if(ut.kind==="git_metadata_target")return vt("rm.git-metadata",x);continue}if(!te)continue;for(let ut of bR(dt,z,ft)){let mt=Jo(ut,z,N.policy,Im),pt=wt(mt,N.policy);if(pt)return pt}}}return null}function bR(D,N,z){let ee=Mn(D,N,z);if(ee.kind==="cwd_self_target")return[ee,Mn(D,N,{...z,skipCwdSelf:!0})];if(ee.kind!=="home_cwd_target")return[ee];let te=Mn(D,N,{...z,skipHomeCwd:!0});if(te.kind!=="cwd_self_target")return[ee,te];return[ee,te,Mn(D,N,{...z,skipHomeCwd:!0,skipCwdSelf:!0})]}function CR(D){let N=[],z=!1;for(let ee of D.slice(1)){let te=t(ee);if(!te)continue;if(te==="--"){z=!0;continue}if(z){N.push({text:te,word:ee});continue}if(!te.startsWith("-"))N.push({text:te,word:ee})}return N}var fr={kind:"none"},Dr={kind:"dynamic"},SR=new Set(["<","<<","<<-","<<<","<&","<>"]),Mm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,vR=/^(?:[0-9]+|[@*])$/,ER=or.maxWords,Dm=or.maxInputLength;function Nm(D){if(!D||Pt(It(D.words[0]?.text??""))!=="printf")return;if(D.words.some((te)=>te.provenance!=="literal"))return;let N=D.words.slice(D.words[1]?.text==="--"?2:1),z=N[0]?.text;if(z===void 0)return"";let ee=N.slice(1).map((te)=>te.text);if(z==="%s")return ee.join("");if(z==="%s\\n"||z===`%s
+`)return`${ee.join(`
+`)}
+`;if(z.includes("%")||/\\(?![\\nrt])/.test(z))return;return z.replaceAll("\\n",`
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Ts(D){let N=co(D[1])==="--"?2:1;if(D.length<=N)return fr;let z=D.slice(N);if(!z.every(si))return Dr;return{kind:"literal",source:z.map(t).join(" ")}}function Lm(D){let N=co(D[1])==="--"?2:1,z=D[N],ee=co(z);if(z===void 0||D.length<=N+1||ee==="-"||ee===""||ee==="-l"||ee==="-p")return fr;if(!si(z))return Dr;return{kind:"literal",source:ee}}function Is(D,N){let z=Fm(D);if(z===-1)return fr;let ee=RR(N);if(!ee)return fr;let te=[],he=ee.command?.length??0;for(let je of ee.references){let at=wR(je,D,z,ee.ifs);if(!at)return Dr;if(he+=at.reduce((lt,ct)=>lt+ct.length+3,0),te.length+at.length>ER||he>Dm)return Dr;te.push(...at)}if(ee.command==="eval")return{kind:"literal",source:te.join(" ")};if(te.length===0||/\s/.test(te[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[ee.command,ee.command&&ee.optionTerminator?"--":null,...te.map(zm)].filter((je)=>je!==null).join(" ")}}function Wm(D,N){let z=Fm(D),ee=D.slice(z+1),te=/\bIFS\b/.test(N);if(z===-1||!ee.every(si)||te)return N;let he=ee.map(co),je="",at=null,lt=0;while(lt<N.length){let ct=N[lt]??"",dt=at==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(N.slice(lt));if(dt){let ft=dt[1]??dt[2],ut=ft==="@"||ft==="*"?he.slice(1):[he[Number(ft)]??""];if(at!=='"'&&ut.some((pt)=>/[*?[]/.test(pt)))return N;if(je+=at==='"'?ut.map((pt)=>pt.replace(/["$`\\]/g,"\\$&")).join(ft==="@"?'" "':" "):ut.map((pt)=>pt.split(/[ \t\n]+/).map((gt)=>gt?zm(gt):"").join(" ")).join(" "),je.length>Dm)return N;lt+=dt[0].length;continue}if(ct==="\\"&&at!=="'"){je+=N.slice(lt,lt+2),lt+=2;continue}if(ct==="'"&&at!=='"'||ct==='"'&&at!=="'")at=at?null:ct;je+=ct,lt++}return je}function Gm(D,N,z,ee){if(!bn(D.map(t)).readsStdinAsCommands)return fr;let te=N.filter((he)=>(he.fd===void 0||he.fd===0)&&SR.has(he.operator)).at(-1);if(te){if(te.operator==="<<"||te.operator==="<<-")return fr;if(te.operator!=="<<<"||te.target?.provenance!=="literal")return Dr;return{kind:"literal",source:te.target.text}}if(!z)return fr;return ee===void 0?Dr:{kind:"literal",source:ee}}function Qn(D,N=new Map){let z=bn(D.map(t)).scriptIndex;if(z===null)return fr;let ee=D[z],te=co(ee);if(Zi(ee,te))return{kind:"literal",source:te};let he=ee?$n(ee,N):null;return he===null?Dr:{kind:"literal",source:he}}var xR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Jl(D){if(D.words.length!==2||D.redirections.length!==0||D.nested.length!==1)return!1;let N=D.words[0],z=D.words[1];if(!N||N.provenance!=="literal"||N.quoted||N.raw!==N.text||!z)return!1;if(!(N.text==="eval"&&z.quoted&&z.parts.length===3&&z.parts[0]?.raw==='"'&&z.parts[1]?.provenance==="command-substitution"&&z.parts[1].raw.startsWith("$(")&&z.parts[2]?.raw==='"'||N.text==="eval"&&!z.quoted&&z.parts.length===1&&z.parts[0]?.provenance==="command-substitution"&&z.parts[0].raw.startsWith("$(")||(N.text==="source"||N.text===".")&&!z.quoted&&z.parts.length===1&&z.parts[0]?.provenance==="command-substitution"&&z.parts[0].raw.startsWith("<(")))return!1;let te=D.nested[0];if(te?.status!=="complete"||te.nodes.length!==1)return!1;let he=te.nodes[0];if(he?.kind!=="command"||he.redirections.length!==0||he.nested.length!==0||he.words.some((lt)=>lt.provenance!=="literal"||lt.parts.some((ct)=>ct.provenance!=="literal")))return!1;let je=he.words[0]?.text;if(je===void 0||wn(je)!==null)return!1;let at=Pt(It(je));return!xR.has(at)&&!Ht.has(at)&&!kr(at)}function Fm(D){return bn(D.map(t)).commandIndex??-1}function RR(D){let N=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(D.trim()),z=N?.[4]??D.trim(),ee=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(z),te=(ee?.[3]??z).split(/\s+/).map(_R);if(te.length===0||te.some((he)=>he===null))return null;return{command:ee?.[1]??null,optionTerminator:ee?.[2]!==void 0,references:te.filter((he)=>!!he),ifs:N?N[1]??N[2]??N[3]??"":` 	
+`}}function _R(D){let N=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(D),z=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(D),ee=N??z;if(!ee)return null;let te=ee[1]??ee[2];return{parameter:te==="@"||te==="*"?te:Number(te),quoted:N!==null}}function wR(D,N,z,ee){let te=N.slice(z+2);if(D.parameter==="@")return D.quoted?Yl(te):PR(te,ee);if(D.parameter==="*"){let at=Yl(te);if(!at)return;let lt=at.join(ee[0]??"");return D.quoted?[lt]:Zl(lt,ee)}let he=N[z+1+D.parameter];if(he&&!si(he))return;let je=co(he);return D.quoted?[je]:Zl(je,ee)}function Yl(D){return D.every(si)?D.map(t):void 0}function PR(D,N){let z=Yl(D);if(!z)return;let ee=z.map((te)=>Zl(te,N));return ee.some((te)=>te===void 0)?void 0:ee.flatMap((te)=>te??[])}function Zl(D,N){if(["*","?","[","]"].some((z)=>D.includes(z)))return;if(N==="")return D===""?[]:[D];if(N===` 	
+`)return D.trim().split(/\s+/).filter(Boolean);if(N.length!==1)return;return N===" "||N==="\t"||N===`
+`?D.trim().split(/\s+/).filter(Boolean):D.split(N).filter(Boolean)}function si(D){if(!D)return!0;return D.provenance==="unknown"?!/[$`]/.test(t(D)):D.provenance==="literal"}function co(D){return D?t(D):""}function zm(D){return`'${D.replaceAll("'",`'"'"'`)}'`}function Ql(D,N){return Xl(h(D,"posix"),N)}function ai(D){return Ql(D,new Set(Array.from(D.matchAll(Mm)).flatMap((N)=>{let z=N[1]??N[2];return z===void 0?[]:[z]})))}function Xl(D,N){if(D.status==="invalid"||D.status==="limited")return!1;let z=new Set(N);for(let ee of D.nodes){if(ee.kind==="group"){if(Xl(ee.body,z))return!0;continue}if(ee.kind!=="command")continue;if(ee.nested.some((te)=>Xl(te,z))||Bm(ee.words,z))return!0;OR(ee,z)}return!1}function Bm(D,N){let z=D.findIndex((je)=>wn(je.text)===null);if(z===-1)return!1;let ee=D[z];if(!ee)return!1;if(ii(ee,N))return!0;let te=It(ee.text);if(te==="source"||te==="."){let je=D[z+1]?.text==="--"?z+2:z+1;return Om(D[je],N)}if(Ht.has(te)){let je=D.slice(z),at=bn(je.map((ct)=>ct.text)),lt=at.commandIndex??at.scriptIndex;return!at.syntaxCheck&&lt!==null&&Om(je[lt],N)}let he=AR(D,z,N);if(he===null)return!1;if(he===-1)return!0;return Bm(D.slice(he),N)}function AR(D,N,z){let ee=It(D[N]?.text??"");if(ee==="command")return TR(D,N+1);if(ee==="exec")return IR(D,N+1);if(ee==="env")return kR(D,N+1,z);return null}function TR(D,N){for(let z=N;z<D.length;z++){let ee=D[z]?.text??"";if(ee==="--")return D[z+1]?z+1:null;if(/^-[p]*[vV][pvV]*$/.test(ee))return null;if(/^-p+$/.test(ee))continue;return z}return null}function IR(D,N){for(let z=N;z<D.length;z++){let ee=D[z]?.text??"";if(ee==="--")return D[z+1]?z+1:null;if(ee==="-a"){z++;continue}if(/^-a.+/.test(ee)||/^-[cl]+$/.test(ee))continue;return z}return null}function kR(D,N,z){for(let ee=N;ee<D.length;ee++){let te=D[ee],he=te?.text??"";if(he==="--")return D[ee+1]?ee+1:null;if(he==="-S"||he==="--split-string")return ii(D[ee+1],z)?-1:ee+2;if(he.startsWith("-S")||he.startsWith("--split-string="))return ii(te,z)?-1:ee+1;if(he==="-u"||he==="--unset"||he==="-C"||he==="--chdir"||he==="-P"){ee++;continue}if(he==="-i"||he==="-0"||he==="--null"||he.startsWith("-u=")||he.startsWith("--unset=")||he.startsWith("-C")||he.startsWith("--chdir=")||he.startsWith("-P"))continue;if(he.startsWith("-"))continue;if(wn(he))continue;return ee}return null}function OR(D,N){if(!D.words.every((z)=>wn(z.text)!==null))return;for(let z of D.words){let ee=wn(z.text);if(!ee)continue;if(ii(z,N))N.add(ee.name)}}function ii(D,N){if(!D)return!1;return D.parts.filter((z)=>z.provenance==="variable").some((z)=>Array.from(z.raw.matchAll(Mm)).some((ee)=>{let te=ee[1]??ee[2];return te!==void 0&&(vR.test(te)||N.has(te))}))}function Om(D,N){return!!D&&(D.parts.some((z)=>z.provenance!=="literal"&&z.provenance!=="variable")||ii(D,N))}var ec="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",tc="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",MR="__CC_SAFETY_NET_XARGS_INPUT__",ks="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Os="rm",DR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,NR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,LR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,WR=/^(?:[0-9]+|[@*])$/;function Hm(D,N){let z=D.map(t),{childStart:ee,replacementToken:te}=Nr(z),he=z.slice(ee),je=vt("xargs.shell-dynamic",tc);if(FR(he,te,N)&&wt(je,N.policy))return wt(je,N.policy);for(let at of Dn(he,N)){let lt=at.tokens,ct=te!==null&&lt[0]!==he[0]&&(lt[0]?.includes(te)??!1)?wt(je,N.policy):null;if(ct)return ct;let dt=Zm(lt,te,at.wrapperEnvAssignments),ft=at.head==="rm"&&te!==null&&qm(lt,te),ut=N.analyzeChild(lt,{...Or(at,N),dynamicInput:dt,dynamicSourceInput:ft||Vm(lt,at.head,te,at.wrapperEnvAssignments,dt,N.environment,N.strict?void 0:N.analyzeNested),dynamicRmInput:ft,shellDynamicMatch:je,dynamicSourceMatch:je,rmDynamicMatch:vt("xargs.rm-recursive-force-dynamic",ec)});if(ut)return ut;let mt=GR(lt,te,N.policy?.rules??[],wt(je,N.policy));if(mt)return mt;if(at.head==="git"){let gt=te===null?[...lt,MR]:lt,ht=te!==null&&(lt.some((Ct)=>Ct.includes(te))||Array.from(at.envAssignments.values()).some((Ct)=>Ct.includes(te))),yt=N.analyzeChild(gt,{...Or(at,N),worktreeMode:te===null||ht?!1:N.worktreeMode});if(yt)return yt}let pt=_(lt,N.policy?.rules??[]);if(pt)return pt}return null}function GR(D,N,z,ee){if(z.length===0)return null;if(N===null){for(let he of z){let je=_([...D,...he.subcommand?[he.subcommand]:[],...he.block_args],z);if(je)return je}return null}let te=It(D[0]??"");if(!z.some((he)=>It(he.command)===te))return null;return D.slice(1).some((he)=>he.includes(N))?ee:null}function jm(D,N,z){let ee=D.indexOf(N);if(ee===-1||D.indexOf(N,ee+N.length)!==-1)return[];let te=Am(D,ee,N.length,z);return te===null?[]:[te]}function Vm(D,N,z,ee,te,he,je){if(Ht.has(N)){if(Xn(D))return!1;if(z!==null&&zR(D,z,je))return!0;let at=Ln(D);if(!at){let lt=Qn(Ut(D));if(lt.kind==="literal")return z!==null&&lt.source.includes(z);return lt.kind==="none"&&te}if(z!==null&&at.includes(z)&&!Km(at,z,je))return!0;if(_n(at))return!0;return BR(at,z,ee)}if(Tn(N))return $m(D,z,ts,Vd(N));if(Rn.has(N))return $m(D,z,Ol,Kf);if(N==="eval"){let at=Ts(Ut(D));if(at.kind==="dynamic")return!0;if(z!==null)return at.kind==="literal"&&at.source.includes(z);return te}if(N==="find")return $R(D,z,he);if(N==="git"){let at=vn(D);return z===null?at.subcommand===null:(at.subcommand?.includes(z)??!1)||at.subcommand!==null&&ao.has(at.subcommand.toLowerCase())&&Ym(at.rest,z).some((lt)=>lt.includes(z))}return!1}function Km(D,N,z){if(z===void 0)return!1;let ee=N.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${ee}`).test(D)||/\bcase\b/.test(D))return!1;let he=D.replaceAll(N,"/");return _n(he)===null&&z(he)===null}function $m(D,N,z,ee){let te=z(D);if(N===null)return te.optionsOpen||z([...D,ks]).sources.some((at)=>at.value===ks);if(te.sources.some((at)=>at.value.includes(N)))return!0;let he=ee.flatMap((at)=>[at.selector,...at.valueForm==="attached-only"||at.valueForm==="attached-or-separate"?[`${at.selector}${ks}`]:[],...at.valueForm==="equals-or-separate"?[`${at.selector}=${ks}`]:[]]),je=new Set(he.flatMap((at)=>D.flatMap((lt)=>jm(lt,N,at))));return Ps(te.sources,je,(at)=>z(D.map((lt)=>lt.replaceAll(N,at))).sources)}function FR(D,N,z){if(D.length===0||(D[0]??"").toLowerCase()==="command")return!1;let ee=new Set(Array.from(Dn(D,z),(he)=>he.head)),te=N===null?[...D,Os]:D.map((he,je)=>je===0?he:he.replaceAll(N,Os));return Array.from(Dn(te,z)).some((he)=>he.head===Os&&!ee.has(Os))}function qm(D,N){return Ym(D.slice(1),N).some((z)=>z.includes(N)&&(z.startsWith("-")||z.startsWith(N)))}function Ym(D,N){let z=D.findIndex((ee)=>ee==="--"&&!ee.includes(N));return z===-1?D:D.slice(0,z)}function Zm(D,N,z){if(N===null)return!0;return D.some((ee)=>ee.includes(N))||Array.from(z.values()).some((ee)=>ee.includes(N))}function zR(D,N,z){let ee=bn(D),te=ee.commandIndex===null?"":D[ee.commandIndex]??"";if(te.includes(N)&&!Km(te,N,z)||ee.scriptIndex!