cc-safety-net 2.4.15 → 2.5.0

package/README.md

@@ -37,13 +37,14 @@ CC Safety Net supports the coding agent CLIs below on Windows, macOS, and Linux.
     <td align="center"><a href="https://ccsafetynet.com/docs/installation#cursor-installation"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/assets/cursor-dark.svg"><img alt="Cursor" src="./.github/assets/cursor-light.svg" height="32"></picture><br>Cursor</a></td>
   </tr>
   <tr>
+    <td align="center"><a href="https://ccsafetynet.com/docs/installation#deepseek-harness-installation"><img alt="DeepSeek Harness" src="./.github/assets/deepseek.svg" height="32"><br>DeepSeek Harness</a></td>
     <td align="center"><a href="https://ccsafetynet.com/docs/installation#gemini-cli-installation"><img alt="Gemini CLI" src="./.github/assets/gemini-cli.svg" height="32"><br>Gemini CLI</a></td>
     <td align="center"><a href="https://ccsafetynet.com/docs/installation#github-copilot-cli-installation"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/assets/copilot-cli-dark.svg"><img alt="GitHub Copilot CLI" src="./.github/assets/copilot-cli-light.svg" height="32"></picture><br>GitHub Copilot CLI</a></td>
     <td align="center"><a href="https://ccsafetynet.com/docs/installation#grok-build-installation"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/assets/grok-build-dark.svg"><img alt="Grok Build" src="./.github/assets/grok-build-light.svg" height="32"></picture><br>Grok Build</a></td>
     <td align="center"><a href="https://ccsafetynet.com/docs/installation#hermes-agent-installation"><img alt="Hermes Agent" src="./.github/assets/hermes.png" height="32"><br>Hermes Agent</a></td>
-    <td align="center"><a href="https://ccsafetynet.com/docs/installation#kimi-code-installation"><img alt="Kimi Code" src="./.github/assets/kimi-cli.png" height="32"><br>Kimi Code</a></td>
   </tr>
   <tr>
+    <td align="center"><a href="https://ccsafetynet.com/docs/installation#kimi-code-installation"><img alt="Kimi Code" src="./.github/assets/kimi-cli.png" height="32"><br>Kimi Code</a></td>
     <td align="center"><a href="https://ccsafetynet.com/docs/installation#openclaw-installation"><img alt="OpenClaw" src="./.github/assets/openclaw.png" height="32"><br>OpenClaw</a></td>
     <td align="center"><a href="https://ccsafetynet.com/docs/installation#opencode-installation"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/assets/opencode-dark.svg"><img alt="OpenCode" src="./.github/assets/opencode-light.svg" height="32"></picture><br>OpenCode</a></td>
     <td align="center"><a href="https://ccsafetynet.com/docs/installation#pi-installation"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/assets/pi-dark.svg"><img alt="Pi" src="./.github/assets/pi-light.svg" height="32"></picture><br>Pi</a></td>
@@ -89,6 +90,8 @@ Keep the `@latest` qualifier. A bare `cc-safety-net` spec can run an older copy
 
 OpenCode integration supports v1.18.29+ and v2.0.6+. Run `npx -y cc-safety-net@latest install --opencode`; the installer selects the host's plugin commands. See [OpenCode compatibility](docs/opencode-compatibility.md) for v2 shell configuration and host limitations.
 
+DeepSeek Harness integration installs as a profile plugin bundle into each DeepSeek Harness on the machine. `npx -y cc-safety-net@latest install --deepseek-harness` adds it to the Desktop app through Desktop's bundled `dsh` command; quit Desktop first, and open it once beforehand so it has a profile. It adds it to the web profile through `npx -y @deepseek-ai/dsh plugin --profile web add cc-safety-net`, which reuses the DeepSeek Harness that `npx @deepseek-ai/dsh web` or a global install runs and needs `pnpm` on your PATH. The installer looks for Desktop in its default location; if yours is elsewhere, add `cc-safety-net` from its Plugins page.
+
 OpenClaw integration requires OpenClaw 2026.8.1+. The installer accepts the plugin's declared capabilities for you, and older OpenClaw releases reject that option.
 
 ## Safety presets

package/dist/amp/cc-safety-net/index.ts

@@ -1,5 +1,5 @@
 // cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp
-// version: 2.4.15
+// version: 2.5.0
 // @bun
 var Ei="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Ve="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Ln="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var vi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Nn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},K=Object.freeze({realpathAttempts:{cap:16384,...vi},processedCandidateBytes:{cap:4194304,...vi},pathEnvironmentExpansion:{cap:64,...vi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Nn},trackedHeredocFiles:{cap:64,...Nn},controlFlowStates:{cap:64,...Nn},wrapperPeelIterations:{cap:20,...Nn},derivedCommandShape:Nn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(K[e].reason);this.kind=e}}function Se(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>K[t].cap)throw new N(t)}}}var Bp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function dt(e){return $p(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function $p(e){return Bp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Up={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Hp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Up[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
@@ -29,7 +29,7 @@ var Ei="CC Safety Net could not analyze the command because it exceeds safe anal
 `||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=Gu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Gu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function WC(e,t){if(S(e,t)!=="\\"||S(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function Gu(e,t,n){if(Fu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Fu(e,t,n,"force"))return{recursive:!1,force:!0};if(S(e,t)!=="-"||S(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=S(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Fu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(S(e,t+i+2)!==r[i])return!1;return!0}function GC(e){let t=!1;for(let n=0;n<Z(e);n++){if(oe(S(e,n))){t=!1;continue}if(tt(e,n,"dd")){t=!0,n++;continue}if(!t||!tt(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!H(S(e,r))&&S(e,r)!=="'"&&S(e,r)!=='"')return!0}return!1}function FC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=S(e,o);if(o===Z(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=BC(e,o);if(s>=0){if(zC(e,s))return!0;let a=s,l=!1;while(H(S(e,a)))l||=S(e,a)===`
 `,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(S(e,o-1)))&&(!S(e,o+2)||H(S(e,o+2))||oe(S(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&nt(e,o+11)||Vs(e,o,"recursive"),r||=j(e,o,"--force")&&nt(e,o+7)||Vs(e,o,"force"),n&&r)return!0;o++}return!1}function Vs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=S(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&nt(e,t+r+2)}function zC(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(H(S(e,n)))n++;let i=n;while(n<Z(e)&&!H(S(e,n)))n++;if(S(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=zu(e,i,"recursive"),a=zu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,S(e,i+1)==="-")continue;let l=$C(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function zu(e,t,n){return j(e,t,`--${n}`)&&nt(e,t+n.length+2)||Vs(e,t,n)}function BC(e,t){if(t>0&&Wt(S(e,t-1)))return-1;let n=t;if(S(e,n)==="\\")n++;if(S(e,n)!=="r")return-1;if(n++,S(e,n)==="\\")n++;if(S(e,n)!=="m"||!H(S(e,n+1)))return-1;return n+1}function $C(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(S(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=S(e,c)??"",m=(d==="r"||d==="f")&&nt(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&m,s||=d==="f"&&m,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&m,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Bu(e,t,n){return rr(e,"reset",gn,!0,(r)=>S(e,r)==="-"&&hn(e,r,t,n)?!0:r)}function UC(e){return rr(e,"clean",gn,!0,(t)=>{if(S(e,t)!=="-")return t;if(hn(e,t,"--fo","rce"))return!0;let n=nr(e,t,gn);for(let r=t+1;r<n;r++)if(S(e,r)==="f")return!0;return n-1})}function Eo(e,t,n){if(!tt(e,t,"git"))return null;let r=t+3;if(!H(S(e,r)))return{commandEnd:-1,next:r};while(H(S(e,r)))r++;while(r<Z(e)){if(oe(S(e,r)))return{commandEnd:-1,next:r};let o=nr(e,r,oe);if(tt(e,r,n))return{commandEnd:r+n.length,next:o};if(S(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=HC(e,r,o);r=o;while(H(S(e,r)))r++;if(i)return{commandEnd:tt(e,r,n)?r+n.length:-1,next:nr(e,r,oe)};if(!s)continue;if(r>=Z(e)||oe(S(e,r)))return{commandEnd:-1,next:r};r=nr(e,r,oe);while(H(S(e,r)))r++}return{commandEnd:-1,next:r}}function HC(e,t,n){for(let r of Ee)if(n-t===r.length&&j(e,t,r))return!0;return!1}function jC(e){return $u(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function VC(e){return rr(e,"push",gn,!0,(t)=>{if(S(e,t)!=="-")return t;if(S(e,t+1)==="f"&&!Wt(S(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Hu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function KC(e){return rr(e,"push",oe,!1,(t)=>{if(H(S(e,t))&&S(e,t+1)==="+"&&t+2<Z(e)&&!oe(S(e,t+2))&&!H(S(e,t+2)))return!0;if(S(e,t)===":"&&S(e,t+1)==="+")return!0;return t})}function qC(e){return rr(e,"push",oe,!1,(t)=>{if(S(e,t)==="-"&&hn(e,t,"--de","lete"))return!0;if(H(S(e,t))&&S(e,t+1)===":"&&t+2<Z(e)&&!H(S(e,t+2))&&!oe(S(e,t+2)))return!0;return t})}function YC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||oe(S(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Eo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||S(e,o)!=="-")continue;let i=nr(e,o,oe),s=ZC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function ZC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(S(e,i)!=="-")continue;if(hn(e,i,"--de","lete"))r=!0;if(hn(e,i,"--fo","rce"))o=!0;if(S(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&XC(S(e,s))){let d=S(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!nt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function XC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function JC(e){return $u(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function $u(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=S(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&S(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Eo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(S(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(hn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(S(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&nt(e,r+1))return!0;if(gn(o))i.outerActive=!1}return!1}function rr(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=S(e,s),l=n(a);if(!i&&!l){let c=Eo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(S(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(S(e,d)))i=!1;s=c}if(l)i=!1}return!1}function QC(e){let t=!1;for(let n=0;n<Z(e);n++){if(js(S(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Eo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&S(e,n)==="-"&&S(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Uu(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=S(e,r),i=t?js(o):oe(o);if(n&&H(o)&&S(e,r+1)==="-"&&tt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(tt(e,r,"find"))n=!0,r+=3}return!1}function nr(e,t,n){let r=t;while(r<Z(e)&&!H(S(e,r))&&!n(S(e,r)))r++;return r}function Hu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&S(e,o)===r[i];i++)o++;return nt(e,o)?o:-1}function hn(e,t,n,r){return Hu(e,t,n,r)>=0}function Te(e,t){tr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)we(t,a);if((s.regex?.test(a)??!1)||s.scan&&vo(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var eb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Vu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;tr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Ku(t.nodes,r,i)}function Ku(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Ku(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return tb(r,t,n)})}function tb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!eb.test(o.text));return e.words.every((o,i)=>o===t||ju(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||ju(o.target.raw,n.anchored,!0)))}function ju(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as nb,resolve as qu}from"path";function or(e,t,n,r){let o=nb(e)?qu(e):t?qu(t,e):void 0;if(!o)return;try{return L(o,n,r)}catch{return o}}function Yu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var yn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",ir="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",qs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),rb=new Set(["-p","--print"]),ob=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),ib=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),sb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),ab=new Map([["python",new Set(["m"])]]),lb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),cb=new Set(["always","default","never"]),ub=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),db=/\\\r?