==null&&(D[ee.scriptIndex]??"").includes(N))return!0;return["-c","-nc","-cn",`--${N}`,N].some((je)=>D.some((at,lt)=>{if(lt===0||!at.includes(N))return!1;return jm(at,N,je).some((dt)=>{let ft=D.map((mt,pt)=>pt===lt?mt.replaceAll(N,dt):mt),ut=bn(ft);if(ut.commandIndex===null&&ut.scriptIndex===null)return!1;if(ee.commandIndex===null&&ut.commandIndex!==null)return!0;if(ee.scriptIndex===null&&ut.scriptIndex!==null)return!0;if(ut.commandIndex!==null&&(ft[ut.commandIndex]??"").includes(dt))return!0;return ut.scriptIndex!==null&&(ft[ut.scriptIndex]??"").includes(dt)})}))}function BR(D,N,z){let ee=new Set(N===null?[]:Array.from(z).filter(([,te])=>te.includes(N)).map(([te])=>te));for(let te of D.matchAll(DR))if(Um(te,ee))return!0;for(let te of D.matchAll(NR))for(let he of(te[1]??"").matchAll(LR))if(Um(he,ee))return!0;return Ql(D,ee)}function Um(D,N){let z=D[1]??D[2];return z!==void 0&&(WR.test(z)||N.has(z))}function $R(D,N,z){if(N===null)return!0;let ee=!1,te=0;for(let he=1;he<D.length;he++){let je=D[he]??"";if(!ee&&!je.startsWith("-")&&je!=="!"&&je!=="("){if(je.indexOf(N)===0)return!0;continue}if(ee=!0,te>0){te--;continue}if(Bn(je)){let lt=so(D,he);he=lt.nextIndex-1;for(let ct of Dn(lt.tokens,{environment:z,cwd:void 0})){let dt=Zm(ct.tokens,N,ct.wrapperEnvAssignments);if(ct.head==="rm"&&qm(ct.tokens,N)||Vm(ct.tokens,ct.head,N,ct.wrapperEnvAssignments,dt,z))return!0}continue}let at=Jn(je);if(at>0){if(te=at,je.includes(N))return!0;continue}if(je.includes(N))return!0}return!1}function Nr(D){let N=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),z=null,ee=1;while(ee<D.length){let te=D[ee];if(!te)break;if(te==="--")return{childStart:ee+1,replacementToken:z};if(!te.startsWith("-"))return{childStart:ee,replacementToken:z};if(te==="-I"){z=D[ee+1]??"{}",ee+=2;continue}if(te.startsWith("-I")&&te.length>2){z=te.slice(2),ee++;continue}if(te==="--replace"){z="{}",ee++;continue}if(te.startsWith("--replace=")){let he=te.slice(10);z=he===""?"{}":he,ee++;continue}if(te==="-J"){z=D[ee+1]??"{}",ee+=2;continue}ee+=N.has(te)?2:1}return{childStart:D.length,replacementToken:z}}var li="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",ci="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",HR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",jR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Ds=/\{[^{}\s]*\}/g,Xm=/\{\}|\{-?\d+\}/g,VR=["e","f","source","file","-e","-f","--source","--file"],KR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],qR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),YR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Jm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),ZR=new Set(["--workdir","--wd"]),Qm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Pn(D,N){for(let z of D){let ee=N(z);if(ee)return ee}return null}function op(D){return Pn([...D],(N)=>_n(N))}function ip(D,N){let z=D.map(t);if((N.envAssignments?.has("PARALLEL")?N.envAssignments.get("PARALLEL"):N.environment.env.get("PARALLEL"))?.trim()){let pt=uo(N);if(pt)return pt}if(z.length===2&&(z[1]==="--version"||z[1]==="--help"))return null;let te=pp(z),{template:he,jobs:je,runsRemotely:at,readsCommandsFromInput:lt,unsupported:ct,workdir:dt,dryRun:ft}=te;if(ct){let pt=uo(N);if(pt)return pt;let gt=op(N.envAssignments?.values()??[]);if(gt)return gt}if(lt){let pt=n_(N);if(pt)return pt}if(dt!==void 0&&at){let pt=uo(N);if(pt)return pt}let ut=r_(dt,N.cwd,N.environment.paths);if(ut===null){let pt=uo(N);if(pt)return pt}let mt=at?{...N,cwd:void 0,originalCwd:void 0}:ut===null||ut===void 0||ut===N.cwd?N:{...N,cwd:ut};if(ft){if([...Dn(he,mt)].flatMap((gt)=>[...gt.envAssignments.values()]).some(oc)){let gt=uo(N);if(gt)return gt}return null}if(he.length===0){let pt=je.map((ht)=>ht[0]??"");N.budget.charge("derivedTokens",pt.length);let gt=cp(mt.envAssignments,mt.cwd,at);return Pn(pt,(ht)=>N.analyzeNested(ht,gt))}return Pn(Dn(he,mt),(pt)=>XR(pt,te,N,mt))}function XR(D,N,z,ee){let{jobs:te,templateHasPlaceholder:he,runsRemotely:je,usesStdin:at}=N,lt=D.tokens,ct=[...D.envAssignments.values()];if(ct.some(fp)){let ht=uo(z);if(ht)return ht}let dt=op(ct);if(dt)return dt;let ft=ct.some(Gt),ut=he||ft,mt=at&&ut,pt=cp(D.envAssignments,D.wrapperCwd,je||mt);if(Ht.has(D.head)){let ht=()=>{if(!he||te.length===0)return null;return Pn(te,(bt)=>z.analyzeChild(Ms(lt,bt,z.budget),Or(D,ee)))};if(Xn(lt))return ht();let yt=Ln(lt);if(yt){if(mp(yt)){let Et=mr(z);if(Et)return Et;if(te.length===0)return null;return Pn(te,(At)=>z.analyzeNested(np(yt,At,z.budget),pt))}if(Gt(yt)){if(te.length>0)return Pn(te,(Dt)=>z.analyzeNested(np(yt,Dt,z.budget),pt));let Et=oi(yt);if(Et?.[0]&&It(Et[0])==="rm"&&Nn(Et)){let Dt=tp(z);if(Dt)return Dt}let At=Et?z.analyzeChild(Et,{...Or(D,ee),dynamicInput:at,shellDynamicMatch:vt("parallel.shell-dynamic",ci),rmDynamicMatch:vt("parallel.rm-recursive-force-dynamic",li)}):null;if(At)return At;return z.analyzeNested(yt,pt)}let bt=!ft&&(!he||te.length>0)?(te.length>0?te:[void 0]).map((Et)=>Is(Ut(Et===void 0?lt:he?lt.map((At)=>up(At,Et)):[...lt,...Et]),yt)):[];if(bt.some((Et)=>Et.kind==="dynamic")){let Et=mr(z);if(Et)return Et}let xt=bt.flatMap((Et)=>Et.kind==="literal"?[Et.source]:[]);if(xt.length>0)return z.budget.charge("derivedTokens",xt.length),Pn(xt,(Et)=>z.analyzeNested(Et,pt));if(ai(yt)){let Et=mr(z);if(Et)return Et}let _t=z.analyzeNested(yt,pt);if(_t)return _t;if(ut)return mr(z);return null}let Ct=Qn(Ut(lt));if(Ct.kind==="dynamic"||Ct.kind==="literal"&&Gt(Ct.source))return mr(z)??ht();if(Ct.kind==="literal")return ht();if(te.length>0){let bt=mr(z);if(bt)return bt;let xt=ht();if(xt)return xt;if(he)return null;let _t=te.flatMap((Et)=>Et[0]===void 0?[]:[Et[0]]);return z.budget.charge("derivedTokens",_t.length),Pn(_t,(Et)=>z.analyzeNested(Et,pt))}if(ut||at)return mr(z)??ht();return null}if(D.head==="rm"&&Nn(lt)){if(he&&te.length>0)return Pn(te,(yt)=>nc(Ms(lt,yt,z.budget,Xm),D.cwd,ee));if(te.length>0)return Pn(te,(yt)=>nc(rp(lt,yt,z.budget),D.cwd,ee));let ht=nc(lt.flatMap((yt,Ct)=>{if(Ct===0||!Gt(yt))return[yt];return yt.startsWith("-")?[yt.replace(Xm,"")]:[]}),D.cwd,ee);if(ht)return ht;return tp(z)}let gt=te.length>0?te:[void 0];return Pn(gt,(ht)=>{let yt=ht===void 0?lt:he?Ms(lt,ht,z.budget):rp(lt,ht,z.budget),Ct=vt("parallel.shell-dynamic",ci),bt=at&&D.head==="find"?t_(yt,ee):null,xt=ap(yt,at,z)??bt?.customResult??null,_t=It(D.head),Et=at&&(_t==="rm"&&rc(yt)||_t==="xargs"&&lp(yt)||bt?.rmOptions===!0),At=at&&(Et||bt?.executedSource===!0||bt===null&&sp(yt,_t)),Dt=z.analyzeChild(yt,{...Or(D,ee),worktreeMode:je||at||ut?!1:z.worktreeMode,dynamicInput:at||ut,dynamicRmInput:Et,dynamicSourceInput:xt!==null||At,shellDynamicMatch:Ct,dynamicSourceMatch:Ct,rmDynamicMatch:vt("parallel.rm-recursive-force-dynamic",li)});if(At){let qt=wt(Ct,z.policy);if(qt)return qt}return Dt??xt??_(yt,z.policy?.rules??[])})}function sp(D,N){if(Gt(D[0]??""))return!0;if(N==="eval"||N==="source"||N===".")return!0;if(N==="parallel"||N==="xargs")return!0;if(Ht.has(N))return e_(D);if(N==="git")return JR(D);if(N==="find")return!0;if(Rn.has(N))return ep(D,VR,ni);if(Tn(N))return ep(D,KR,es);return!1}function rc(D){let N=D.indexOf("--"),z=D.slice(1,N===-1?void 0:N);if(!D.some(Gt))return N===-1;return z.some((te)=>Gt(te)&&(te.startsWith("-")||mp(te)))}function JR(D){if(QR(D))return!0;let N=vn(D);if(N.subcommand===null||Gt(N.subcommand))return!0;if(!ao.has(N.subcommand.toLowerCase()))return!1;let z=N.rest.indexOf("--"),ee=N.rest.slice(0,z===-1?void 0:z);if(!D.some(Gt))return z===-1;return ee.some(Gt)}function QR(D){for(let N=1;N<D.length;N++){let z=D[N];if(!z||z==="--"||!z.startsWith("-"))return!1;if(z==="-c"||z==="--config-env"){if(Gt(D[N+1]??""))return!0;N++;continue}if(z.startsWith("-c")&&z.length>2||z.startsWith("--config-env=")){if(Gt(z))return!0;continue}if(Gt(z))return!0}return!1}function e_(D){if(Xn(D))return!1;let N=Ln(D);if(N!==null)return Gt(N);let z=Qn(Ut(D));if(z.kind==="literal")return Gt(z.source);if(z.kind==="dynamic")return!0;return!D.some(Gt)}function ep(D,N,z){let ee=z(D);if(ee.some((te)=>Gt(te.value)))return!0;if(!D.some(Gt))return z([...D,Qm]).some((te)=>te.value===Qm);return Ps(ee,N,(te)=>z(D.map((he)=>up(he,[te]))))}function ap(D,N,z){let ee=z.policy?.rules??[];if(!N||ee.length===0)return null;let te=ee.filter((he)=>It(he.command)===It(D[0]??""));if(te.length===0)return null;if(D.slice(1).some(Gt))return mr(z);return Pn(te,(he)=>_([...D,...he.subcommand?[he.subcommand]:[],...he.block_args],[he]))}function t_(D,N){let z={customResult:null,executedSource:!D.some(Gt),rmOptions:!1},ee=!1,te=0,he=null,je=()=>{if(!he?.some(Gt))return;for(let at of Dn(he,N))z.executedSource||=sp(at.tokens,at.head),z.rmOptions||=at.head==="rm"&&rc(at.tokens)||at.head==="xargs"&&lp(at.tokens),z.customResult??=ap(at.tokens,!0,N)};for(let at of D.slice(1)){if(!ee&&!at.startsWith("-")&&at!=="!"&&at!=="("){z.executedSource||=Gt(at);continue}if(ee=!0,he){if(at===";"||at==="+"){je(),he=null;continue}he.push(at);continue}if(te>0){te--;continue}if(Bn(at)){he=[],z.executedSource||=Gt(at);continue}let lt=Jn(at);if(lt>0){te=lt,z.executedSource||=Gt(at);continue}z.executedSource||=Gt(at)}return je(),z}function lp(D){let N=D.slice(Nr(D).childStart);return It(N[0]??"")==="rm"&&rc(N)}function Ns(D,N){return(z)=>wt(vt(D,N),z.policy)}var mr=Ns("parallel.shell-dynamic",ci),n_=Ns("parallel.command-stream-dynamic",HR),uo=Ns("parallel.command-stream-dynamic",jR),tp=Ns("parallel.rm-recursive-force-dynamic",li);function nc(D,N,z){return wt(As(Ut(D),{environment:z.environment,cwd:N,budget:z.budget,originalCwd:z.originalCwd,strict:z.strict,paranoid:z.paranoidRm,allowTmpdirVar:z.allowTmpdirVar,tmpdirWordSplittingUnsafe:cr(z.envAssignments??new Map,z.environment),trustedTmpdirValue:Tr(z.envAssignments??new Map,z.environment),protectedGitMetadata:z.protectedGitMetadata,policy:z.policy}),z.policy)}function cp(D,N,z){let ee={};if(D)ee.envAssignments=D;if(z)return ee.effectiveCwd=null,ee.worktreeMode=!1,ee;if(N!==void 0)ee.effectiveCwd=N;return Object.keys(ee).length>0?ee:void 0}function up(D,N){return D.replace(Ds,(z)=>dp(z,N))}function Ms(D,N,z,ee=Ds){return z.charge("derivedTokens",D.reduce((te,he)=>te+1+Math.floor(he.length/64),0)),D.map((te)=>te.replace(ee,(he)=>{let je=dp(he,N);return z.charge("derivedTokens",Math.max(1,Math.ceil(je.length/64))),je}))}function np(D,N,z){return Ms([D],N,z)[0]??""}function rp(D,N,z){return z.charge("derivedTokens",D.length+N.length),[...D,...N]}function dp(D,N){let z=/^\{(-?\d+)[^{}\s]*\}$/.exec(D)?.[1];if(z===void 0)return N[0]??"";let ee=Number(z);return N[ee>0?ee-1:N.length+ee]??""}function Gt(D){return D.search(Ds)!==-1}function fp(D){if(oc(D))return!0;for(let N of D.matchAll(Ds))if(!/^(?:\{\}|\{\d+\})$/.test(N[0]))return!0;return!1}function oc(D){let N=D.indexOf("{=");return N!==-1&&D.indexOf("=}",N+2)!==-1}function mp(D){return/^\{[^{}\s]*\}$/.test(D)}function r_(D,N,z){if(D===void 0)return;if(D==="..."||/^~|[{}$`*?[]/.test(D))return null;if(!N&&!UR(D))return null;try{return ir(N??D,D,z)}catch{return null}}function pp(D){let N=1,z=[],ee=D.length,te=-1,he=!1,je=!1,at,lt=!1,ct=D.some((pt)=>pt==="::::"||pt==="::::+"||pt===":::+");while(N<D.length){let pt=D[N];if(pt===void 0)break;if(pt===":::"){te=N;break}if(pt==="--"){let bt=Nl(D,N+1);z.push(...bt.templateTokens),ee=N+1,te=bt.markerIndex;break}if(!pt.startsWith("-")){let bt=Nl(D,N);z.push(...bt.templateTokens),ee=N,te=bt.markerIndex;break}let gt=D[N+1],ht=pt.indexOf("="),yt=ht===-1?pt:pt.slice(0,ht),Ct=ht===-1?void 0:pt.slice(ht+1);if(pt==="--dry-run"){lt=!0,N++;continue}if(pt==="-I"||pt.startsWith("-I")&&pt.length>2){ct||=(pt==="-I"?gt:pt.slice(2))!=="{}",N+=pt==="-I"?2:1;continue}if(pt==="--replace"||pt==="-i"){ct=!0,N+=2;continue}if(yt==="--replace"||pt.startsWith("-i")&&pt.length>2){let bt=yt==="--replace"?Ct:pt.slice(2);ct||=bt!==""&&bt!=="{}",N++;continue}if(pt==="-a"||YR.has(yt)){ct=!0,N+=Ct===void 0?2:1;continue}if(pt==="--pipe"||pt==="--pipepart"){je=!0,N++;continue}if(yt==="--env"){ct=!0,N+=Ct===void 0?2:1;continue}if(Jm.has(yt)||pt.startsWith("-S")&&pt.length>2){he=!0,N+=Jm.has(pt)?2:1;continue}if(ZR.has(yt)){ct=!0;let bt=Ct??gt;if(bt===void 0||bt===":::"||bt==="--"){N++;continue}at=bt,N+=Ct===void 0?2:1;continue}if(pt.startsWith("-j")&&pt.length>2&&/^\d+$/.test(pt.slice(2))){N++;continue}if(pt.startsWith("--")&&Ct!==void 0){N++;continue}if(qR.has(pt)){if(gt===void 0||gt===":::"||gt==="--"){ct=!0,N++;continue}N+=2;continue}N+=pt==="-j"||pt==="--jobs"?2:1}ct||=z.some(lt?oc:fp);let dt=[];if(te!==-1){let pt=[];for(let gt=te+1;gt<D.length;gt++){let ht=D[gt];if(ht===":::"){dt.push(pt),pt=[];continue}if(ht!==void 0)pt.push(ht)}dt.push(pt)}ct||=dt.length>1;let ft=o_(dt),ut=z.some(Gt),mt=z.length===0&&te===-1;return{template:z,jobs:ft,childStart:ee,templateHasPlaceholder:ut,runsRemotely:he,usesStdin:je||te===-1,readsCommandsFromInput:mt,unsupported:ct,workdir:at,dryRun:lt}}function o_(D){if(D.length===0||D.some((z)=>z.length===0))return[];let N=[[]];for(let[z,ee]of D.entries()){if(ee.length===1){let he=ee[0];if(he===void 0)return[];for(let je of N)je.push(he);if(N.length*(z+1)>a.derivedTokens.cap)throw new s("derivedTokens");continue}let te=[];for(let he of N)for(let je of ee){if((te.length+1)*(z+1)>a.derivedTokens.cap)throw new s("derivedTokens");te.push([...he,je])}N=te}return N}function gp(D){return pp(D).childStart}var i_="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Ls="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function sc(D){return D?.parts.some((N)=>N.provenance==="command-substitution")??!1}function ic(D){return D?.parts.some((N)=>N.provenance==="literal"&&N.raw.replace(/^["']/,"").startsWith("-"))??!1}function yp(D,N,z,ee,te=!1,he){let at=(Do(D,N)||ee&&D!=="powershell"&&N[0]?.provenance==="variable")&&Jt(he,"shell.dynamic-executable",te)?vt("shell.dynamic-executable",i_):null;return wt(at,he)??bp(D,N,z,te,he)}function bp(D,N,z,ee,te){if(N.length<2)return null;let he=N.flatMap((at,lt)=>sc(at)?[lt]:[]);if(he.length===0)return null;let je=It(N[0]?.text??"");if(je==="git"){let at=Q(D,N),lt=a_(at);if(Jt(te,"shell.dynamic-structure",ee)&&he.some((ft)=>ft<=lt))return wt(vt("shell.dynamic-structure",Ls),te);if(wt(ws(at,{environment:z}),te))return null;let ct=N[lt]?.text.toLowerCase(),dt=at.findIndex((ft,ut)=>ut>lt&&t(ft)==="--");if(Jt(te,"shell.dynamic-structure",ee)&&ct&&ao.has(ct)&&he.some((ft)=>ft>lt&&(dt===-1||ft<dt)))return wt(vt("shell.dynamic-structure",Ls),te);return null}if(je==="find")return Jt(te,"shell.dynamic-structure",ee)&&l_(N)?wt(vt("shell.dynamic-structure",Ls),te):null;if(je==="rm"){let at=N.findIndex((ct,dt)=>dt>0&&t(ct)==="--"),lt=Nn(N.map(t));return Jt(te,"shell.dynamic-structure",ee)&&he.some((ct)=>(at===-1||ct<at)&&(ct<N.length-1||!lt))?wt(vt("shell.dynamic-structure",Ls),te):null}if(je==="xargs")return hp(D,N.slice(Nr(N.map(t)).childStart),"xargs",z,ee,te);if(je==="parallel")return hp(D,N.slice(gp(N.map(t))),"parallel",z,ee,te);return null}function hp(D,N,z,ee,te,he){if(N.length===0)return null;let je=s_(N,ee);if(Do(D,je)){let lt=wt(vt(`${z}.shell-dynamic`,z==="xargs"?tc:ci),he);if(lt)return lt}let at=bp(D,je,ee,te,he);if(at)return at;if(je[0]?.text==="rm"&&je.slice(1).some((lt)=>sc(lt)&&ic(lt)))return wt(vt(`${z}.rm-recursive-force-dynamic`,z==="xargs"?ec:li),he);return null}function s_(D,N){let z=wr(D,N),ee=z.rewritten?Ut(z.words.map(t)):z.words,te=ee[0];return te&&t(te)==="busybox"?ee.slice(1):ee}function a_(D){let N=1;while(N<D.length){let z=D[N],ee=z?t(z):"";if(yn.has(ee)){N+=2;continue}if(ee.startsWith("-")){N++;continue}return N}return N}function l_(D){let N=!1,z=0,ee=!1,te=!1;for(let he=1;he<D.length;he++){let je=D[he];if(!je)continue;let at=sc(je);if(z>0){z--;continue}if(te){if(je.text===";"||je.text==="+"){te=!1,N=!0,ee=!1;continue}if(at&&(ee||ic(je)))return!0;ee=!1;continue}if(!N&&!je.text.startsWith("-")){if(at&&(he>1||ic(je)))return!0;continue}if(N=!0,at)return!0;let lt=Jn(je.text);if(lt>0){z=lt;continue}if(Bn(je.text))te=!0,ee=!0}return!1}function ac(D,N){return D.some((z)=>{if(z.value==="-"&&(z.kind==="main-script"||z.kind==="program-file"))return!0;return!Zi(N[z.tokenIndex],z.value)})}var Sp=[{heads:new Set(["rm","rmdir"]),analyze:(D)=>As(D.words,{environment:D.options.environment,cwd:D.cwd,originalCwd:D.originalCwd,strict:D.options.strict,paranoid:D.options.paranoidRm,allowTmpdirVar:D.allowTmpdirVar,tmpdirWordSplittingUnsafe:cr(D.envAssignments,D.options.environment),trustedTmpdirValue:Tr(D.envAssignments,D.options.environment),protectedGitMetadata:D.options.protectedGitMetadata,policy:D.options.policy,budget:D.options.budget})},{heads:new Set(["git"]),analyze:(D)=>ws(D.words,lc(D))},{heads:new Set(["find"]),analyze:(D)=>rm(D.words,{environment:D.options.environment,cwd:D.cwd,originalCwd:D.originalCwd,strict:D.options.strict,allowTmpdirVar:D.allowTmpdirVar,tmpdirWordSplittingUnsafe:cr(D.envAssignments,D.options.environment),trustedTmpdirValue:Tr(D.envAssignments,D.options.environment),protectedGitMetadata:D.options.protectedGitMetadata,budget:D.options.budget,envAssignments:D.envAssignments,policy:D.options.policy,analyzeTokens:D.analyzeChildTokens,analyzeNested:(N,z)=>Lr(D.options.analyzeNested(N,z))})},{heads:new Set(["xargs"]),analyze:(D)=>Hm(D.words,{...Cp(D),analyzeChild:D.analyzeChild,analyzeNested:(N,z)=>Lr(D.options.analyzeNested(N,z))})},{heads:new Set(["parallel"]),analyze:(D)=>ip(D.words,{...Cp(D),analyzeChild:D.analyzeChild,analyzeNested:(N,z)=>Lr(D.options.analyzeNested(N,z))})}];function Cp(D){return{environment:D.options.environment,cwd:D.cwd,originalCwd:D.originalCwd,strict:D.options.strict,paranoidRm:D.options.paranoidRm,paranoidInterpreters:D.options.paranoidInterpreters,allowTmpdirVar:D.allowTmpdirVar,protectedGitMetadata:D.options.protectedGitMetadata,budget:D.options.budget,envAssignments:D.envAssignments,worktreeMode:D.options.worktreeMode,policy:D.options.policy}}function Lr(D){return D?{id:D.ruleId??"",reason:D.reason,intent:D.intent??"manual_only"}:null}function lc(D){return{environment:D.options.environment,cwd:D.cwd,originalCwd:D.originalCwd,dynamicArguments:D.dynamicArguments,envAssignments:D.envAssignments,shellAssignments:D.options.shellAssignments,policy:D.options.policy,worktreeMode:D.options.worktreeMode}}function xp(D){return Sp.find((N)=>N.heads.has(D))?.analyze}function mo(D,N,z){let ee=z.trace;if(D.length===0)return null;let te=z.commandView?.dialect??"posix",he=(Rt)=>Rt.map((Tt)=>te==="posix"?t(Tt):Tt.text),je=z.child,at=je!==void 0&&!je.embedded,lt=je?.embedded===!0,ct=z.effectiveCwd===null,dt=je?je.cwd:ct?void 0:z.effectiveCwd??z.cwd,ft=je?je.originalCwd:ct?void 0:z.cwd,ut=ge(D);if(ut.envAssignments.size>0)ee?.recordSegment({type:"env-strip",input:he(D),envVars:[...ut.envAssignments.keys()],output:he(ut.words)});let mt=wr(ut.words,z.environment,dt,new Map([...z.envAssignments??[],...ut.envAssignments])),pt=mt.envSplitValues??[];if(pt.length>0){let Rt=[...pt,...he(mt.words)].join(" "),Tt=_n(Rt);if(Tt)return ee?.recordSegment({type:"dangerous-text",token:Rt,matched:!0,reason:Tt.reason}),sn(Tt);if(z.strict)return fn(ee);let Nt=os(pt,he(mt.words));if(Nt){z.budget.charge("derivedTokens",Nt.length);let Yt=z.analyzeNested(Nt.join(" "),{effectiveCwd:mt.cwd===void 0?z.effectiveCwd:mt.cwd,envAssignments:new Map([...z.envAssignments??[],...ut.envAssignments,...mt.envAssignments])});if(Yt)return Yt}}let gt=mt.rewritten?Ut(he(mt.words)):Q(te,mt.words),ht=he(gt),yt={...z,wrapperNormalizationBudget:z.wrapperNormalizationBudget??{iterations:0}};if(ee&&ut.words.length>gt.length){let Rt=he(ut.words);ee.recordSegment({type:"leading-tokens-stripped",input:Rt,removed:Rt.slice(0,Rt.length-gt.length),output:ht})}let Ct=new Map([...z.envAssignments??[],...ut.envAssignments,...mt.envAssignments]),bt=ht[0];if(!bt)return null;if(kr(bt))throw new s("wrapperPeelIterations");let xt=It(bt),_t=mt.cwd===null?void 0:mt.cwd??dt,Et=mt.cwd===null?void 0:ft,At=mt.cwd===void 0?z.effectiveCwd:mt.cwd,Dt=je?je.allowTmpdirVar:!Xo(Ct,z.environment),qt=yp(te,mt.words,z.environment,N===0,z.strict,z.policy);if(qt)return ee?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:qt.reason}),sn(qt);let jn=Ss(ht,z.policy);if(jn){for(let Rt of[jn.childIndex,...jn.alternativeChildIndices]){vp(yt.wrapperNormalizationBudget);let Tt=gt.slice(Rt);ee?.recordSegment({type:"transparent-wrapper",wrapper:jn.wrapper,output:he(Tt)});let Nt=mo(Tt,N,{...yt,effectiveCwd:At,envAssignments:Ct});if(Nt)return Nt}return null}let mn=lt?void 0:xt==="eval"?Ts(gt):xt==="trap"&&!at?Lm(gt):void 0;if(at&&je&&xt==="eval"){if(mn?.kind==="dynamic")return fo(je,z.policy);if(mn?.kind==="literal"){let Rt=z.analyzeNested(mn.source,{effectiveCwd:At,envAssignments:Ct});if(Rt)return Rt}return po(je,z.policy)}if(mn?.kind==="dynamic"&&(z.strict||!z.commandView||!Jl(z.commandView)))return fn(ee);if(mn?.kind==="literal"){ee?.recordSegment({type:"recurse",reason:xt==="eval"?"shell-eval":"shell-trap",innerCommand:mn.source,depth:N+1});let Rt=z.analyzeNested(mn.source,{effectiveCwd:At,envAssignments:Ct,functionDefinitions:z.functionDefinitions});if(Rt)return Rt}if(at?Ht.has(xt):_p(bt,xt)){if(Xn(ht))return null;if(at&&je){let Rt=Ln(ht);if(Rt){if(je.dynamicSourceInput??je.dynamicInput){let Nt=fo(je,z.policy);if(Nt)return Nt}if(ai(Rt)){let Nt=fo(je,z.policy);if(Nt)return Nt}return z.analyzeNested(Rt,{effectiveCwd:At,envAssignments:Ct})}let Tt=Qn(gt);if(Tt.kind==="dynamic")return fo(je,z.policy);if(Tt.kind==="literal")return je.dynamicSourceInput?fo(je,z.policy):null;return je.dynamicSourceInput??je.dynamicInput?fo(je,z.policy):null}if(lt){let Rt=Ln(ht),Tt=Rt?z.analyzeNested(Rt,{effectiveCwd:At,envAssignments:Ct}):Qn(gt).kind==="dynamic"?fn(ee):null;if(Tt)return Tt}if(je===void 0){let Rt=f_(ht,Ct,At,z,ee,N);if(Rt)return Rt;let Tt=Ln(ht);if(Tt){let Br=Is(gt,Tt);if(Br.kind==="dynamic")return fn(ee);let Ys=Br.kind==="literal"?Br.source:Wm(gt,Tt),Mc=m_(Ys);ee?.recordSegment({type:"shell-wrapper",wrapper:xt,innerCommand:Mc}),ee?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Mc,depth:N+1});let Dc=z.analyzeNested(Ys,{effectiveCwd:At,envAssignments:Ct});if(Dc)return Dc;return ai(Ys)?fn(ee):null}let Nt=Qn(gt,z.strict?void 0:z.shellAssignments);if(Nt.kind==="dynamic")return fn(ee);if(Nt.kind==="literal")return Ws(Nt.source,At,Ct,z,ee,N);let Yt=Gm(gt,z.commandView?.redirections??[],z.hasPipelineInput??!1,z.literalShellInput);if(Yt.kind==="dynamic")return fn(ee);if(Yt.kind==="literal")return ee?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Yt.source,depth:N+1}),z.analyzeNested(Yt.source,{effectiveCwd:At,envAssignments:Ct})}}if(!je&&(xt==="source"||xt===".")){let Rt=ht[1]==="-p"?2:null;if(Rt!==null){let Br=z.commandView?gt[Rt]:void 0;if(!Br)return null;if(Br.provenance!=="literal")return fn(ee)}let Tt=Rt===null?1:3,Nt=ht[Tt]==="--"?Tt+1:Tt,Yt=z.commandView?gt[Nt]:void 0;if(!Yt)return null;if(Yt.provenance==="literal")return Ws(Yt.text,At,Ct,z,ee,N);if(z.strict||!z.commandView||!Jl(z.commandView))return fn(ee)}if(Rn.has(xt)&&!lt){if(!je&&z.strict&&ac(ni(ht),gt))return fn(ee);let Rt=qf(ht,(Nt)=>Lr(z.analyzeNested(Nt,{effectiveCwd:At,envAssignments:Ct}))),Tt=wt(Rt,z.policy);if(Tt)return ee?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:Tt.reason}),sn(Tt)}if(Tn(xt)&&!lt){if(!je&&z.strict&&ac(es(ht),gt))return fn(ee);let Rt=jd(ht);if(at&&je)return u_(xt,Rt,At,Ct,z,je);if(Rt){let Tt=Jt(z.policy,"interpreter.one-liner-paranoid",!!z.paranoidInterpreters);if(ee?.recordSegment({type:"interpreter",interpreter:xt,codeArg:Rt,paranoidBlocked:Tt}),Tt){let Yt=wt(vt("interpreter.one-liner-paranoid",$o),z.policy);if(Yt)return sn(Yt)}if(ul(xt,Rt))return null;ee?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:Rt,depth:N+1});let Nt=z.analyzeNested(Rt,{effectiveCwd:At,envAssignments:Ct});if(Nt&&!Rp(Nt,Rt))return Nt;if(Uo(Rt,void 0,!z.strict)){let Yt=wt(vt("interpreter.dangerous-command",eo),z.policy);if(Yt)return ee?.recordSegment({type:"dangerous-text",token:Rt,matched:!0,reason:eo}),sn(Yt)}ee=void 0}}if(xt==="busybox"&&ht.length>1)return vp(yt.wrapperNormalizationBudget),ee?.recordSegment({type:"busybox",subcommand:ht[1]??"unknown"}),ee?.recordSegment({type:"recurse",reason:"busybox",innerCommand:ht.slice(1).join(" "),depth:N+1}),mo(gt.slice(1),N,{...yt,effectiveCwd:At,envAssignments:Ct});let Wt=je?null:wt(Qf(xt,ht),z.policy);if(Wt)return ee?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:Wt.reason}),sn(Wt);let Ot=ee===yt.trace?yt:{...yt,trace:ee},nn={words:gt,head:xt,cwd:_t,originalCwd:Et,envAssignments:Ct,allowTmpdirVar:Dt,dynamicArguments:mt.words.some((Rt)=>Rt.provenance==="command-substitution"),depth:N,effectiveCwd:At,options:Ot,analyzeChildTokens:(Rt,Tt)=>at&&je?uc(Rt,N,Ot,{...je,cwd:Tt??void 0,effectiveCwd:Tt??void 0}):Lr(mo(Ut(Rt),N+1,{...Ot,child:void 0,commandView:void 0,effectiveCwd:Tt,envAssignments:Ct}))??_(Rt,Ot.policy.rules),analyzeChild:(Rt,Tt)=>uc(Rt,N,Ot,Tt)},Vt=je&&(xt==="xargs"||xt==="parallel")?void 0:xp(xt);if(xt==="rm"||xt==="xargs"||xt==="parallel")ee?.recordSegment({type:"tmpdir-check",tmpdirValue:Ct.has("TMPDIR")||z.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Dt});let Kt=ee&&xt==="git"?Pm(nn.words,lc(nn)):void 0,pn=Ep(Kt?Kt.match:Vt?.(nn)??null,z.policy);if(ee)p_(nn,pn,Kt?.relaxation??null);if(pn)return sn(pn);if(at&&je&&(xt==="rm"||xt==="rmdir")){if(!(xt==="rm"&&(Nn(ht)||je.dynamicRmInput)))return null;return(je.dynamicRmInput?po(je,z.policy):null)??d_(je,z.policy)}let yr=!je&&Vt===void 0&&!Pi.has(xt),bo=ee&&yr?[]:void 0;if(yr)for(let Rt=1;Rt<ht.length;Rt++){let Tt=ht[Rt];if(!Tt)continue;bo?.push(Tt);let Nt=Ep(c_(ht,Rt,N,Ot,_t,Et,At,Ct),z.policy);if(Nt)return ee?.recordSegment({type:"fallback-scan",tokensScanned:bo??[],embeddedCommandFound:It(Tt)}),sn(Nt)}if(ee?.recordSegment({type:"fallback-scan",tokensScanned:bo??[]}),lt&&je&&!je.wrappedByTransparent)return null;let En=_(ht,z.policy.rules);if(ee?.recordSegment({type:"custom-rules-check",rulesChecked:z.policy.rules.length>0,matched:!!En,reason:En?.reason}),En)return sn(En);return at&&je?po(je,z.policy):null}function uc(D,N,z,ee){return Lr(mo(Ut(D),N+1,{...z,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:ee.originalCwd,effectiveCwd:ee.effectiveCwd,envAssignments:ee.envAssignments,worktreeMode:ee.dynamicInput?!1:ee.