\n/g,mb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Zu(e){return Ro(e).code}function xo(e){return Ro(e).sources}function Xu(e){return mb.get(Zs(e))??[]}function Ro(e){let t=Zs(e[0]??"");if(!qs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Le(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Le(t,n,r,o,i,s);if(t==="node"&&rb.has(s)){let m=e[i+1];if(m===void 0)return Le(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(pb(t,s)){let m=e[i+1];if(m===void 0)return Le(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Le(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(gb(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=fb(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Le(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Le(t,n,r,o);if(lb.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&ub.has(s))||t==="python"&&!cb.has(m))return Le(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let u=s[m];if(u===void 0)break;if(ab.get(t)?.has(u)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Le(t,n,r,o)}if(ob.get(t)?.has(u)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&u==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(ib.get(t)?.has(u)){if(m+1===s.length)i++;break}if(sb.get(t)?.has(u)&&m+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return Le(t,n,r,o);if(c)i++}return Le(t,n,r,o,void 0,void 0,!0)}function Le(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
 `))||null,sources:r?c:[],optionsOpen:r&&s}}function fb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ys(e,t){return Zs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Zs(e){let t=T(e).toLowerCase();return Hr.test(t)?"python":t}function pb(e,t){return qs.get(e)?.has(t)??!1}function gb(e){return qs.get(e)?.has("--eval")??!1}function sr(e,t,n=!1){let r=Cb(e,t);if(!Ks(r,t))return!1;we(t,r);let o=yb(r);if(Ks(o,t))return!0;if(we(t,o),!Ju.test(o))return!1;return!n||hb(r,t)}function hb(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let d=e.startsWith(c.repeat(3),l)?c.repeat(3):c,m=l+d.length,u=m;while(u<e.length&&!e.startsWith(d,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;o.push({start:m,text:e.slice(m,u)}),r.fill(" ",l,u+d.length),l=u+d.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>Ju.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:Xs(i,c)}});if(s.some((l)=>Js(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),d=s.some((m)=>l.start>=m.start&&l.start<m.end);return(c||d)&&Ks(l.text,t)})}function Xs(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Js(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Ju=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function yb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Ks(e,t){if(So(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(we(t,e),r.test(e))return!0;if(So(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(we(t,e),r.test(e))return!0;if(So(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(we(t,e),n.some((o)=>vo(o,r))))}function Cb(e,t){return we(t,e),e.replace(db,"")}import{lstatSync as gS,readdirSync as hS}from"fs";import{basename as yS,isAbsolute as xd,join as CS,relative as Rd}from"path";import{isAbsolute as id,parse as Pb}from"path";import{dirname as bb,isAbsolute as Sb,parse as vb,sep as Eb}from"path";function ht(e,t,n){if(et(t))throw Error("Unsupported Windows namespace path");let r=Sb(t)?vb(t).root:"",o=r||e;for(let i of Rb(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=bb(o);continue}let s=xb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function xb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${Eb}${t}`}function Rb(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Qs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],wb=new Set(Qs),_b=1024,Qu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),ed=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),Ab=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function wo(e){return wb.has(e)}function ea(e){return wo(e)||Qu.has(e)||ed.has(e)||Hn(e)}function rt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function td(e,t){let n=rt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=_b?{state:"valid",count:r}:{state:"invalid"}}function _o(e,t,n){let o=e.match(Ab)?.[1];if(!o||!ea(o))return null;let i=e.indexOf("=");return{name:o,value:`${rt(o,t,n)??""}${e.slice(i+1)}`}}function nd(e){return od(e,ed)}function rd(e){return od(e,Qu)}function od(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var ad=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ie(e){if(!ad.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Ao(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Ie(_(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function ld(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Gt(e,t,n,r){if(!ld(Cn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<K.wrapperPeelIterations.cap;m++){let u=sd(i),f=Ao(i);for(let[g,h]of f.envAssignments)s.set(g,h),a.set(g,h);if(i=f.words,i.length===0)break;while(i.length>0&&Cn(i).includes("=")&&!Ib(i)){let g=kb(Cn(i),a,t.env)??_o(Cn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=O(Cn(i));if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=Mb(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=Lb(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=Wb(i);if(p==="builtin")i=i.slice(We(i,1)==="--"?2:1);if(sd(i)===u)break}let d=Ao(i);for(let[m,u]of d.envAssignments)s.set(m,u),a.set(m,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:Tb(d.words,o)}}function Tb(e,t){return e.some((n)=>!t.has(n))}function sd(e){return e.map(_).join(" ")}function Cn(e){let t=e[0];return t?_(t):""}function We(e,t){let n=e[t];return n?_(n):void 0}function Ib(e){return ad.test(Cn(e))}function kb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var Ob=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Mb(e,t,n){let r=1,o=n;while(r<e.length){let i=We(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=We(e,r+1);o=s?ar(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=ar(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=ar(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(Ob.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Db=new Set(["-i","-0","--null"]),Nb=new Set(["-u","--unset","-C","--chdir","-P"]);function Lb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=We(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(Db.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=We(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:We(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(Nb.has(c)){if(c==="-C"||c==="--chdir"){let m=We(e,a+1);s=m?ar(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=ar(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Ie(c))break;while(a<e.length){let m=Ie(We(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(We(e,a)==="--")a++;return l(a)}return l(a)}function ar(e,t,n){if(t==="")return null;if(!e&&!id(t))return null;let r=id(t)?Pb(t).root:n.realpath(e??"/");if(r===null)return null;try{return ht(r,t,n)}catch{return null}}function Wb(e){if(We(e,1)==="-v")return[...q(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=We(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var Gb=/['"\\$`{}#]/;function Po(e,t){if(e.some((r)=>Gb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function yt(e,t,n){return To(e,t,n).tokens}function Fb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ct(e,t,n,r=0){let o=To(e,t,n),i=(o.envSplitValues??[]).flatMap(Fb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ct(s,t,n,r+1)}function To(e,t,n,r){if(!ld(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Gt(q(e),t,n,r);return{tokens:o.words.map(_),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var oa=Symbol("adopt-as-operand"),zb=new Set(["env","sudo","command","builtin"]),Bb=new Set(["&&","||","|&","|","&",";"]),$b=new Set(["<<","<<<",">|"]),Ub=new Set(["|","|&"]),Hb=/[*@#?$!_-]/,jb=/^\w+(?::\w+)*/,Vb=Object.freeze([]),lr=Object.freeze({kind:"scope",edge:"enter"}),cr=Object.freeze({kind:"scope",edge:"exit"}),Kb=Object.freeze([]),qb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),ur=new Set(["bash","sh","zsh","dash","ksh"]),Yb=256,fd=new WeakMap;function pd(e,t){let n=t.status==="complete"?new Set(ra(t)):new Set,r=Jb(e,n);if(Vr(r))return Io("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Ft(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Io("structural-limit",r,t);if(o.invalid)return Io("invalid",r,t);let s=Io("complete",r,t,o.assignmentFallbacks);return fd.set(s,Object.freeze(i)),s}function Oo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,d=[];for(let m of gd(e)){if(m.kind==="scope"){if(m.edge==="enter"){d.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let u=o.segment(a,s,c,null,l);if(u)return u;let f=d.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let u=o.segment(a,s,c,m.operator,l);if(u)return u;s=Zb(a,s,n,r),c=a.length>0&&Ub.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let u=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(u===oa){l.add(a.length),a.push(i(m.target));continue}if(u)return u;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function Mo(e){return gd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function dr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function Zb(e,t,n,r){let o=dr(e)?new Map([...t.variables,...Xb(e,t.variables)]):t.variables,i=yt([...e],n),s=T(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:le(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function Xb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function gd(e){return fd.get(e)??Vb}function Jb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Io(e,t,n,r=Kb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Ft(e,t){return e.nodes.flatMap((n,r)=>Qb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function Qb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Ge(oS(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Ge(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[ko("{"),...Ft(e.body,a),...s?[ko("}")]:[]]:[lr,Ge("("),...Ft(e.body,a),...s?[Ge(")")]:[],cr]}]}let o=lS(e,r.functions);if(o){if(r.depth>=gt.maxDepth||++r.flags.expansions>Yb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...cd(e,r),ko(";"),...Ft(o,{...r,depth:r.depth+1}),ko(";")]},...ud(e,t,n,r)]}return[{start:e.span.start,events:cd(e,r)},...ud(e,t,n,r)]}function cd(e,t){return[...e.words.map((n)=>({start:n.span.start,events:yd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:eS(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function eS(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?yd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ia(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:iS(r),targetOrder:$b.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:bd(t)}:{}}),...s===void 0?o:o.slice(1)]}function ud(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ia(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Ge(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...hd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?tS(t,n,r):[]]}function tS(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:hd(n.source.slice(r.span.end,e.span.end),n)}]}function hd(e,t){if(t.depth>=gt.maxDepth)return t.flags.limited=!0,[];let n=Ne(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Ft(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function yd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Ge("glob"):s!==""||e.quoted&&o.length===0?ia(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of ta(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Ge(f));continue}s+=f.text,a||=f.glob}continue}let d=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=ta(f,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=d?Ft(d,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(lr,...p,cr);continue}let m=d?Ft(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(lr,...m,cr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Ge("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),lr,...m,...c.raw.endsWith(")")?[Ge(")")]:[],cr);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>Ge("(")),...u===1?[lr]:[],...m,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>Ge(")")):[],...u===1?[cr]:[])}return l(),o}function ta(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=dd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=dd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function dd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=rS(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return nS(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&Hb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?jb:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function nS(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=ta(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function rS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function oS(e){return/^[\r\n]+$/.test(e)?";":e}function Ge(e){return Object.freeze({kind:"operator",operator:e,boundary:Bb.has(e)})}function ko(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ia(e){return Object.freeze({kind:"word",text:e})}function iS(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function mr(e){return qb.has(e)||/^python\d/.test(e)}var sS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Cd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=sS.get(e)?.has(n)??!1;return Cd(e,t.slice(r?2:1))}function na(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return na(e.slice(1));if(!zb.has(t))return[...e];return na(Cd(t,e.slice(1)))}function bd(e){let t=Jn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return na(n<0?[]:e.words.slice(n).map((r)=>r.text))}function aS(e){let t=bd(e)[0];if(t===void 0)return!1;let n=T(t).toLowerCase();return mr(n)&&!ur.has(n)}function ra(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ra(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>ra(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(aS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!uS(t))return r;return[...r,...o]})}function lS(e,t){let n=Jn(e);return n===void 0?void 0:t.get(n)}function bt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function cS(e){if(bt(e.words[0],"git"))return bt(e.words[1],"commit");if(!bt(e.words[0],"gh")||!bt(e.words[2],"create"))return!1;return bt(e.words[1],"pr")||bt(e.words[1],"issue")}function uS(e){return(bt(e.words[0],"cat")||bt(e.words[0],"tee")||cS(e))&&!e.words.some(md)&&!e.redirections.some((n)=>md(n.target))}function md(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Sd=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),vd=new Set([...Sd,"glob"]),dS=new Set([...vd,"pattern"]);class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function fr(e){let t=mS(),n=zn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((d)=>d.source===s.source);if(a!==-1){let d=i[a];if(!d)return i;return i[a]={...d,usages:[...d.