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:ee}))}function c_(D,N,z,ee,te,he,je,at){for(let lt of Dn(D.slice(N),{environment:ee.environment,cwd:te,envAssignments:at,policy:ee.policy})){let ct=lt.tokens[0];if(!ct)continue;let dt=It(ct);if(_p(ct,dt)||xp(dt)!==void 0&&dt!=="xargs"&&dt!=="parallel"||lt.wrappedByTransparent&&ee.policy.rules.length>0)ee.budget.charge("derivedTokens",D.length-N);let ut=uc(lt.tokens,z,ee,{embedded:!0,cwd:lt.cwd,originalCwd:lt.wrapperCwd===null?void 0:he,effectiveCwd:lt.wrapperCwd===void 0?je:lt.wrapperCwd,envAssignments:lt.envAssignments,allowTmpdirVar:!Xo(lt.envAssignments,ee.environment),worktreeMode:!1,wrappedByTransparent:lt.wrappedByTransparent});if(ut)return ut}return null}function u_(D,N,z,ee,te,he){if(!N)return po(he,te.policy);if(Jt(te.policy,"interpreter.one-liner-paranoid",!!te.paranoidInterpreters)){let at=wt(vt("interpreter.one-liner-paranoid",$o),te.policy);if(at)return sn(at)}if(ul(D,N))return po(he,te.policy);let je=te.analyzeNested(N,{effectiveCwd:z,envAssignments:ee});if(je&&!Rp(je,N))return je;if(Uo(N,void 0,!te.strict)){let at=wt(vt("interpreter.dangerous-command",eo),te.policy);if(at)return sn(at)}return po(he,te.policy)}function Rp(D,N){let z=D.ruleId==="raw-text.dangerous-command",ee=(D.reason.startsWith(ys)||D.reason===io)&&!Ai(N);return z||ee}function fo(D,N){let z=D.shellDynamicMatch?wt(D.shellDynamicMatch,N):null;return z?sn(z):null}function po(D,N){let z=D.dynamicSourceInput&&D.dynamicSourceMatch?wt(D.dynamicSourceMatch,N):null;return z?sn(z):null}function d_(D,N){let z=D.dynamicInput&&D.rmDynamicMatch?wt(D.rmDynamicMatch,N):null;return z?sn(z):null}function f_(D,N,z,ee,te,he){let je=nm(D);if(je.argvSource?.kind==="absent")return fn(te);if(je.argvSourceApplies&&je.argvSource){let lt=Ws(je.argvSource.value,z,N,ee,te,he,!0);if(lt)return lt}if(!je.envSourceApplies||!je.envName)return null;let at=N.get(je.envName);if(!at)return null;return Ws(at,z,N,ee,te,he,!0)}function Ws(D,N,z,ee,te,he,je=!1){if(je&&/[$`*?[\]]/.test(D))return fn(te);let at=Bo(D,N,ee.environment.paths,ee.budget),lt=at?ee.literalHeredocFiles?.get(at):void 0;if(lt===void 0)return je?fn(te):null;return ee.budget.charge("derivedTokens",1),te?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:lt,depth:he+1}),ee.analyzeNested(lt,{effectiveCwd:N,envAssignments:z})}function m_(D){let N=D[0];return D.length>=2&&(N==='"'||N==="'")&&D.at(-1)===N?D.slice(1,-1):D}function p_(D,N,z){let ee={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[D.head];if(!ee)return;if(D.options.trace?.recordSegment({type:"rule-check",rule:ee,matched:!!N||!!z,reason:N?.reason??z?.originalReason}),z)D.options.trace?.recordSegment({type:z.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:z.originalReason,gitCwd:z.gitCwd})}function vp(D){if(D.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");D.iterations++}function sn(D){return{reason:D.reason,ruleId:D.id||void 0,intent:D.intent}}function fn(D){return D?.recordSegment({type:"error",message:ei}),sn(g_())}function g_(){return{id:"",reason:ei,intent:"stop_and_explain"}}function _p(D,N){return Ht.has(N)||D==="$SHELL"||D==="${SHELL}"||Ht.has(Pt(N))}function Ep(D,N){return D?.id.startsWith("custom.")||D?.id==="raw-text.dangerous-command"?D:wt(D,N)}var h_=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,y_=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function b_(D,N){let z=Ap(D,N);if(z.length===0)return!1;let ee=z[Pp(z)];if(ee==="cd"||ee==="pushd"||ee==="popd")return!0;return h_.test(D.join(" "))}function wp(D,N,z,ee,te){if(D.dialect==="powershell"){let bt=C_(D.words,te);if(bt.kind==="none")return;if(!N||bt.kind==="unknown")return null;return cc(x_(bt.target),N,z.paths)}let he=D.words.map(t),je=he.some((bt)=>/^CDPATH\+?=/.test(bt));if(!b_(he,z))return je?null:void 0;if(!N)return null;let at=Ap(he,z,N),lt=Pp(at);if(lt===-1||at[lt]!=="cd")return null;let ct=at.slice(lt+1),dt=ct.findIndex((bt)=>bt.length<=1||!bt.startsWith("-")||bt==="--");if((dt===-1?ct:ct.slice(0,dt)).some((bt)=>!/^-[LP]+$/.test(bt)))return null;let ut=dt===-1?[]:ct.slice(dt),mt=ut[0]==="--"?ut.slice(1):ut;if(mt.length>1)return null;let pt=mt[0],gt=ee.get("HOME")||z.home;if(pt===void 0)return cc(gt,N,z.paths);let ht=D.words.find((bt)=>bt.provenance==="variable"&&bt.text===pt),yt=D.words.find((bt)=>bt.text===pt&&/^~(?:\/|$)/.test(bt.raw)),Ct=ht?$n(ht,new Map([...ee,["HOME",gt]])):yt?`${gt}${pt.slice(1)}`:pt;if(Ct===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(Ct)&&(je||z.env.has("CDPATH")))return null;return cc(Ct,N,z.paths)}function cc(D,N,z){if(!D||D==="-"||D.startsWith("~")||D.includes("$")||D.includes("`"))return null;try{let ee=ir(N,D,z);return z.isDirectory(ee)?ee:null}catch{return null}}function C_(D,N){let z=S_(D[0])?1:0,ee=D[z];if(!v_(ee,z===1))return{kind:"none"};let te=ee.text.toLowerCase(),he=te.split(/[\\/]/).pop()??te;if(!y_.has(he))return{kind:"none"};if(te!==he||he==="pop-location"||he==="popd")return{kind:"unknown"};return E_(D.slice(z+1),N)}function S_(D){return D?.provenance==="literal"&&!D.quoted&&D.raw===D.text&&(D.text==="&"||D.text===".")}function v_(D,N){return D?.provenance==="literal"&&(N||!D.quoted&&D.raw===D.text)}function E_(D,N){let z;for(let ee of D){if(ee.provenance!=="literal"||z!==void 0)return{kind:"unknown"};z=ee.text}if(z!==void 0)return{kind:"target",target:z};return N===void 0?{kind:"unknown"}:{kind:"target",target:N}}function x_(D){return D.includes("::")?void 0:D.replaceAll("\\","/")}function Pp(D){let N=0;if(D[0]==="builtin"&&D.length>1)N=1;if(D[N]!=="time")return N;let z=N+1;while(D[z]?.startsWith("-"))z++;return z}function Ap(D,N,z){let ee=R_(D);return sr([...ee],N,z)}function R_(D){let N=0;while(N<D.length){let z=D[N];if(z!=="{"&&z!=="("&&z!=="$(")break;N++}return D.slice(N)}var k_="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Wr="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function hc(D,N,z,ee){if(N>=a.recursionDepth.cap)return z.trace?.recordSegment({type:"error",message:Fn}),{reason:Fn,segment:D,intent:"stop_and_explain"};let te=ee??z.factStore?.getCommandProgram(D,z.shell??"auto")??h(D,z.shell);if(te.status==="limited")return z.trace?.recordSegment({type:"error",message:Fn}),{reason:Fn,segment:D,intent:"stop_and_explain"};if(te.status==="invalid"){let ct=te.issues.find((dt)=>dt.code.includes("heredoc"));if(ct){if(!z.strict)return gc(D,z);let dt=`${ys}: ${ct.message}`;return z.trace?.recordGlobal({type:"error",message:dt}),{reason:dt,segment:D,intent:"stop_and_explain"}}return Dp(D,z),{reason:io,segment:D,intent:"stop_and_explain"}}if(z.strict&&te.status==="partial")return Dp(D,z),{reason:io,segment:D,intent:"stop_and_explain"};if(te.issues.some((ct)=>ct.code.includes("quote")))return gc(D,z);let je=z.cwd,at=z.effectiveCwd!==void 0?z.effectiveCwd:z.cwd,lt=gm(z.environment.env,z.envAssignments);return zs(te,N,{...z,rootProgram:te},je,[{effectiveCwd:at,shellGitContextState:lt,literalHeredocFiles:new Map(z.literalHeredocFiles),functionDefinitions:new Map(z.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function zs(D,N,z,ee,te){let he=[...te],je,at,lt;for(let[ct,dt]of D.nodes.entries()){if(dt.kind==="connector"){at=dt.operator;continue}let ft=D.nodes[ct+1],ut=ft?.kind==="connector"?ft.operator:void 0,mt=O_(D,ct,dt,at,ut),gt=at==="&&"||at==="||"?je:void 0,ht=at==="&&"?gt?.success??he:at==="||"?gt?.failure??he:he,yt=at==="||"?gt?.success??[]:[],Ct=at==="&&"?gt?.failure??[]:[],bt={connector:at,skippedSuccessStates:yt,skippedFailureStates:Ct};if(pr(ut)&&!pr(at))lt=bt;let xt=pr(ut)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:pr(at)?lt??bt:bt,_t=Gr(xt.connector)||Gr(ut);if(dt.kind==="function"){let Wt=ht.flatMap((nn)=>{let Vt=Fr(nn);return Vt.functionDefinitions.set(dt.name,dt.body),dc(nn,[Vt],mt,ut==="&",Gr(ut))}),Ot=fc(Wt,[],xt.skippedSuccessStates,xt.skippedFailureStates,xt.connector,ut);he=Ot.states,je=Ot.conditionalStates,at=void 0;continue}if(dt.kind==="group"){let Wt=[],Ot=[];for(let Vt of ht){let Kt=zs(dt.body,N,z,ee,[Fr(Vt)]);if(Kt.result)return Kt;if(Wt.push(...dc(Vt,Kt.states,mt,ut==="&",Gr(ut))),_t)Ot.push(Vt,...mt?Kt.states.map((pn)=>Gs(Vt,pn)):Kt.states)}let nn=fc(Wt,Ot,xt.skippedSuccessStates,xt.skippedFailureStates,xt.connector,ut);he=nn.states,je=nn.conditionalStates,at=void 0;continue}if(dt.kind!=="command")continue;let Et=tw(D.nodes[ct-1]),At=z.trace?.flattenNested?z.trace.currentSegmentIndex:z.trace?.allocateSegment(),Dt=D.nodes[ct-2],qt=pr(at)&&Dt?.kind==="command"?Nm(Dt)??D_(Dt):void 0,jn=[],mn=[];for(let Wt of ht){let Ot=N_(dt,N,z,ee,[Fr(Wt)]);if(Ot.result)return{result:Ot.result,states:he};let nn=D.dialect==="powershell"?Ot.states:Ot.states.map((Vt)=>Gs(Wt,Vt));for(let Vt of nn){let Kt=Fr(Vt),pn=G_(dt,N,z.trace?{...z,trace:Np(z.trace,At)}:z,ee,Kt,pr(at),qt);if(pn)return{result:pn,states:he};let yo=lw(dt,Kt.functionDefinitions);if(yo)z.budget.charge("derivedTokens",Bs(yo));let yr=yo?N+1>=a.recursionDepth.cap?mc(dt.displayText,z,[Kt]):zs(yo,N+1,z,ee,[Kt]):{result:null,states:sw(dt,Kt).flatMap((En)=>nw(dt,Vt,En,Et))};if(yr.result)return yr;jn.push(...dc(Wt,yr.states,mt,ut==="&",Gr(ut)));let bo=typeof Kt.effectiveCwd==="string"&&Kt.effectiveCwd!==Vt.effectiveCwd&&dt.redirections.every((En)=>["<",">",">>",">|"].includes(En.operator)&&En.target?.text==="/dev/null");if(_t&&(Et||!bo))mn.push(Wt),mn.push(...yr.states.map((En)=>mt?Gs(Wt,En):En))}}let hr=fc(jn,mn,xt.skippedSuccessStates,xt.skippedFailureStates,xt.connector,ut);he=hr.states,je=hr.conditionalStates,at=void 0}return{result:null,states:he}}function O_(D,N,z,ee,te){if(z.kind==="group"&&z.style==="subshell")return!0;if(D.dialect==="posix"&&(pr(ee)||pr(te)))return!0;if(te==="&")return!0;return D.dialect==="powershell"&&z.kind==="group"&&z.style==="brace"&&M_(D,N)}function dc(D,N,z,ee,te){let he=z?N.map((at)=>Gs(D,at)):[...N],je=te?he.flatMap((at)=>go(D.literalHeredocFiles,at.literalHeredocFiles)?[at]:[{...at,literalHeredocFiles:new Map(D.literalHeredocFiles)},at]):he;return ee?[D,...je]:je}function Gs(D,N){return{...D,literalHeredocFiles:new Map(N.literalHeredocFiles),createdDirectories:new Set(N.createdDirectories)}}function M_(D,N){let z=D.nodes.slice(0,N).reverse().find((te)=>te.kind==="command"||te.kind==="connector");if(!z||z.kind!=="command")return!0;let ee=z.words[0]?.text.toLowerCase();if(ee==="&"||ee===".")return!1;if(ee==="write-output"||ee==="function"||ee==="start-job")return!0;if(L_(z))return!0;return z.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function pr(D){return D==="|"||D==="|&"}function D_(D){if(D?.dialect!=="powershell")return;if(D.words.length===1&&D.words[0]?.quoted&&D.words[0].provenance==="literal")return D.words[0].text;if(D.words[0]?.text.toLowerCase()==="write-output"&&D.words.length===2&&D.words[1]?.provenance==="literal")return D.words[1].text;return}function Gr(D){return D==="&&"||D==="||"}function fc(D,N,z,ee,te,he){let je={success:Fs([...z,...D]),failure:Fs([...ee,...N])},at=Gr(he)?je:void 0;return{states:Gr(te)||at?Fs([...je.success,...je.failure]):je.success,conditionalStates:at}}function Np(D,N,z=D.flattenNested){return{currentSegmentIndex:N,flattenNested:z,allocateSegment:D.allocateSegment,getNextSegmentIndex:D.getNextSegmentIndex,recordGlobal:D.recordGlobal,recordSegment:(ee,te=N)=>D.recordSegment(ee,te)}}function N_(D,N,z,ee,te){let he=D.nested.map((je)=>({program:je,depth:N}));if(D.dialect==="powershell"){let je=W_(D);if(je){if(N+1>=a.recursionDepth.cap)return mc(je,z,te);let at=h(je,"powershell");if(at.status==="limited")return mc(je,z,te);if(at.status!=="complete")return Tp(he,z,ee,te);z.budget.charge("derivedTokens",Bs(at)),he.push({program:at,depth:N+1})}}return Tp(he,z,ee,te)}function L_(D){let N=D.words[0];return N?.provenance==="variable"&&D.words.at(-1)?.text==="="?N.text.toLowerCase():void 0}function Tp(D,N,z,ee){let te=[...ee];for(let he of D){let je=[];for(let at of te){let lt=zs(he.program,he.depth,N,z,[Fr(at)]);if(lt.result)return lt;je.push(...lt.states)}te=Fs(je)}return{result:null,states:te}}function W_(D){let N=D.words[0]?.provenance==="literal"&&!D.words[0].quoted&&D.words[0].raw===D.words[0].text&&(D.words[0].text==="&"||D.words[0].text==="."),z=N?1:0,ee=D.words[z];if(ee?.provenance!=="literal"||!N&&(ee.quoted||ee.raw!==ee.text)||!["iex","invoke-expression"].includes(ee.text.toLowerCase()))return;let te=D.words.slice(z+1),he=te[0]&&!te[0].quoted&&te[0].raw===te[0].text&&["-c","-command"].includes(te[0].text.toLowerCase())?1:0,je=te[he];return te.length===he+1&&je?.quoted&&je.provenance==="literal"?je.text:void 0}function Bs(D){return D.nodes.reduce((N,z)=>N+(z.kind==="command"?z.words.length+z.nested.reduce((ee,te)=>ee+Bs(te),0):z.kind==="group"||z.kind==="function"?Bs(z.body):0),0)}function mc(D,N,z){return N.trace?.recordSegment({type:"error",message:Fn}),{result:{reason:Fn,segment:D,intent:"stop_and_explain"},states:[...z]}}function G_(D,N,z,ee,te,he,je){let at={...z,environment:{...z.environment,env:te.shellGitContextState.env,paths:U_(z.environment.paths,te.createdDirectories,z.budget)}},lt=Y_(D,!at.strict);if(lt&&at.strict)return at.trace?.recordSegment({type:"error",message:lt}),{reason:lt,segment:D.source,intent:"stop_and_explain"};Lp(D,te,"before-consumer",at.environment.paths,at.budget);let ct=Q(D.dialect,D.words),dt=ct.map(t),ft=D.displayText,ut=mm(ct,te.shellGitContextState),mt=ym(ut,te.shellGitContextState);if(D.dialect==="powershell"){let ht=wt(zf(D,he,uw(at,te.effectiveCwd)),at.policy);if(at.