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:fS(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ot(e,t){if(!e.includes("$"))return e;return ki(e,t)}function mS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Ne(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let d=n.get(a);if(d)return d;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=pd(i,a);return e.set(i,c),c},getCommandProgram:r}}function fS(e){let t=e.route.kind==="grep"?vd:e.route.kind==="glob"?dS:Sd;return[...Ml(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?Ll(e.input):[]]}var pS=new Set(["-S","--suffix"]);function bn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Oo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function Do(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&pS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var ke="Git metadata and hooks are protected. Ask the user before modifying them.";function wd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Nr(e.invocation.toolName))return null;let a=e.paths.find((l)=>Ed(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=bn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>RS(a,l,t,n,r),isRedirectionTarget:(a,l)=>Ed(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function zt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Lo(le(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(sa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(m)=>c?No(m,l):bS(m,l);if(n.markerFiles.some(d))return!0;return r&&aa(n).some(d)}if(sa(a,n))return!0;return r&&aa(n).some((c)=>No(c,a))}function bS(e,t){let n=Rd(t,e);if(n===""||n.startsWith("..")||xd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function SS(e,t,n,r,o){return zt(e,t,n,!0,r,o)}function vS(e,t,n,r,o){if(!n)return!1;return sa(Lo(le(e,t,r,o)),n)}function Ed(e,t,n,r,o,i){let s=Lo(le(e,t,r,o));return i.includes(s)||Ad(s,n)}function _d(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>No(i,Lo(le(s,t,r,o)))))}function sa(e,t){return t.entries.includes(e)||t.directories.includes(e)||Ad(e,t)}function Ad(e,t){return t.hooksDirectories.some((n)=>No(e,n))}var ES=50000;function Pd(e,t){let n=[...new Set(aa(e))];if(n.some((o)=>t(yS(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=xS(o);if(!i)return!0;if(r+=i.length,r>ES)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>CS(o,s.name)))}return!1}function xS(e){try{let t=gS(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return hS(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function aa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function No(e,t){let n=Rd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!xd(n)}function Lo(e){return process.platform==="win32"?e.toLowerCase():e}function RS(e,t,n,r,o){if(dr(e))return null;let i=Ct([...e],r);if(T(i[0]??"").toLowerCase()!=="mv")return null;let s=Do(i.slice(1)),a=s.sources.find((l)=>SS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&vS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as zo,normalize as OS,parse as MS,posix as Ld,resolve as $t,sep as da}from"path";import{isAbsolute as wS,join as Td,normalize as Od,parse as _S,sep as Id}from"path";var AS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],PS=` 	
-`;function pr(e,t){if(St(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!la(e.get("TMPDIR")??"",t)}function Bt(e,t){if(e.has("TMPDIR"))return la(e.get("TMPDIR")??"",t);let n=ca(e,t);if(n===void 0)return!0;return la(n,t)}function ca(e,t){return Dd(e,t,"TMPDIR")}function la(e,t){if(!e)return!1;if(IS(e))return!1;return Sn(e,t)}function St(e,t){let n=Dd(e,t,"IFS");return n!==void 0&&n!==""&&n!==PS}function Sn(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Md(t).some((r)=>vn(n,r))}function Fo(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Md(t).some((r)=>Go(r)===Go(n))}var kd=new WeakMap;function Md(e){let t=kd.get(e);if(t)return t;let n=TS(e);return kd.set(e,n),n}function TS(e){let t=AS.map((r)=>Wo(r,e.paths)??Od(r)),n=Wo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&kS(n))return[...t,n];return t}function IS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Dd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function kS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Wo(e,t){try{let n=Od(e);if(!wS(n))return n;let r=_S(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Td(i,o[s]??"");if(t.entryKind(a)==="missing")return Td(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function vn(e,t){let n=Go(e),r=Go(t);if(n===r)return!0;let o=r.endsWith(Id)?r:`${r}${Id}`;return n.startsWith(o)}function Go(e){return process.platform==="win32"?e.toLowerCase():e}var DS=process.platform==="win32",Nd=64,NS=16384;function gr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function hr(e){let t=wu(e,Nd,Nd,NS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:LS(e)}}function LS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>WS(e.raw,n.span.start-e.span.start))}function WS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function vt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Se();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:US(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function ze(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&jS(e))return{kind:"outside_anchored_cwd"};let o=!r&&Gd(e,t.posixShell);if(et(e))return{kind:"outside_anchored_cwd"};if(ma(e,r))return{kind:"root_or_home_target"};if(FS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&zt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(zS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(HS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&YS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>ZS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(XS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(GS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function GS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(zo(r)||r.startsWith("~"))return!1;if(fa(r))return!1;if(Fd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return Sn($t(t.resolvedCwd,r),t.environment)}function Wd(e,t,n={}){let{containmentTarget:r,...o}=n;if(ze(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if($S(i))return!1;if(Fo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Fd(r??i,s,t.environment.paths,t.budget))}function ma(e,t=!1){let n=e.trim(),r=Ld.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function FS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=zo(o)?o:t.resolvedCwd?$t(t.resolvedCwd,o):null;if(!i)return!1;let s=he(L(i,t.environment.paths,t.budget));if(s===MS(s).root)return!0;return s===he(L(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=OS(e);if(DS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function zS(e,t,n,r,o,i,s,a){let l=e.trim();if(fa(l))return!1;if(!r&&Sn(l,a))return!0;return(t||i&&s)&&n&&!o&&BS(l,n)}function BS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Gd(e.slice(n.length+1),t)})}function $S(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Ld.normalize(`/${t[1]??""}`)==="/"}function fa(e){return e.split(/[\\/]+/).includes("..")}function US(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Yn(o.trim(),t);if(!zo(i))return[];try{let s=L(i,n,r);if(Zn(s,L(t,n,r)))return[];return[he(s)]}catch{return[]}})}function HS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(fa(r))return!1;let o=n?r:Yn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=zo(o)?o:i?