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!ht,reason:ht?.reason}),ht)return cw(ft,ht)}if(dt.length===1&&dt[0]?.includes(" ")&&!Do(D.dialect,D.words)){let ht=wt(_n(dt[0]),at.policy),yt=ht!==null&&!at.strict&&Bd(D,at.rootProgram);if(ht&&!yt)return at.trace?.recordSegment({type:"dangerous-text",token:dt[0],matched:!0,reason:ht.reason}),{reason:ht.reason,segment:ft,ruleId:ht.id,intent:ht.intent};at.trace?.recordSegment({type:"dangerous-text",token:dt[0],matched:!1});let Ct=Ip(D,lt,te,mt,je,at);if(Ct)return Ct;return Vl(ut,te.shellGitContextState),null}let pt=mo(D.words,N,{...at,commandView:D,cwd:ee,effectiveCwd:te.effectiveCwd,envAssignments:mt,shellAssignments:te.shellGitContextState.shellAssignments,literalHeredocFiles:te.literalHeredocFiles,functionDefinitions:te.functionDefinitions,hasPipelineInput:he,literalShellInput:je,analyzeNested:(ht,yt)=>{let Ct=yt&&Object.hasOwn(yt,"effectiveCwd")?yt.effectiveCwd:te.effectiveCwd,bt=hc(ht,N+1,{...at,effectiveCwd:Ct,envAssignments:yt?.envAssignments??mt,literalHeredocFiles:te.literalHeredocFiles,functionDefinitions:yt?.functionDefinitions,worktreeMode:yt?.worktreeMode??at.worktreeMode,trace:at.trace?Np(at.trace,at.trace.currentSegmentIndex,!0):void 0});return bt?{reason:bt.reason,ruleId:bt.ruleId,intent:bt.intent}:null}});if(pt)return{...pt,segment:ft};let gt=Ip(D,lt,te,mt,je,at);if(gt)return gt;return Vl(ut,te.shellGitContextState),null}function Ip(D,N,z,ee,te,he){let je=Z_(D,N,z,ee??new Map,he);if(je)return je;return Lp(D,z,"after-consumer",he.environment.paths,he.budget),z.literalHeredocFiles.clear(),B_(D,N,z,he.environment.paths,he.budget),H_(D,z,he.environment.paths,he.budget),Q_(D,z,te,he.environment,he.trace),null}var F_=new Set([">>","<>"]);function Lp(D,N,z,ee,te){for(let je of D.redirections){if(!(z==="before-consumer"?z_(je):F_.has(je.operator)))continue;kp(je.target,N,ee,te)}if(z!=="before-consumer"||!tn(D.words[0],"tee"))return;let he=Gp(D.words.slice(1));if(!he)return;for(let je of he.operands)kp(je,N,ee,te)}function z_(D){if(D.operator===">"||D.operator===">|")return!0;return D.operator===">&"&&D.fd===void 0&&D.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(D.target.text)}function kp(D,N,z,ee){let te=D?.provenance==="literal"?Bo(D.text,N.effectiveCwd,z,ee):void 0;if(!te)return;N.literalHeredocFiles.delete(te)}function B_(D,N,z,ee,te){if(N)return;let he=D.redirections.find((je)=>je.operator==="<<"||je.operator==="<<-")?.heredoc;if(!he)return;for(let je of $_(D,z.shellGitContextState.shellAssignments)){let at=Bo(je,z.effectiveCwd,ee,te);if(!at||!Hd(at))continue;if(!z.literalHeredocFiles.has(at)&&z.literalHeredocFiles.size>=a.trackedHeredocFiles.cap)throw new s("trackedHeredocFiles");z.literalHeredocFiles.set(at,he.body)}}function $_(D,N){let z=pc(K_(D.redirections)?.target,N),ee=z===void 0?[]:[z];if(tn(D.words[0],"cat"))return V_(D.words)?ee:[];if(!tn(D.words[0],"tee"))return[];let te=Gp(D.words.slice(1),N);if(!te||te.append||te.hasUnsupportedOptions)return[];let he=te.operands.map((je)=>pc(je,N));if(!he.every((je)=>je!==void 0))return[];return[...he,...ee]}function pc(D,N){if(q_(D))return D.text;return(D&&$n(D,N))??void 0}function U_(D,N,z){if(N.size===0)return D;let ee=(te)=>{let he=Mt(te,D,z);return[...N].some((je)=>je===he||je.startsWith(`${he}${I_}`))};return{realpath:(te)=>D.realpath(te)??(ee(te)?Mt(te,D,z):null),entryKind:(te)=>{let he=D.entryKind(te);return he==="missing"&&ee(te)?"present":he},isDirectory:(te)=>D.isDirectory(te)||ee(te)}}function H_(D,N,z,ee){if(N.shellGitContextState.bodyDepth>0||!tn(D.words[0],"mkdir"))return;let te=D.words.slice(1).map((ct)=>pc(ct,N.shellGitContextState.shellAssignments));if(!te.every((ct)=>ct!==void 0))return;let he=te.findIndex((ct)=>ct==="--"||ct==="-"||!ct.startsWith("-")),je=te.slice(0,he);if(he===-1||!je.every((ct)=>/^(?:-[pv]+|--parents|--verbose)$/.test(ct)))return;let at=je.some((ct)=>ct==="--parents"||/^-v*p/.test(ct)),lt=N.effectiveCwd;for(let ct of te.slice(te[he]==="--"?he+1:he)){if(ct.split(/[\\/]/).includes("..")||!w_(ct)&&!lt)continue;let dt=Mt(T_(lt??"",ct),z,ee);if(at?j_(dt,z):z.isDirectory(__(dt))&&Wp(dt,z))N.createdDirectories.add(dt)}}function j_(D,N){let z=A_(D).root,ee=D.slice(z.length).split(/[\\/]+/).filter(Boolean),te=(je)=>P_(z,...ee.slice(0,je+1)),he=ee.findIndex((je,at)=>!N.isDirectory(te(at)));return he===-1||Wp(te(he),N)}function Wp(D,N){try{return N.entryKind(D)==="missing"}catch{return!1}}function V_(D){let N=!1;for(let z of D.slice(1)){if(N||z.provenance!=="literal")return!1;if(z.text==="--"){N=!0;continue}if(!/^-u+$/.test(z.text))return!1}return!0}function K_(D){let N=D.findLast((z)=>(z.fd??([">",">|",">>",">&"].includes(z.operator)?1:0))===1);return N?.operator===">"||N?.operator===">|"?N:void 0}function Gp(D,N=new Map){let z=[],ee=!0,te=!1,he=!1;for(let je of D){if(je.provenance!=="literal"&&$n(je,N)===null)return;if(ee&&tn(je,"--")){ee=!1;continue}if(ee&&!je.quoted&&je.raw===je.text&&/^-[^-]/.test(je.text)){te||=je.text.slice(1).includes("a"),he||=Array.from(je.text.slice(1)).some((at)=>at!=="a"&&at!=="i");continue}if(ee&&!je.quoted&&je.raw===je.text&&je.text.startsWith("--")){te||=je.text==="--append",he||=je.text!=="--append"&&je.text!=="--ignore-interrupts";continue}z.push(je)}return{operands:z,append:te,hasUnsupportedOptions:he}}function q_(D){if(!D||D.provenance!=="literal"||D.text.length===0)return!1;if(D.quoted||D.raw!==D.text)return!0;return!D.raw.startsWith("~")&&!/[{}]/.test(D.raw)}function tn(D,N){return D?.text===N&&D.raw===N&&D.provenance==="literal"&&!D.quoted}function yc(D){return D.quotedDelimiter||!/[$`\\]/.test(D.body)}function Y_(D,N){let z=D.redirections.filter((lt)=>lt.operator==="<<"||lt.operator==="<<-");if(z.length===0)return;if(z.length!==1)return Wr;let ee=z[0];if(!ee?.heredoc)return Wr;let te=/\$\(|`/.test(ee.heredoc.body);if(!yc(ee.heredoc)&&(!N||te))return k_;if(ee.fd!==void 0&&ee.fd!==0)return Wr;if(D.redirections.some((lt)=>lt!==ee&&["<","<<","<<-","<<<","<&","<>"].includes(lt.operator)))return Wr;let he=D.redirections.some((lt)=>lt!==ee&&Op(lt.target));if(tn(D.words[0],"cat"))return he?Wr:void 0;if(tn(D.words[0],"tee"))return he||D.words.slice(1).some(Op)?Wr:void 0;let je=D.words[0],at=D.words[1];if(tn(je,"git")&&(tn(at,"apply")||tn(at,"commit")))return;if(tn(je,"gh")&&(tn(at,"pr")||tn(at,"issue"))&&tn(D.words[2],"create"))return;return Wr}function Op(D){return D?.parts.some((N)=>N.provenance==="command-substitution"&&N.raw.startsWith(">("))??!1}function Z_(D,N,z,ee,te){if(!N)return null;let he=D.redirections.filter((ct)=>ct.operator==="<<"||ct.operator==="<<-"),je=he.flatMap((ct)=>ct.heredoc?[ct.heredoc.body]:[]);if(J_(D,he,z,ee,te))return null;let at=X_(D,he,te);if(at!==void 0)return at?{reason:at.reason,segment:D.displayText,ruleId:at.id,intent:at.intent}:null;let lt=gc(je.length===he.length?je.join(`
+`):D.source,te);return lt?{...lt,segment:D.displayText}:null}function X_(D,N,z){let ee=N.length===1?N[0]:void 0;if(!ee?.heredoc||!yc(ee.heredoc)||ee.fd!==void 0&&ee.fd!==0)return;let te=tn(D.words[0],"uv")&&tn(D.words[1],"run")?D.words.slice(2):D.words,he=te[0];if(he?.provenance!=="literal"||!Tn(he.text))return;let je=te.findIndex((ft)=>tn(ft,"-"));if(!te.slice(1,je===-1?void 0:je).every((ft)=>ft.provenance==="literal"&&ft.text.startsWith("-")))return;let lt=ee.heredoc.body,ct=Jt(z.policy,"interpreter.one-liner-paranoid",!!z.paranoidInterpreters);if(z.trace?.recordSegment({type:"interpreter",interpreter:he.text,codeArg:lt,paranoidBlocked:ct}),ct){let ft=wt(vt("interpreter.one-liner-paranoid",$o),z.policy);if(ft)return ft}if(!Uo(lt,void 0,!z.strict))return null;let dt=wt(vt("interpreter.dangerous-command",eo),z.policy);if(!dt)return null;return z.trace?.recordSegment({type:"dangerous-text",token:lt,matched:!0,reason:dt.reason}),dt}function J_(D,N,z,ee,te){let he=N.length===1?N[0]:void 0;if(!he?.heredoc||!yc(he.heredoc)||he.fd!==void 0&&he.fd!==0)return!1;let je=wr(D.words,te.environment,z.effectiveCwd,ee),at=je.words.map(t),lt=It(at[0]??"");if((je.envSplitValues?.length??0)>0||!Ht.has(lt)&&!Ht.has(Pt(lt)))return!1;return Xn(at)}function Q_(D,N,z,ee,te){let he=wp(D,N.effectiveCwd,ee,N.shellGitContextState.shellAssignments,z);if(he===null)te?.recordSegment({type:"cwd-change",segment:D.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(he!==void 0)N.effectiveCwd=he}var ew=new Set(["fi","done","esac"]);function tw(D){return D?.kind==="command"&&D.words.length===1&&D.words[0]?.raw==="!"}function nw(D,N,z,ee){let te=D.words[0]?.text??"",he=N.shellGitContextState.bodyDepth,je=z.shellGitContextState.bodyDepth,at=z.compoundBodies;if(je>he)return z.compoundBodies=[...at.slice(0,he),{entryCwd:N.effectiveCwd,branchCwds:at[he]?.branchCwds??[],hasElse:!1}],[z];let lt=he>0?at[he-1]:void 0;if(lt&&(te==="else"||te==="elif"))return z.compoundBodies=[...at.slice(0,he-1),{entryCwd:lt.entryCwd,branchCwds:[...lt.branchCwds,z.effectiveCwd],hasElse:te==="else"}],z.effectiveCwd=lt.entryCwd,[z];let ct=lt!==void 0&&ew.has(te);if(ct)z.compoundBodies=at.slice(0,je);return[...new Set([z.effectiveCwd,...ct?lt.branchCwds:[],...ct&&!lt.hasElse?[lt.entryCwd]:[],...ee?[N.effectiveCwd]:[]])].map((ft)=>{if(ft===z.effectiveCwd)return z;let ut=Fr(z);return ut.effectiveCwd=ft,ut})}function rw(D,N){return D.length===N.length&&D.every((z,ee)=>{let te=N[ee];return te!==void 0&&z.entryCwd===te.entryCwd&&z.hasElse===te.hasElse&&z.branchCwds.length===te.branchCwds.length&&z.branchCwds.every((he,je)=>he===te.branchCwds[je])})}var ow=/^[A-Za-z_][A-Za-z0-9_]*$/,iw=8;function sw(D,N){let z=D.words[1]?.text;if(D.dialect!=="posix"||D.words[0]?.text!=="for"||z===void 0||!ow.test(z))return[N];let ee=D.words.slice(3);if(!(D.words[2]?.text==="in"&&ee.length>=1&&ee.length<=iw&&ee.every((he)=>he.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(he.text))))return N.shellGitContextState.shellAssignments.delete(z),[N];return ee.map((he)=>{let je=Fr(N);return je.shellGitContextState.shellAssignments.set(z,he.text),je})}function Fr(D){return{effectiveCwd:D.effectiveCwd,shellGitContextState:hm(D.shellGitContextState),literalHeredocFiles:new Map(D.literalHeredocFiles),functionDefinitions:new Map(D.functionDefinitions),createdDirectories:new Set(D.createdDirectories),compoundBodies:D.compoundBodies}}function Fs(D){let N=[];for(let z of D){if(!N.some((ee)=>aw(ee,z)))N.push(z);if(N.length>a.controlFlowStates.cap)throw new s("controlFlowStates")}return N}function aw(D,N){return D.effectiveCwd===N.effectiveCwd&&rw(D.compoundBodies,N.compoundBodies)&&go(D.shellGitContextState.env,N.shellGitContextState.env)&&go(D.literalHeredocFiles,N.literalHeredocFiles)&&go(D.functionDefinitions,N.functionDefinitions)&&go(D.shellGitContextState.effectiveEnvAssignments,N.shellGitContextState.effectiveEnvAssignments)&&go(D.shellGitContextState.shellAssignments,N.shellGitContextState.shellAssignments)&&D.shellGitContextState.bodyDepth===N.shellGitContextState.bodyDepth&&Mp(D.shellGitContextState.bodyAssignments,N.shellGitContextState.bodyAssignments)&&Mp(D.createdDirectories,N.createdDirectories)}function Mp(D,N){return D.size===N.size&&[...D].every((z)=>N.has(z))}function go(D,N){if(D===N)return!0;if(!D||!N||D.size!==N.size)return!1;return[...D].every(([z,ee])=>N.get(z)===ee&&N.has(z))}function lw(D,N){let z=No(D);return z===void 0?void 0:N.get(z)}function cw(D,N){if(!N)return null;return{reason:N.reason,segment:D,ruleId:N.id,intent:N.intent}}function uw(D,N=D.effectiveCwd){let z=N===null;return{environment:D.environment,cwd:z?void 0:N??D.cwd,originalCwd:z?void 0:D.cwd,strict:D.strict,paranoid:D.paranoidRm,allowTmpdirVar:D.allowTmpdirVar,protectedGitMetadata:D.protectedGitMetadata,policy:D.policy,budget:D.budget}}function gc(D,N){let z=wt(_n(D),N.policy),ee=N.trace?.currentSegmentIndex??N.trace?.allocateSegment(),te={type:"dangerous-text",token:D,matched:!!z,reason:z?.reason};if(N.trace?.recordSegment(te,ee),!z&&/^(?:cd|pushd)\s/.test(D))N.trace?.recordSegment({type:"cwd-change",segment:D,effectiveCwdNowUnknown:!0},ee);return z?{reason:z.reason,segment:D,ruleId:z.id,intent:z.intent}:null}function Dp(D,N){let z={type:"strict-unparseable",rawCommand:D,reason:io},ee=N.trace?.currentSegmentIndex;if(ee===void 0)N.trace?.recordGlobal(z);if(ee!==void 0)N.trace?.recordSegment(z)}var dw=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Fp(D,N,z,ee){let te=hc(D,0,{...N,...Fe(N),budget:N.budget??gn(),factStore:ee},z);if(!te)return null;return{kind:"deny",reason:te.reason,intent:te.intent??"manual_only",...te.ruleId?{ruleId:te.ruleId}:{},evidence:{command:D,segment:te.segment}}}function zp(D,N,z){try{return{decision:D()}}catch(ee){let te=fw(ee,N,z);if(!te)throw ee;return te}}function fw(D,N,z){if(!(D instanceof s)||!dw.has(D.kind))return null;let ee=a[D.kind];if(z?.currentSegmentIndex!