$t(i,o):null;if(!s)return!1;try{let a=he(L(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(da)?l:`${l}${da}`))}catch{return!1}}function jS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Gd(e,t=!1){return e.includes("$")||e.includes("`")||VS(e)||t&&KS(e)}function VS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function KS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&qS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function qS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function YS(e,t,n,r){try{return he(L(e,n,r))===he(L(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function ZS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(L($t(t,e),n,r))===he(L(o,n,r))}catch{try{return he($t(t,e))===he(o)}catch{return!1}}}function XS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ua(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ua($t(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ua($t(a,e),t,i,s)}catch{return!1}}function ua(e,t,n,r){try{return zd(L(e,n,r),L(t,n,r))}catch{return!1}}function Fd(e,t,n,r){if(!t)return!1;try{return zd(L(t,n,r),L(e,n,r))}catch{return!0}}function zd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${da}`)||n===r}var JS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Bd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",QS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",$d="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Ud="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",ev="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",tv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",nv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Ud},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:ke},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:$d},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:ev},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Bd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:QS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Bd}};function Hd(e,t,n,r=vt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return rv(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function rv(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=iv(o),s=o[i];if(!s||!JS.has(pv(s.text)))return null;let a=ov(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",tv);for(let l of a.targets)if(!et(l.text)&&ma(ga(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Ud);for(let l of a.targets)if(n.resolvedCwd&&zt(ga(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",ke);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",$d);for(let l of a.targets){let c=gr(ze(ga(l.text),n),n,r,nv);if(c)return c}return null}function ov(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(sv(l))continue;if(s){t.push(pa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=lv(l.text);if(!c){t.push(pa(l)),i=i||l.dynamic;continue}if(cv(c.name)){let d=c.value?av(c.value,l):e[++a];if(d?.kind==="word"){t.push(pa(d)),i=i||d.dynamic;continue}i=!0;continue}if(uv(c.name)){n=!0;continue}if(dv(c.name)){r=!0;continue}if(mv(c.name))o=fv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function iv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function pa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function sv(e){return e.kind==="word"&&e.text===","}function ga(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function av(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function lv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function cv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function uv(e){return"recurse".startsWith(e)}function dv(e){return e.length>=2&&"force".startsWith(e)}function mv(e){return e==="wi"||"whatif".startsWith(e)}function fv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function pv(e){return e.toLowerCase()}var En="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Bo="Unsupported heredoc syntax",yr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",jd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var gv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),hv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),yv=new Set(["-o","--output","--query","--subscription"]),Cv=new Set;function Vd(e){if(e==="aws")return gv;if(e==="gcloud")return hv;if(e==="az")return yv;return Cv}var bv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Sv=new Set;function Kd(e){if(e==="git")return Ee;if(e==="docker")return bv;return Sv}function it(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=me(e);for(let o of t){if(!xv(n,o.command))continue;if(o.match){if(vv(n,e,o.match))return qd(o);continue}if(!Rv(n,e,o.subcommand))continue;if(_v(e,new Set(o.block_args),r))return qd(o)}return null}function qd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function vv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return Ev(r,n.command_path,Vd(e))}function Ev(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function xv(e,t){return e===O(t)}function Rv(e,t,n){if(!n)return!0;return Yd(t,1,n,Kd(e))}function Yd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&wv(e,i,n,r))return!0;continue}return s===n}return!1}function wv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Yd(e,t+2,n,r)}function _v(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var Av=new Set(["-e","--source"]),Pv=new Set(["-F","-v","--assign","--field-separator"]),Zd=new Set(["-f","--file"]),Tv=new Set(["print","printf","return"]),Xd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Iv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Jd(e,t,n){let r=!1;for(let o of kv(e)){let i=Ov(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",Iv):null}function ya(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&Av.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(Pv.has(a)||Zd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Zd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function br(e){return ya(e).sources}function kv(e){return br(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Ov(e,t){we(t,e);let n=e.includes("system")?Ca(e,t):null,r=Mv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Ca(e,t){we(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Uo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Qd(e,i+1);continue}if(s==="/"&&em(e,i)){i=tm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,Cr(e[a-1])||Cr(e[i]))continue;let l=$o(e,i);if(e[l]!=="(")continue;l=$o(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=Uo(e,l,c);if(!d){r=!0,o=!0;continue}if(l=$o(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Mv(e,t){we(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let f=Uo(e,i,d);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(d==="#"){i=Qd(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&em(e,i)){let f=tm(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+`;function pr(e,t){if(St(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!la(e.get("TMPDIR")??"",t)}function Bt(e,t){if(e.has("TMPDIR"))return la(e.get("TMPDIR")??"",t);let n=ca(e,t);if(n===void 0)return!0;return la(n,t)}function ca(e,t){return Dd(e,t,"TMPDIR")}function la(e,t){if(!e)return!1;if(IS(e))return!1;return Sn(e,t)}function St(e,t){let n=Dd(e,t,"IFS");return n!==void 0&&n!==""&&n!==PS}function Sn(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Md(t).some((r)=>vn(n,r))}function Fo(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Md(t).some((r)=>Go(r)===Go(n))}var kd=new WeakMap;function Md(e){let t=kd.get(e);if(t)return t;let n=TS(e);return kd.set(e,n),n}function TS(e){let t=AS.map((r)=>Wo(r,e.paths)??Od(r)),n=Wo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&kS(n))return[...t,n];return t}function IS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Dd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function kS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Wo(e,t){try{let n=Od(e);if(!wS(n))return n;let r=_S(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Td(i,o[s]??"");if(t.entryKind(a)==="missing")return Td(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function vn(e,t){let n=Go(e),r=Go(t);if(n===r)return!0;let o=r.endsWith(Id)?r:`${r}${Id}`;return n.startsWith(o)}function Go(e){return process.platform==="win32"?e.toLowerCase():e}var DS=process.platform==="win32",Nd=64,NS=16384;function gr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function hr(e){let t=wu(e,Nd,Nd,NS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:LS(e)}}function