==void 0)z.recordSegment({type:"error",message:ee.reason});if(z?.currentSegmentIndex===void 0)z?.recordGlobal({type:"error",message:ee.reason});return{decision:{kind:"deny",reason:ee.reason,intent:"stop_and_explain",evidence:{command:N,segment:N}},errorCode:ee.errorCode}}var mw=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Cc=new Set(["cc-safety-net","ccsn"]),pw=new Set(["bunx","npx","pnpx"]),gw=new Set(["pnpm","yarn"]),hw=new Set(["npm","pnpm","yarn"]),yw=new Set(["bun","node"]);function Us(D,N,z={}){if(Cc.has(D))return 0;if(pw.has(D)){if(z.broad)return bc(N);let te=N[0]==="-y"||N[0]==="--yes"?1:0;return $s(N[te])?te+1:null}let ee=z.broad?N.findIndex((te)=>!te.startsWith("-")):0;if(ee!==-1&&hw.has(D)&&z.broad&&N[ee]==="exec"){let te=bc(N.slice(ee+1));return te===null?null:ee+1+te}if(gw.has(D)){if(D==="yarn"&&!z.broad)return null;if(!z.broad)return N[0]==="dlx"&&$s(N[1])?2:null;if(ee===-1||N[ee]!=="dlx")return null;let te=bc(N.slice(ee+1));return te===null?null:ee+1+te}if(yw.has(D)){let te=z.broad&&ee!==-1?ee:0;if(Bp(N[te]))return te+1;if(D==="bun"&&N[te]==="run"&&Bp(N[te+1]))return te+2}return null}function bc(D){let N=D.findIndex((ee)=>$s(ee));if(N===-1)return null;let z=N;while(z<D.length){let ee=D[z]??"";if(!ee.startsWith("-")&&!$s(ee))break;z++}return z}function $s(D){if(!D)return!1;let N=D.indexOf("@");if(N===-1)return Cc.has(D);if(N===0)return!1;let z=D.slice(N+1);if(z===""||z.includes("/")||z.includes(":"))return!1;return Cc.has(D.slice(0,N))}function Bp(D){let N=D?.replaceAll("\\","/");return[...mw].some((z)=>N===z||N?.endsWith(`/${z}`))}var Me="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function $p(D,N,z){let ee=un(D,"input-candidate");if(!ee)return null;let te=no(ee.shell,D.invocation.context.executionCwd,N,z,{findSegmentTarget:(he)=>bw(he,N),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return te?{target:te}:null}function bw(D,N){let z=sr([...D],N),ee=z.slice(1),te=Us(Pt(z[0]??"").toLowerCase(),ee,{broad:!0});if(te===null)return null;let he=ee.slice(te).filter((je)=>je!=="-g"&&je!=="--global");return he[0]==="policy"&&he[1]==="apply"?z.join(" "):null}import{dirname as Hs}from"node:path";var $e="This path contains the protected policy config and you must not modify or delete it.",Cw=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Vp(D,N,z){let ee=_w(D.invocation.context,N,z);if(D.invocation.route.kind==="patch")return Up(D.paths,!1,D.invocation.context.executionCwd,ee,N,z);let te=un(D,"input-candidate");if(D.invocation.route.kind==="command")return te?Hp(te.shell,D.invocation.context.executionCwd,ee,N,z):null;if(D.invocation.route.kind==="unknown"&&te){let he=Hp(te.shell,D.invocation.context.executionCwd,ee,N,z);if(he)return he}return Up(D.paths,D.invocation.route.kind==="grep"||D.invocation.route.kind==="glob"||Ci(D.invocation.toolName),D.invocation.context.executionCwd,ee,N,z)}function Up(D,N,z,ee,te,he){if(N)return null;let je=D.find((at)=>ui(at,z,ee,te,he));return je?{target:je}:null}function Hp(D,N,z,ee,te){let he=no(D,N,ee,te,{findSegmentTarget:(je,at)=>Sw(je,at,z,ee,te)?.target??null,isRedirectionTarget:(je,at)=>ui(je,at.cwd,z,ee,te),findMalformedTarget:(je)=>Rw(je,N,z,ee,te)?.target??null});return he?{target:he}:null}function Sw(D,N,z,ee,te){if(qo(D))return null;let he=ar([...D],ee),je=Pt(he[0]??"").toLowerCase(),at=he.slice(1);if(je==="rm"&&vw(at)){let lt=Ew(at).find((ct)=>jp(cn(ct,N.variables),N.cwd,z,ee,te));if(lt)return{target:lt}}if(je==="find"){if(xs(he,1)||Wl(he,ee)){let ct=(ri(Ut(he))??Ut(["."])).find((dt)=>{let ft=cn(dt.text,N.variables);return ui(ft,N.cwd,z,ee,te)||jp(ft,N.cwd,z,ee,te)})?.text;if(ct)return{target:ct}}}if(je==="mv"){let lt=us(at).sources.find((ct)=>ww(cn(ct,N.variables),N.cwd,z,ee,te));if(lt)return{target:lt}}if(xw(he,je))return null;for(let lt of[...D,...he])for(let ct of Kp(lt))if(ui(cn(ct,N.variables),N.cwd,z,ee,te))return{target:ct};return null}function vw(D){return D.some((N)=>N==="--recursive"||N.startsWith("-")&&!N.startsWith("--")&&/[rR]/.test(N.slice(1)))}function Ew(D){let N=D.indexOf("--");if(N!==-1)return[...D.slice(0,N).filter((z)=>!z.startsWith("-")),...D.slice(N+1)];return D.filter((z)=>!z.startsWith("-"))}function xw(D,N){if(!Cw.has(N))return!1;if(N!=="sed")return!0;return!D.slice(1).some((z)=>z.startsWith("-i")||z==="--in-place"||z.startsWith("--in-place="))}function Rw(D,N,z,ee,te){for(let he of D.split(/\s+/))for(let je of Kp(he))if(ui(je,N,z,ee,te))return{target:je};return null}function Kp(D){let N=D.trim().replace(/^['"]|['"]$/g,""),z=N.indexOf("=");return z===-1||z===N.length-1?[N]:[N,N.slice(z+1)]}function _w(D,N,z){let ee=(at)=>di(rn(at,D.executionCwd,N,z)),te=ee(u(N)),he=[ee(b(D.executionCwd)),ee(b(D.configCwd))],je=new Set(he.map((at)=>Hs(at)));for(let at=Hs(te);;at=Hs(at))if(je.add(at),Hs(at)===at)break;return{files:new Set([te,...he]),directoriesAndAncestors:je}}function ui(D,N,z,ee,te){let he=zc(D,N,ee,te,(je)=>di(je)===_i);return he!==null&&z.files.has(di(he))}function jp(D,N,z,ee,te){return z.directoriesAndAncestors.has(di(rn(D,N,ee,te)))}function ww(D,N,z,ee,te){let he=di(rn(D,N,ee,te));return z.files.has(he)||z.directoriesAndAncestors.has(he)}function di(D){return process.platform==="win32"?D.toLowerCase():D}import{isAbsolute as js,posix as ig,resolve as Ks,win32 as Pw}from"node:path";import{fileURLToPath as Aw}from"node:url";var sg="Access to a sensitive path is not allowed.",ag=new Set(["echo","printf"]),Tw=new Set(["find"]),Iw=new Set(["!","do","elif","else","if","then","until","while"]),kw=new Set(["-exec","-execdir"]),Ow=new Set([";","+"]),Mw=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),Dw=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),lg=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),Nw=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),Lw=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),cg=new Set(["-c","-e","-r","-E","--eval","--exec"]),Ww=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),Gw=new Set(["grep","rg"]),Fw=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),zw=new Set(["commit","merge","notes","stash","tag"]),Bw=new Set(["-m","--message"]),$w=new Set(["--grep"]),qp=new Set(["jq","gojq","jaq"]),Yp="f",Zp="file",Uw="files",Hw=new Set(["e","f"]),jw=new Set(["regexp","file"]),Vw=new Set(["e","f","A","B","C","m"]),Kw=new Set(["regexp","file","after-context","before-context","context","max-count"]),Sc="__CC_SAFETY_NET_PIPE_INPUT__",Ec=/[\w./~@+-]*[./~][\w./~@+-]*/g,qw=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,Yw=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,Zw=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Xp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Jp=/\b(?:system|exec|spawn|popen)\s*$/,Xw=/\b(?:eval|exec)\s*\(/g,Jw=/\b(?:eval|exec)\s*$/,Qw=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Qp(D,N,z,ee,te,he){for(let je of D){let at=je.target;if(ZP(at,je.cwd,N?.denyPaths??[],z,ee,te))return{target:at,ruleId:"secret.deny-path"};if(he&&!he.has(at))continue;let lt=qP(at,je.cwd,N,ee,te);if(lt){let ct=he!==void 0&&!lt.startsWith("secret.home.")&&!lt.startsWith("secret.cli.");if(ct&&ee.paths.isDirectory(hg(at,je.cwd,ee,te)))continue;if(ct&&je.isRedirectionWriteTarget===!0&&!at.includes("$")&&!Rc(at,je.cwd,ee,te))continue;if(ct&&/\s/.test(at)&&!at.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(at)&&!Rc(at,je.cwd,ee,te))continue;if(!lt.startsWith("secret.cli.")&&XP(at,je.cwd,N?.allowPaths??[],z,ee,te))continue;return{target:at,ruleId:lt}}}return null}function ug(D,N,z,ee,te={}){let he=eg(D,z,ee),je=Qp(he,N,D.invocation.context.configCwd,z,ee);if(je===null||je.ruleId==="secret.deny-path"||te.strict!==!1)return je;let at=Qp(he,N,D.invocation.context.configCwd,z,ee,new Set(eg(D,z,ee,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((lt)=>lt.target)));return at?.ruleId!=="secret.deny-path"&&eP(D,z)?null:at}function eP(D,N){let z=un(D,"input-candidate")??un(D,"declared-command");if(!z)return!1;if(z.program.nodes.some((je)=>je.kind==="command"&&je.nested.length>0))return!1;let ee=[];for(let je of cs(z.shell)){if(je.kind==="operator"&&je.boundary)return!1;if(je.kind==="redirection")return!1;if(je.kind==="operator")continue;ee.push(Zn(je.text,N))}let te=tr(ee);if(te.length===0)return!1;let he=Gn(te[0]??"").toLowerCase();if(D.invocation.route.kind==="unknown")return z.program.dialect==="powershell"&&(he==="ls"||he==="stat");return _c(he,te.slice(1))}function _c(D,N){if(D==="ls"||D==="stat")return!0;if(D==="test")return N.length===2&&(N[0]==="-e"||N[0]==="-f");if(D==="[")return N.length===3&&(N[0]==="-e"||N[0]==="-f")&&N[2]==="]";if(D==="git")return N[0]==="check-ignore";if(D!=="find")return!1;return!N.some((z)=>Mw.has(z))}function eg(D,N,z,ee={}){let te=D.invocation.context.executionCwd,he=D.invocation.route.kind;if(he!=="command"&&he!=="unknown")return D.paths.map((at)=>({target:at,cwd:te}));let je=un(D,"input-candidate");return[...je?ho(je.shell,D.store,ee,N,te,z,tP(je)):[],...he==="unknown"?D.paths.map((at)=>({target:at,cwd:te})):[]]}function tP(D){return D.program.dialect==="powershell"}function ho(D,N,z,ee,te,he,je=!1){if(D.status==="structural-limit")throw new y;if(D.status==="unclosed-quote")return[];if(D.status==="invalid")throw Error("Unable to parse command for secret protection");let at=[...D.assignmentFallbacks.map((ct)=>({target:ct,cwd:te})),...kP(Zn(D.source,ee),N,z,ee,te,he)],lt=(ct)=>Zn(fP(ct,je),ee);return ls(D,te,ee,he,{word:lt,segment:(ct,dt,ft,ut,mt)=>{if(ct.length===0)return null;if(at.push(...qs(ct,N,z,ee,dt.cwd,he,mt)),ft!==null)at.push(...rP(ft,ct,N,z,ee,dt.cwd,he));return null},redirection:(ct,dt)=>{if(ct.body!==void 0&&ct.consumer!==void 0)at.push(...dg(ct.consumer,[ct.body],N,z,ee,dt.cwd,he,(ft)=>oP(ct.consumer??[],ft,N,z,ee,dt.cwd,he)));if(ct.targetOrder==="legacy-segment")return Cl;return at.push({target:lt(ct.target),cwd:dt.cwd,...ct.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),at}function wc(D,N,z,ee,te,he){let je=N.getShellSyntax(D);if(je.status==="structural-limit")throw new y;return je.status==="complete"?ho(je,N,z,ee,te,he):null}function qs(D,N,z,ee,te,he,je){let at=(gt)=>({target:gt,cwd:te});if(je?.size){let gt=D.filter((ht,yt)=>!je.has(yt));if(qp.has(Gn(tr(gt)[0]??"").toLowerCase()))return[...D.filter((ht,yt)=>je.has(yt)).map(at),...qs(gt,N,z,ee,te,he)]}let lt=dP(D).map(at),ct=tr(D);if(ct.length===0)return lt;let dt=ct[0]??"",ft=Gn(dt).toLowerCase(),ut=ct.slice(1),mt=ct.findIndex((gt)=>!Iw.has(gt));if(z.skipMetadataOnlySegments===!0&&mt!==-1&&_c(Gn(ct[mt]??"").toLowerCase(),ct.slice(mt+1)))return lt;let pt=nP(dt,ft,ut);if(pt)return[...lt,...pt.map(at)];if(ag.has(ft))return z.displayOperandsAreCapturedOutput===!0?[...lt,...fg(D).map(at)]:lt;if(ft==="eval")return[...lt,...wc(ut.join(" "),N,z,ee,te,he)??ut.map(at)];if(ft==="export")return[...lt,...ut.flatMap((gt)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(gt)?[gt.slice(gt.indexOf("=")+1)]:Hn(ft,gt)).map(at)];if(ft==="git")return[...lt,...pP(ut).map(at)];if(ft==="gh")return[...lt,...xc(ft,ut,Fw).map(at)];if(qp.has(ft))return[...lt,...mP(ut).map(at)];if(Gw.has(ft))return[...lt,...FP(ut).map(at)];if(Tw.has(ft))return[...lt,...bP(ut,N,z,ee,te,he).map(at)];if(Rn.has(ft))return[...lt,...ut.flatMap((gt)=>Hn("awk",gt)).map(at),...ut.flatMap((gt)=>SP(gt,N,z,ee,te,he)),...ut.flatMap(vP).map(at)];if(ft==="curl")return[...lt,...ut.flatMap((gt)=>Hn(ft,gt)).map(at),...gP(ut).map(at)];if(Yo(ft)){let gt=Ko.has(ft)?bn([ft,...ut]):null;if(gt!==null&&gt.command!==null&&gt.commandIndex!==null){let ht=N.getShellSyntax(gt.command);if(ht.status==="structural-limit")throw new y;if(ht.status==="complete")return[...lt,...ho(ht,N,z,ee,te,he),...ut.slice(gt.commandIndex).filter((yt)=>!yt.startsWith("-")).map(at)]}return[...lt,...CP(ft,ut,N,z,ee,te,he)]}return[...lt,...ut.flatMap((gt)=>Hn(ft,gt)).map(at)]}function nP(D,N,z){let ee=Us(N,z);if(ee===null||z[ee]!=="explain")return null;let te=[D,...z.slice(0,ee)],he=z.slice(ee+1);for(let je=0;je<he.length;je++){let at=he[je];if(at==="--json"||at==="--help"||at==="-h")continue;if(at==="--cwd"){let lt=he[je+1];if(lt&&!lt.startsWith("--"))te.push(lt);je++;continue}return te}return te}function rP(D,N,z,ee,te,he,je){if(lP(N,z,ee,te,he,je)){let at=tr(D),lt=_c(Gn(at[0]??"").toLowerCase(),at.slice(1))?at.slice(1).filter((ct)=>!ct.startsWith("-")):[];return[...fg(D),...lt].map((ct)=>({target:ct,cwd:he}))}return dg(N,iP(D),z,ee,te,he,je,()=>[])}function oP(D,N,z,ee,te,he,je){let at=tr(D);if(!Yo(Gn(at[0]??"").toLowerCase()))return[];return wc(N,z,ee,te,he,je)??[{target:N,cwd:he}]}function dg(D,N,z,ee,te,he,je,at){let lt=cP(D);if(lt===null)return N.flatMap(at);return N.flatMap((ct)=>Ko.has(lt)?ho(z.getShellSyntax(ct),z,ee,te,he,je):Vs(lt,ct,z,ee,te,he,je))}function fg(D){let N=tr(D);if(N.length===0)return[];let z=Gn(N[0]??"").toLowerCase();if(!ag.has(z))return[];let ee=N[N[1]==="--"?2:1];if(z==="printf"&&ee!==void 0&&!ee.startsWith("-")&&!ee.replaceAll("%%","").includes("%"))return[Pc(ee.replaceAll("%%","%"))];return N.slice(1)}function iP(D){let N=tr(D);if(N.length===0)return[];let z=Gn(N[0]??"").toLowerCase(),ee=N.slice(1);if(z==="echo"){let te=ee.findIndex((he)=>!