LS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>WS(e.raw,n.span.start-e.span.start))}function WS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function vt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Se();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:US(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function ze(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&jS(e))return{kind:"outside_anchored_cwd"};let o=!r&&Gd(e,t.posixShell);if(et(e))return{kind:"outside_anchored_cwd"};if(ma(e,r))return{kind:"root_or_home_target"};if(FS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&zt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(zS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(HS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&YS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>ZS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(XS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(GS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function GS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(zo(r)||r.startsWith("~"))return!1;if(fa(r))return!1;if(Fd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return Sn($t(t.resolvedCwd,r),t.environment)}function Wd(e,t,n={}){let{containmentTarget:r,...o}=n;if(ze(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if($S(i))return!1;if(Fo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Fd(r??i,s,t.environment.paths,t.budget))}function ma(e,t=!1){let n=e.trim(),r=Ld.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function FS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=zo(o)?o:t.resolvedCwd?$t(t.resolvedCwd,o):null;if(!i)return!1;let s=he(L(i,t.environment.paths,t.budget));if(s===MS(s).root)return!0;return s===he(L(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=OS(e);if(DS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function zS(e,t,n,r,o,i,s,a){let l=e.trim();if(fa(l))return!1;if(!r&&Sn(l,a))return!0;return(t||i&&s)&&n&&!o&&BS(l,n)}function BS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Gd(e.slice(n.length+1),t)})}function $S(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Ld.normalize(`/${t[1]??""}`)==="/"}function fa(e){return e.split(/[\\/]+/).includes("..")}function US(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Yn(o.trim(),t);if(!zo(i))return[];try{let s=L(i,n,r);if(Zn(s,L(t,n,r)))return[];return[he(s)]}catch{return[]}})}function HS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(fa(r))return!1;let o=n?r:Yn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=zo(o)?o:i?$t(i,o):null;if(!s)return!1;try{let a=he(L(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(da)?l:`${l}${da}`))}catch{return!1}}function jS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Gd(e,t=!1){return e.includes("$")||e.includes("`")||VS(e)||t&&KS(e)}function VS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function KS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&qS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function qS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function YS(e,t,n,r){try{return he(L(e,n,r))===he(L(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function ZS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(L($t(t,e),n,r))===he(L(o,n,r))}catch{try{return he($t(t,e))===he(o)}catch{return!1}}}function XS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ua(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ua($t(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ua($t(a,e),t,i,s)}catch{return!1}}function ua(e,t,n,r){try{return zd(L(e,n,r),L(t,n,r))}catch{return!1}}function Fd(e,t,n,r){if(!t)return!1;try{return zd(L(t,n,r),L(e,n,r))}catch{return!0}}function zd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${da}`)||n===r}var JS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Bd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",QS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",$d="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Ud="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",ev="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",tv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",nv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Ud},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:ke},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:$d},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:ev},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Bd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:QS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Bd}};function Hd(e,t,n,r=vt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return rv(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function rv(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=iv(o),s=o[i];if(!s||!JS.has(pv(s.text)))return null;let a=ov(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",tv);for(let l of a.targets)if(!et(l.text)&&ma(ga(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Ud);for(let l of a.targets)if(n.resolvedCwd&&zt(ga(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",ke);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",$d);for(let l of a.targets){let c=gr(ze(ga(l.text),n),n,r,nv);if(c)return c}return null}function ov(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(sv(l))continue;if(s){t.push(pa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=lv(l.text);if(!c){t.push(pa(l)),i=i||l.dynamic;continue}if(cv(c.name)){let d=c.value?av(c.value,l):e[++a];if(d?.kind==="word"){t.push(pa(d)),i=i||d.dynamic;continue}i=!0;continue}if(uv(c.name)){n=!0;continue}if(dv(c.name)){r=!0;continue}if(mv(c.name))o=fv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function iv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function pa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function sv(e){return e.kind==="word"&&e.text===","}function ga(e){let t=e.replace(/\\/g,"/"),n=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function av(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function lv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function cv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function uv(e){return"recurse".startsWith(e)}function dv(e){return e.length>=2&&"force".startsWith(e)}function mv(e){return e==="wi"||"whatif".startsWith(e)}function fv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function pv(e){return e.toLowerCase()}var En="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Bo="Unsupported heredoc syntax",yr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",jd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var gv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),hv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),yv=new Set(["-o","--output","--query","--subscription"]),Cv=new Set;function Vd(e){if(e==="aws")return gv;if(e==="gcloud")return hv;if(e==="az")return yv;return Cv}var bv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Sv=new Set;function Kd(e){if(e==="git")return Ee;if(e==="docker")return bv;return Sv}function it(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=me(e);for(let o of t){if(!xv(n,o.command))continue;if(o.match){if(vv(n,e,o.match))return qd(o);continue}if(!Rv(n,e,o.subcommand))continue;if(_v(e,new Set(o.block_args),r))return qd(o)}return null}function qd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function vv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return Ev(r,n.command_path,Vd(e))}function Ev(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function xv(e,t){return e===O(t)}function Rv(e,t,n){if(!n)return!0;return Yd(t,1,n,Kd(e))}function Yd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&wv(e,i,n,r))return!0;continue}return s===n}return!1}function wv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Yd(e,t+2,n,r)}function _v(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var Av=new Set(["-e","--source"]),Pv=new Set(["-F","-v","--assign","--field-separator"]),Zd=new Set(["-f","--file"]),Tv=new Set(["print","printf","return"]),Xd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Iv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Jd(e,t,n){let r=!1;for(let o of kv(e)){let i=Ov(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",Iv):null}function ya(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&Av.