/^-[neE]+$/.test(he));return[(te===-1?[]:ee.slice(te)).join(" ")]}if(z==="printf")return sP(ee);return[]}function sP(D){let N=D[0];if(N===void 0)return[];let z=(N.match(/%%|%[bqs]/g)??[]).filter((te)=>te!=="%%").length;if(z===0||D.length===1)return[Pc(N)];let ee=D.slice(1);return Array.from({length:Math.ceil(ee.length/z)},(te,he)=>aP(N,ee.slice(he*z,(he+1)*z)))}function aP(D,N){let z=0;return Pc(D.replace(/%%|%[bqs]/g,(ee)=>{if(ee==="%%")return"%";let te=N[z]??"";return z++,te}))}function Pc(D){return D.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function lP(D,N,z,ee,te,he){let je=tr(D);if(je.length===0||Gn(je[0]??"").toLowerCase()!=="xargs")return!1;let at=Nr(je),lt=je.slice(at.childStart);if(lt.length===0)return!1;if(at.replacementToken==="")return!1;let ct=at.replacementToken,dt=ct===null?[...lt,Sc]:lt.map((ft)=>ft.split(ct).join(Sc));return qs(dt,N,z,ee,te,he).some((ft)=>ft.target.includes(Sc))}function cP(D){let N=tr(D);if(N.length===0)return null;let z=Gn(N[0]??"").toLowerCase();if(!Yo(z))return null;return uP(z,N.slice(1))?z:null}function uP(D,N){let z=Ac(D);for(let ee=0;ee<N.length;ee++){let te=N[ee];if(te===void 0)break;if(cg.has(te)||mg(D,te)||/^--(?:eval|exec)=/.test(te))return!1;if(te==="-")return!0;if(te.startsWith("-")){if(z==="python"&&te==="-m")return!1;if(Qw.get(z)?.has(te))ee++;continue}return!1}return!0}function Ac(D){return/^python\d/.test(D)?"python":D}function dP(D){let N=[];for(let z of D){if(gg(z))continue;let ee=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(z);if(ee===null)break;if(ee[1]!==void 0&&ee[1]!=="")N.push(ee[1])}return N}var tg=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function fP(D,N){if(!N||!tg.test(D))return D;return`~${D.replace(tg,"").replace(/\\/g,"/")}`}function Hn(D,N){if(N==="--")return[];let z=[],ee=N.indexOf("=");if(ee>0&&ee<N.length-1)z.push(N.slice(ee+1));if(N.startsWith("-"))return z;if(D==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(N))return z;if(D==="zip"&&/\.zip$/i.test(N))return z;return z.push(N),z}function mP(D){let N=-1,z=!1;for(let ee=0;ee<D.length;ee++){let te=D[ee]??"";if(!z&&te==="--"){z=!0;continue}if(z||!/^-(?:[A-Za-z]|-)/.test(te)){if(N===-1)N=ee;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(te)){ee+=2;continue}if(te==="--indent"||te==="-L"){ee++;continue}if(te.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(te)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(te))continue;return D.flatMap((he)=>Hn("jq",he))}return D.flatMap((ee,te)=>te===N?[]:Hn("jq",ee))}function pP(D){let N=[];for(let z=0;z<D.length;z++){let ee=D[z]??"";if(ee==="--"||!ee.startsWith("-"))return[...N,...zw.has(ee)?xc("git",D.slice(z).map((he)=>/^-[aeinopqsv]+m$/.test(he)?"-m":he),Bw):xc("git",D.slice(z),$w)];if(N.push(...Hn("git",ee)),!yn.has(ee))continue;let te=D[z+1];if(te===void 0)break;N.push(...ee==="-c"&&te.includes("=")?[te.slice(te.indexOf("=")+1)]:Hn("git",te)),z++}return N}function xc(D,N,z){let ee=[];for(let te=0;te<N.length;te++){let he=N[te]??"";if(he==="--")return[...ee,...N.slice(te).flatMap((je)=>Hn(D,je))];if(z.has(he)){te++;continue}if(he.includes("=")&&z.has(he.slice(0,he.indexOf("="))))continue;ee.push(...Hn(D,he))}return ee}function gP(D){return D.flatMap((N,z)=>{let ee=yP(N);if(ee!==null)return ng(ee.flag,ee.value);let te=hP(D[z-1]);return te===null?[]:ng(te,N)})}function ng(D,N){if(D==="-F"||D==="--form"){let z=N.indexOf("="),ee=z===-1?N:N.slice(z+1);if(!ee.startsWith("@")&&!ee.startsWith("<"))return[];return vc(ee.slice(1).split(";")[0]??"")}if(D==="--data-urlencode"){let z=N.indexOf("@"),ee=N.indexOf("=");if(z===-1||ee!==-1&&ee<z)return[];return vc(N.slice(z+1))}return N.startsWith("@")?vc(N.slice(1)):[]}function hP(D){if(D===void 0)return null;if(lg.has(D))return D;return/^-[A-Za-z]+[dF]$/.test(D)?`-${D.slice(-1)}`:null}function yP(D){let N=D.slice(0,2);if(D.length>2&&(N==="-d"||N==="-F"))return{flag:N,value:D.slice(2)};let z=D.indexOf("=");if(z===-1)return null;let ee=D.slice(0,z);return lg.has(ee)?{flag:ee,value:D.slice(z+1)}:null}function vc(D){return D===""||D==="-"?[]:[D]}function bP(D,N,z,ee,te,he){let je=D.findIndex((lt)=>lt.startsWith("-")||lt==="("||lt==="!"||lt===";"),at=[...D.slice(0,je===-1?D.length:je),...D.flatMap((lt,ct)=>lt==="-files0-from"&&D[ct+1]!==void 0?[D[ct+1]??""]:[])];for(let lt=0;lt<D.length;lt++){if(!kw.has(D[lt]??""))continue;let ct=D.slice(lt+1),dt=ct.findIndex((mt)=>Ow.has(mt)),ft=dt===-1?ct:ct.slice(0,dt),ut=qs(ft,N,z,ee,te,he).map((mt)=>mt.target);if(at.push(...ut.filter((mt)=>mt!=="{}")),!ut.includes("{}"))continue;at.push(...D.slice(0,lt).flatMap((mt,pt,gt)=>{if(!Dw.has(mt))return[];let ht=gt[pt+1];return ht===void 0?[]:[ht,ht.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return at}function CP(D,N,z,ee,te,he,je){let at=[];for(let lt=0;lt<N.length;lt++){let ct=N[lt];if(ct===void 0)break;if(cg.has(ct)||mg(D,ct)){let ft=N[lt+1];if(ft!==void 0)at.push(...Vs(D,ft,z,ee,te,he,je)),lt++;continue}let dt=/^--(?:eval|exec)=(.*)$/.exec(ct);if(dt!==null&&dt[1]!==void 0){at.push(...Vs(D,dt[1],z,ee,te,he,je));continue}if(!ct.startsWith("-"))at.push({target:ct,cwd:he})}return at}function mg(D,N){if(!N.startsWith("-")||N.startsWith("--")||N.length<=2)return!1;return Ww.get(N[N.length-1]??"")?.has(Ac(D))??!1}function SP(D,N,z,ee,te,he){if(!D.includes("system"))return[];return Ml(D)?.commands.flatMap((je)=>ho(N.getShellSyntax(je),N,z,ee,te,he))??[]}function vP(D){return Array.from(D.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((N)=>N[1]).filter((N)=>N!==void 0&&N!=="")}function EP(D){let N=Array.from(D.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((z)=>z[2]).filter((z)=>z!==void 0&&z!=="");return[...N,...N.flatMap(Tc),...D.match(Ec)??[]]}function Vs(D,N,z,ee,te,he,je){let at=(gt)=>({target:gt,cwd:he}),lt=RP(N,xP(D));if(lt.kind==="unmaskable")return EP(N).map(at);let ct=lt.masked.match(Xp)!==null||lt.literals.some((gt)=>Jp.test(lt.masked.slice(0,gt.start))),dt=lt.masked.match(Xw)!==null||lt.literals.some((gt)=>Jw.test(lt.masked.slice(0,gt.start))),ft=ee.inlineLiteralsPresumedData===!0&&!Ko.has(D),ut=ft&&!(AP(lt.masked)||ct||dt)?[]:lt.literals,mt=ft?Array.from(lt.masked.matchAll(Xp),(gt)=>{let ht=gt.index+gt[0].length;return{start:ht,end:fl(lt.masked,ht)}}):[],pt=!ft||mt.some((gt)=>ml(lt.masked,gt.start))?lt.literals:lt.literals.filter((gt)=>Jp.test(lt.masked.slice(0,gt.start))||mt.some((ht)=>gt.start>=ht.start&&gt.start<ht.end));return[...ut.map((gt)=>gt.text).filter((gt)=>gt!=="").map(at),...ut.flatMap((gt)=>Tc(gt.text)).map(at),...ft?[]:lt.literals.flatMap((gt)=>gt.text.match(Ec)??[]).map(at),...ct?pt.flatMap((gt)=>wc(gt.text,z,ee,te,he,je)??[at(gt.text)]):[],...dt?lt.literals.flatMap((gt)=>Vs(D,gt.text.replace(/\\(.)/g,(ht,yt)=>yt==="n"?`
+`:yt),z,ee,te,he,je)):[],...(lt.masked.match(Ec)??[]).map(at)]}function xP(D){let N=Ac(D);if(N==="python")return"python";if(N==="osascript")return"opaque";return N==="node"||N==="bun"||N==="deno"?"javascript":"simple"}function RP(D,N){if(N==="opaque")return{kind:"unmaskable"};let z=D.split(""),ee=[];for(let te=0;te<D.length;te++){let he=D[te]??"";if(N==="simple"&&(he==="`"||he==="%"||he==="<")){if(Yw.test(D.slice(te)))return{kind:"unmaskable"}}let je=he==="'"||he==='"'||N==="javascript"&&he==="`"?he:null;if(je===null)continue;if(je==="`"&&PP(D,te))return{kind:"unmaskable"};let at=N==="python"?_P(D,te):"",lt=N==="python"&&D.startsWith(je.repeat(3),te)?je.repeat(3):je,ct=te+lt.length,dt=wP(D,ct,lt);if(dt===null)return{kind:"unmaskable"};let ft=D.slice(ct,dt);if(/[fF]/.test(at)&&ft.includes("{"))return{kind:"unmaskable"};if(N==="simple"&&je==='"'&&Zw.test(ft))return{kind:"unmaskable"};ee.push({start:ct,text:ft});for(let ut=te;ut<dt+lt.length;ut++)z[ut]=" ";te=dt+lt.length-1}return{kind:"masked",masked:z.join(""),literals:ee}}function _P(D,N){return qw.exec(D.slice(Math.max(0,N-3),N))?.[1]??""}function wP(D,N,z){let ee=z==="`",te=ee||z.length===3;for(let he=N;he<D.length;he++){let je=D[he];if(je==="\\"){he++;continue}if(ee&&je==="$"&&D[he+1]==="{")return null;if(!te&&(je===`
+`||je==="\r"))return null;if(D.startsWith(z,he))return he}return null}function PP(D,N){for(let z=N-1;z>=0;z--){let ee=D[z];if(!ee||/\s/.test(ee))continue;return/[\w$\])]/.test(ee)}return!1}function AP(D){for(let N of D.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let z=N[0],ee=N.index;if(Nw.has(z.toLowerCase()))return!0;let te=z.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((he)=>he.toLowerCase());if(!te.some((he)=>Lw.has(he)))continue;if(te.length>1)return!0;if(TP(D,ee)===".")return!0;if(IP(D,ee+z.length)==="(")return!0}return!1}function TP(D,N){for(let z=N-1;z>=0;z--)if(!/\s/.test(D[z]??""))return D[z];return}function IP(D,N){for(let z=N;z<D.length;z++)if(!/\s/.test(D[z]??""))return D[z];return}function kP(D,N,z,ee,te,he){return LP(D).flatMap((je)=>{let at=N.getShellSyntax(je);if(at.status==="invalid")return[];return[...ho(at,N,{...z,displayOperandsAreCapturedOutput:!0},ee,te,he),...OP(at,ee)?MP(at,ee).map((lt)=>({target:lt,cwd:te})):[]]})}function OP(D,N){let z=cs(D);for(let ee=0;ee<z.length;ee++){let te=z[ee];if(te?.kind!=="word"||Gn(Zn(te.text,N)).toLowerCase()!=="base64")continue;for(let he=ee+1;he<z.length;he++){let je=z[he];if(je?.kind==="operator")break;if(je?.kind!=="word")continue;let at=Zn(je.text,N);if(at==="--decode"||!at.startsWith("--")&&at.startsWith("-")&&/[dD]/.test(at))return!0}}return!1}function MP(D,N){return cs(D).flatMap((z)=>z.kind==="word"?[Zn(z.text,N)]:z.kind==="redirection"&&z.target?[Zn(z.target,N)]:[]).flatMap(Tc)}function Tc(D){let N=NP(D);if(N===null)return[];let z=Buffer.from(N,"base64").toString("utf8");if(z===""||DP(z))return[];return Buffer.from(z,"utf8").toString("base64").replace(/=+$/g,"")===N.replace(/=+$/g,"")?[z]:[]}function DP(D){return Array.from(D).some((N)=>{let z=N.charCodeAt(0);return z<32||z===127})}function NP(D){if(D.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(D))return null;if(/=/.test(D.replace(/=+$/g,"")))return null;let N=D.replace(/=+$/g,"");if(N.length%4===1)return null;return`${N.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-N.length%4)%4)}`}function LP(D){let N=[],z={inSingle:!1,inDouble:!1,escaped:!1};for(let ee=0;ee<D.length;ee++){let te=D[ee];if(!te)break;if(Io(te,z))continue;if(pg(D,ee,z)){let he=WP(D,ee+1);if(he!==null)N.push(he.body),ee=he.endIndex;continue}if(!z.inSingle&&te==="`"){let he=GP(D,ee);if(he!==null)N.push(he.body),ee=he.endIndex}}return N}function WP(D,N){let z={inSingle:!1,inDouble:!1,escaped:!1},ee=1;for(let te=N+1;te<D.length;te++){let he=D[te];if(!he)break;if(Io(he,z))continue;if(pg(D,te,z)){ee++,te++;continue}if(!z.inSingle&&!z.inDouble&&he===")"){if(ee--,ee===0)return{body:D.slice(N+1,te),endIndex:te}}}return null}function GP(D,N){let z=!1;for(let ee=N+1;ee<D.length;ee++){let te=D[ee];if(!te)break;if(z){z=!1;continue}if(te==="\\"){z=!0;continue}if(te==="`")return{body:D.slice(N+1,ee),endIndex:ee}}return null}function pg(D,N,z){return!z.inSingle&&D[N]==="$"&&D[N+1]==="("&&D[N+2]!=="("}function FP(D){let N=[],z=[],ee=!1,te=!1,he=!1;for(let lt=0;lt<D.length;lt++){let ct=D[lt];if(ct===void 0)break;if(!he&&ct==="--"){he=!0;continue}if(he){z.push(ct);continue}let dt=/^--([^=]+)(?:=(.*))?$/.exec(ct);if(dt!==null){let ft=dt[1]??"",ut=dt[2];if(ft===Uw)te=!0;if(jw.has(ft))ee=!0;if(ut!==void 0){if(ft===Zp)N.push(ut);continue}if(Kw.has(ft)){let mt=D[lt+1];if(ft===Zp&&mt!==void 0)N.push(mt);lt++}continue}if(ct.startsWith("-")&&ct.length>1){let ft=ct.slice(1),ut="",mt="";for(let gt=0;gt<ft.length;gt++){let ht=ft[gt]??"";if(Hw.has(ht))ee=!0;if(Vw.has(ht)){ut=ht,mt=ft.slice(gt+1);break}}if(ut==="")continue;if(mt.length>0){if(ut===Yp)N.push(mt);continue}let pt=D[lt+1];if(ut===Yp&&pt!==void 0)N.push(pt);lt++;continue}z.push(ct)}let at=!ee&&!te?z.slice(1):z;return[...N,...at]}function tr(D){let N=D.findIndex((z)=>!gg(z)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(z));return N===-1?[]:D.slice(N)}function gg(D){return D==="env"||D==="command"||D==="builtin"||D==="sudo"}var zP=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),BP=".env.",$P=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),UP=[".env.example.",".env.sample."];function HP(D){let N;try{N=new URL(D.trim())}catch{return!1}return N.protocol!=="file:"&&N.host!==""}function jP(D){return D.length>0&&!/\s/.test(D)}function Rc(D,N,z,ee){let te=hg(D,N,z,ee);return te!==""&&z.paths.entryKind(te)!=="missing"}function hg(D,N,z,ee){try{return pi(D,N,z,ee)}catch(te){if(te instanceof s)throw te;return""}}var VP=new Set(["node_modules","__pycache__"]),KP=[["vendor","bundle"],["vendor","cache"]];function qP(D,N,z,ee,te){if(HP(D))return null;let he=Un(D,N,ee,te);if(!he)return null;let je=Ft(he.split("/").pop()??""),at=Ft(he),lt=()=>jP(je)||Rc(D,N,ee,te);if($P.has(je)||UP.some((ut)=>je.startsWith(ut)))return null;let ct=Ft(eA(D,N,ee,te));for(let ut of Pa){let mt=`~/${ut.suffixParts.join("/")}`;if((og(at,mt)||og(ct,mt))&&er(ut.id,z))return ut.id}let dt=YP(he,N,z,ee,te);if(dt)return dt;if(zP.has(je))return null;for(let ut of wa)if(je===ut.basename&&er(ut.id,z))return ut.id;if(je.startsWith(BP)&&er(Ii.id,z)&&lt())return Ii.id;for(let ut of Aa)if(je.length>ut.prefix.length&&je.startsWith(ut.prefix)){let mt=je.slice(ut.prefix.length)[0];if((mt==="-"||mt==="_")&&er(ut.id,z)&&lt())return ut.id}for(let ut of Ta)if(je.length>ut.prefix.length&&je.startsWith(ut.prefix)){if(je.slice(ut.prefix.length)===ut.suffix&&er(ut.id,z))return ut.id}if(JP(at))return null;if(!je.includes(".")&&ko.pattern.test(je)&&er(ko.id,z))return ko.id;let ft=QP(je,z);if(ft)return ft;return null}function YP(D,N,z,ee,te){return ki.find((he)=>{if(!er(he.id,z))return!1;switch(he.id){case"secret.cli.claude-code":return Lt(D,$t(ee.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",N,ee,te),[".credentials.json"]);case"secret.cli.claude-code.config":{let je=Ft(D).split("/");return Lt(D,$t(ee.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",N,ee,te),["settings.json","settings.local.json"])||mi(D,"~/.claude.json",N,ee,te)||je.at(-1)==="settings.local.json"&&je.at(-2)===".claude"||je.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Lt(D,Un("~/.gemini/config",N,ee,te),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let je=$t(ee.env.get("CODEX_HOME"),"~/.codex",N,ee,te);return Lt(D,je,["auth.json",".credentials.json"])||fi(D,je,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let je=$t(ee.env.get("CODEX_HOME"),"~/.codex",N,ee,te),at=Ft(D).split("/").at(-1)??"";return Lt(D,je,["config.toml"])||at.endsWith(".config.toml")&&Lt(D,je,[at])}case"secret.cli.gemini":return Lt(D,on($t(ee.env.get("GEMINI_CLI_HOME"),"~",N,ee,te),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let je=Ft(D).split("/"),at=ee.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),lt=ee.env.get("ProgramData")?[on($t(ee.env.get("ProgramData"),"",N,ee,te),"gemini-cli")]:[];return Lt(D,on($t(ee.env.get("GEMINI_CLI_HOME"),"~",N,ee,te),".gemini"),["settings.json","google_accounts.json"])||je.at(-1)==="settings.json"&&je.at(-2)===".gemini"||(at?.trim()?mi(D,at,N,ee,te):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...lt].some((ct)=>Lt(D,Un(ct,N,ee,te),["settings.json"]))}case"secret.cli.copilot-cli":{let je=$t(ee.env.get("COPILOT_HOME"),"~/.copilot",N,ee,te);return Lt(D,je,["config.json"])||fi(D,je,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Lt(D,$t(ee.env.get("COPILOT_HOME"),"~/.copilot",N,ee,te),["mcp-config.json"]);case"secret.cli.kimi-code":{let je=$t(ee.env.get("KIMI_CODE_HOME"),"~/.kimi-code",N,ee,te),at=$t(ee.env.get("KIMI_SHARE_DIR"),"~/.kimi",N,ee,te);return Lt(D,je,["server.token"])||fi(D,je,["credentials"])||fi(D,at,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let je=["config.toml","mcp.json"],at=Ft(D).split("/");return at.at(-1)==="mcp.json"&&at.at(-2)===".kimi-code"||Lt(D,$t(ee.env.get("KIMI_CODE_HOME"),"~/.kimi-code",N,ee,te),je)||Lt(D,$t(ee.env.get("KIMI_SHARE_DIR"),"~/.kimi",N,ee,te),[...je,"config.json","config.json.bak"])}case"secret.cli.opencode":{let je=on($t(ee.env.get("XDG_DATA_HOME"),"~/.local/share",N,ee,te),"opencode"),at=Ft(D).split("/").at(-1)??"",lt=ee.env.get("OPENCODE_DB")?.trim(),ct=lt&&lt!==":memory:"?[lt,`${lt}-wal`,`${lt}-shm`]:[];return Lt(D,je,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(at)&&Lt(D,je,[at])||ct.some((dt)=>mi(D,dt,N,ee,te))}case"secret.cli.opencode.config":{let je=on($t(ee.env.get("XDG_CONFIG_HOME"),"~/.config",N,ee,te),"opencode"),at=ee.env.get("ProgramData")?[on($t(ee.env.get("ProgramData"),"",N,ee,te),"opencode")]:[],lt=["opencode.json","opencode.jsonc"],ct=ee.env.get("OPENCODE_CONFIG");return lt.includes(Ft(D).split("/").at(-1)??"")||Lt(D,je,["config.json"])||(ct?.trim()?mi(D,ct,N,ee,te):!1)||["/Library/Application Support/opencode","/etc/opencode",...at].some((dt)=>Lt(D,Un(dt,N,ee,te),lt))}case"secret.cli.pi":return Lt(D,$t(ee.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",N,ee,te),["auth.json"]);case"secret.cli.pi.config":return Lt(D,$t(ee.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",N,ee,te),["models.json"]);case"secret.cli.amp":{let je=Un("~",N,ee,te);return[on($t(ee.env.get("XDG_DATA_HOME"),"~/.local/share",N,ee,te),"amp"),on(je,".local","share","amp")].some((lt)=>Lt(D,lt,["secrets.json"]))||fi(D,on(je,".amp"),["oauth"])}case"secret.cli.amp.config":{let je=["settings.json","settings.jsonc"],at=[on($t(ee.env.get("XDG_CONFIG_HOME"),"~/.config",N,ee,te),"amp"),on(Un("~",N,ee,te),".config","amp")],lt=Ft(D).split("/"),ct=ee.env.get("AMP_SETTINGS_FILE");return at.some((dt)=>Lt(D,dt,je))||lt.at(-2)===".amp"&&je.includes(lt.at(-1)??"")||(ct?.trim()?mi(D,ct,N,ee,te):!1)}case"secret.cli.cursor":{let je=on($t(ee.env.get("XDG_CONFIG_HOME"),"~/.config",N,ee,te),"cursor"),at=on($t(ee.env.get("CURSOR_DATA_DIR"),"~/.cursor",N,ee,te),"projects");return Lt(D,Un("~/.cursor",N,ee,te),["auth.json"])||Lt(D,je,["auth.json"])||Ft(D).split("/").at(-1)==="mcp-auth.json"&&zr(Ft(D),Ft(at))}case"secret.cli.cursor.config":{let je=Ft(D).split("/");return je.at(-1)==="mcp.json"&&je.at(-2)===".cursor"}case"secret.cli.grok-build":return Lt(D,$t(ee.env.get("GROK_HOME"),"~/.grok",N,ee,te),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let je=Ft(D).split("/");return je.at(-1)==="config.toml"&&je.at(-2)===".grok"||Lt(D,$t(ee.env.get("GROK_HOME"),"~/.grok",N,ee,te),["config.toml","managed_config.toml","requirements.toml"])||Lt(D,Un("/etc/grok",N,ee,te),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var rg=new WeakMap;function $t(D,N,z,ee,te){let he=rg.get(te)??new Map;rg.set(te,he);let je=`${z}\x00${D??""}\x00${N}`,at=he.get(je);if(at!==void 0)return at;let lt=Un(D?.trim()?D:N,z,ee,te);return he.set(je,lt),lt}function Lt(D,N,z){return z.some((ee)=>yg(D,on(N,ee)))}function fi(D,N,z){return z.some((ee)=>zr(Ft(D),Ft(on(N,ee))))}function mi(D,N,z,ee,te){return yg(D,Un(N,z,ee,te))}function yg(D,N){return Ft(D)===Ft(N)}function on(D,...N){return Wn([D,...N].filter(Boolean).join("/"))}function ZP(D,N,z,ee,te,he){if(z.length===0)return!1;let je=Ft(pi(D,N,te,he));return z.some((at)=>zr(je,Ft(pi(at,ee,te,he))))}function XP(D,N,z,ee,te,he){if(z.length===0)return!1;let je=Ft(pi(D,N,te,he));if(!je)return!1;let at=te.env.get("HOME")??te.home,lt=at?Wn(Mt(hn(at),te.paths,he)):"",ct=Ft(lt),dt=te.env.get("CC_SAFETY_NET_HOME"),ft=Ft(dt?Wn(Mt(Ks(hn(dt)),te.paths,he)):lt&&Wn(Mt(`${lt}/.cc-safety-net`,te.paths,he)));if(ft&&zr(je,ft))return!1;return z.some((ut)=>{let mt=Da(ut);if(mt&&ig.basename(je)!==Ft(mt.name))return!1;let pt=Ft(pi(mt?.root??ut,ee,te,he));if(!pt)return!1;if(ct&&(ct===pt||ct.startsWith(pt.endsWith("/")?pt:`${pt}/`)))return!1;return zr(je,pt)&&!(mt&&je===pt)})}function JP(D){let N=D.split("/");return N.some((z)=>VP.has(z))||KP.some(([z,ee])=>N.some((te,he)=>te===z&&N[he+1]===ee))}function QP(D,N){let z=D.lastIndexOf("."),ee=z>0&&z<D.length-1?D.slice(z+1):"";if(ee==="")return null;for(let te of Ia)if(ee===te.extension&&er(te.id,N))return te.id;for(let te of ka)if(te.pattern.test(ee)&&er(te.id,N))return te.id;return null}function Ft(D){return D.toLowerCase()}function er(D,N){return!N?.disabledRules?.includes(D)}function Un(D,N,z,ee){let{home:te,normalized:he}=Ic(D,z,ee);if(!he)return"";if(!te)return he;let je=kc(he,te),at=js(je)?je:Wn(Ks(N,je)),lt=Wn(Mt(at,z.paths,ee));if(!zr(lt,te)){if(js(je))return lt;return lt===at?he:lt}let ct=lt.slice(te.length);return ct?`~${ct}`:"~"}function og(D,N){return D===N||D.startsWith(`${N}/`)}function eA(D,N,z,ee){let{home:te,normalized:he}=Ic(D,z,ee);if(!he||!te)return"";let je=kc(he,te),at=ig.normalize(js(je)?je:Wn(Ks(N,je))),lt=Wn(hn(z.env.get("HOME")??z.home)),ct=(ut)=>process.platform==="win32"?ut.toLowerCase():ut,dt=[te,lt].find((ut)=>ut!==""&&zr(ct(at),ct(ut)));if(dt===void 0)return"";let ft=at.slice(dt.length);return ft?`~${ft}`:"~"}function pi(D,N,z,ee){let{home:te,normalized:he}=Ic(D,z,ee);if(!he)return"";let je=te?kc(he,te):he;return Wn(Mt(js(je)?je:Ks(N,je),z.paths,ee))}function Ic(D,N,z){let ee=N.env.get("HOME")??N.home,te=ee?Wn(Mt(hn(ee),N.paths,z)):"",he=Wn(hn(tA(Zn(D,N))));return{home:te,normalized:he}}function tA(D){if(!D.trim().toLowerCase().startsWith("file:"))return D;try{return Aw(D)}catch{return D}}function kc(D,N){if(D==="~")return N;if(D.startsWith("~/"))return on(N,D.slice(2));return D}function nA(D){if(process.platform==="win32")return!0;return Pw.parse(D).root.length>1}function Wn(D){let N=D.trim(),z=(N.includes("\\")&&nA(N)?N.replace(/\\/g,"/"):N).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(z==="/")return z;return z.replace(/\/+$/g,"")}function zr(D,N){return D===N||D.startsWith(N.endsWith("/")?N:`${N}/`)}function Gn(D){return D.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??D}class p extends Error{stage;evaluation;name="GuardEvaluationError";constructor(D,N,z){super(`CC Safety Net ${D} dependency failed`,{cause:z});this.stage=D;this.evaluation=N}}var rA={findPolicyMutation:Vp,findGitMetadataMutation:vf,resolveGitMetadata:iA,loadPolicySnapshot:E,findSensitiveTarget:ug,analyzeCommand:Fp,getModes:R},oA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function B(D,N){let z={...rA,...N.dependencies},ee=lA(D),te=gi(D)?D.command:ee,he=gr("policy-protection",te,()=>Zo(D)),je=un(he,"input-candidate"),at=un(he,"declared-command");if(gi(D)&&D.command?.trim()&&at?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Fn,intent:"stop_and_explain",evidence:{command:D.command,segment:D.command}}};if(je?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Bf,intent:"stop_and_explain"}};let lt=gn(),ct=gr("policy-protection",te,()=>z.resolveGitMetadata([D.context.executionCwd,D.context.configCwd],N.environment)),dt=gr("policy-protection",te,()=>z.findPolicyMutation(he,N.environment,lt));if(dt){let bt=te??dt.target;return{stage:"policy-protection",decision:{kind:"deny",reason:$e,intent:"hard_stop",evidence:{command:bt,segment:dt.target}}}}let ft=gr("policy-protection",te,()=>$p(he,N.environment,lt));if(ft){let bt=te??ft.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Me,intent:"hard_stop",evidence:{command:bt,segment:ft.target}}}}let ut=gr("policy-protection",te,()=>z.findGitMetadataMutation(he,ct,N.environment,lt));if(ut){let bt=te??ut.target;return{stage:"policy-protection",decision:{kind:"deny",reason:x,intent:"hard_stop",evidence:{command:bt,segment:ut.target}}}}let mt=gr("config-load",te,()=>z.loadPolicySnapshot(N.environment,{...N.policyOptions,cwd:D.context.configCwd})),pt=mt.policy,gt=z.getModes(pt,N.environment.env),ht={level:gt.effectiveLevel,...sA(mt)},yt=pt.secretProtection.enabled===!1?null:gr("secret-protection",te,()=>z.findSensitiveTarget(he,pt.secretProtection,N.environment,lt,{strict:gi(D)||je?.program.dialect==="powershell"?gt.strict:void 0}));if(yt){let bt=te??yt.target;return{stage:"secret-protection",...ht,decision:{kind:"deny",reason:sg,intent:"hard_stop",ruleId:yt.ruleId,evidence:{command:bt,segment:yt.target}}}}if(!gi(D))return{stage:"non-command",...ht,decision:{kind:"allow"}};if(!D.command||D.command.trim()==="")return{...Oc("command-validation",te),...ht};let Ct=gr("command-analysis",te,()=>zp(()=>z.analyzeCommand(D.command,{cwd:D.context.executionCwd,shell:D.route.shell,policySnapshot:mt,environment:N.environment,protectedGitMetadata:ct,effectiveCapabilities:gt.capabilities,strict:gt.strict,paranoidRm:gt.paranoidRm,paranoidInterpreters:gt.paranoidInterpreters,worktreeMode:gt.worktreeMode,budget:lt,...N.trace?{trace:N.trace}:{}},aA(he),he.store),D.command,N.trace));if(Ct.decision){let bt=!gt.strict&&(Ct.decision.ruleId==="raw-text.dangerous-command"||Ct.decision.reason===ei&&!oA.test(Ct.decision.evidence?.segment??"")&&_n(D.command)===null);return{stage:"command-analysis",...ht,..."errorCode"in Ct?{errorCode:Ct.errorCode}:{},decision:bt?{...Ct.decision,unverifiedByStandardMode:!0}:Ct.decision}}return{stage:"command-analysis",...ht,decision:{kind:"allow"}}}function iA(D,N){let z=[...new Set(D.filter((ee)=>typeof ee==="string"&&ee!==""))].flatMap((ee)=>N.gitMetadata(ee)??[]);if(z.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(z.flatMap((ee)=>ee.entries))]),markerFiles:Object.freeze([...new Set(z.flatMap((ee)=>ee.markerFiles))]),directories:Object.freeze([...new Set(z.flatMap((ee)=>ee.directories))]),hooksDirectories:Object.freeze([...new Set(z.flatMap((ee)=>ee.hooksDirectories))])})}function sA(D){if(D.state==="ready")return{};return{configFallback:{reason:D.reason}}}function aA(D){return un(D,"declared-command")?.program}function lA(D){try{return ne(D.input)}catch(N){let z=gi(D)?D.command:void 0;throw new p("policy-protection",Oc("policy-protection",N instanceof f?void 0:z,N),N)}}function gr(D,N,z){try{return z()}catch(ee){throw new p(D,Oc(D,ee instanceof f?void 0:N,ee),ee)}}function Oc(D,N,z){let ee=z instanceof s||z instanceof y;return{stage:D,decision:{kind:"deny",reason:ee?Xs:So,intent:"stop_and_explain",...N?{evidence:{command:N,segment:N}}:{}}}}function gi(D){return D.route.kind==="command"}
+export{a,s,V,ke,Ue,k,Ze,Ge,ye,P,A,be,Xe,c,o,He,xe,R,L,ve,Qe,f,q,ne,ce,et,We,d,Re,r,v,i,re,n,g,le,F,tt,nt,l,ue,de,rt,I,K,oe,S,ot,M,b,Se,j,u,J,Be,ze,O,w,T,pe,fe,Le,it,m,e,Te,we,Ve,qe,ie,Ce,se,_e,Y,U,Pe,me,G,Ke,H,Z,X,ae,Je,Ye,C,W,Ae,Ie,Oe,De,E,Ne,Ee,Fe,h,t,Q,ge,y,x,_,st,Me,$e,p,B};