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(Pv.has(a)||Zd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Zd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function br(e){return ya(e).sources}function kv(e){return br(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Ov(e,t){we(t,e);let n=e.includes("system")?Ca(e,t):null,r=Mv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Ca(e,t){we(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Uo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Qd(e,i+1);continue}if(s==="/"&&em(e,i)){i=tm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,Cr(e[a-1])||Cr(e[i]))continue;let l=$o(e,i);if(e[l]!=="(")continue;l=$o(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=Uo(e,l,c);if(!d){r=!0,o=!0;continue}if(l=$o(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Mv(e,t){we(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let f=Uo(e,i,d);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(d==="#"){i=Qd(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&em(e,i)){let f=tm(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
 {}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ha(e,i,"print")||ha(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,u=$o(e,m);if(ha(e,u,"getline")){o=!0;let f=Lv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Gv(s,a)){o=!0;let f=Nv(e,u);if(!f){r=!0,c=m,i=m;continue}if(!Dv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function Cr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function $o(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Dv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
 }#`.includes(r)}function Uo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Wv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function Nv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Uo(e,t,n)}function Lv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Wv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
 `,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ha(e,t,n){return e.startsWith(n,t)&&!Cr(e[t-1])&&!Cr(e[t+n.length])}function Gv(e,t){return t!==null&&t>=e}function Qd(e,t){let n=e.indexOf(`
@@ -45,5 +45,5 @@ var Ei="CC Safety Net could not analyze the command because it exceeds safe anal
 `).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function L_(e,t,n,r,o,i){let s=ut(e);if(s.length===0||je(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Kt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,ol]:l.map((m)=>m.split(c).join(ol));return Ci(d,t,n,r,o,i).some((m)=>m.target.includes(ol))}function W_(e){let t=ut(e);if(t.length===0)return null;let n=je(t[0]??"").toLowerCase();if(!mr(n))return null;return G_(n,t.slice(1))?n:null}function G_(e,t){let n=ml(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(hp.has(o)||Sp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(A_.get(n)?.has(o))r++;continue}return!1}return!0}function ml(e){return/^python\d/.test(e)?"python":e}function F_(e){let t=[];for(let n of e){if(Ep(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var lp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function z_(e,t){if(!t||!lp.test(e))return e;return`~${e.replace(lp,"").replace(/\\/g,"/")}`}function Xe(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function B_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Xe("jq",i))}return e.flatMap((r,o)=>o===t?[]:Xe("jq",r))}function $_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...p_.has(r)?al("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),g_):al("git",e.slice(n),h_)];if(t.push(...Xe("git",r)),!Ee.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Xe("git",o)),n++}return t}function al(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Xe(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Xe(e,i))}return r}function U_(e){return e.flatMap((t,n)=>{let r=j_(t);if(r!==null)return cp(r.flag,r.value);let o=H_(e[n-1]);return o===null?[]:cp(o,t)})}function cp(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return il(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return il(t.slice(n+1))}return t.startsWith("@")?il(t.slice(1)):[]}function H_(e){if(e===void 0)return null;if(gp.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function j_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return gp.has(r)?{flag:r,value:e.slice(n+1)}:null}function il(e){return e===""||e==="-"?[]:[e]}function V_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!i_.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((f)=>s_.has(f)),m=d===-1?c:c.slice(0,d),u=Ci(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...u.filter((f)=>f!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,g)=>{if(!l_.has(f))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function K_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(hp.has(c)||Sp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...hi(e,m,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...hi(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Sp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return d_.get(t[t.length-1]??"")?.has(ml(e))??!1}function q_(e,t,n,r,o,i){if(!e.includes("system"))return[];return Ca(e)?.commands.flatMap((s)=>On(t.getShellSyntax(s),t,n,r,o,i))??[]}function Y_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function Z_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(fl),...e.match(sl)??[]]}function hi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=J_(t,X_(e));if(l.kind==="unmaskable")return Z_(t).map(a);let c=l.masked.match(op)!==null||l.literals.some((g)=>ip.test(l.masked.slice(0,g.start))),d=l.masked.match(w_)!==null||l.literals.some((g)=>__.test(l.masked.slice(0,g.start))),m=r.inlineLiteralsPresumedData===!0&&!ur.has(e),u=m&&!(nA(l.masked)||c||d)?[]:l.literals,f=m?Array.from(l.masked.matchAll(op),(g)=>{let h=g.index+g[0].length;return{start:h,end:Xs(l.masked,h)}}):[],p=!m||f.some((g)=>Js(l.masked,g.start))?l.literals:l.literals.filter((g)=>ip.test(l.masked.slice(0,g.start))||f.some((h)=>g.start>=h.start&&g.start<h.end));return[...u.map((g)=>g.text).filter((g)=>g!=="").map(a),...u.flatMap((g)=>fl(g.text)).map(a),...m?[]:l.literals.flatMap((g)=>g.text.match(sl)??[]).map(a),...c?p.flatMap((g)=>ul(g.text,n,r,o,i,s)??[a(g.text)]):[],...d?l.literals.flatMap((g)=>hi(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
 `:y),n,r,o,i,s)):[],...(l.masked.match(sl)??[]).map(a)]}function X_(e){let t=ml(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function J_(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(x_.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&tA(e,o))return{kind:"unmaskable"};let a=t==="python"?Q_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,d=eA(e,c,l);if(d===null)return{kind:"unmaskable"};let m=e.slice(c,d);if(/[fF]/.test(a)&&m.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&R_.test(m))return{kind:"unmaskable"};r.push({start:c,text:m});for(let u=o;u<d+l.length;u++)n[u]=" ";o=d+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function Q_(e,t){return E_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function eA(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
 `||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function tA(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function nA(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(c_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>u_.has(i)))continue;if(o.length>1)return!0;if(rA(e,r)===".")return!0;if(oA(e,r+n.length)==="(")return!0}return!1}function rA(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function oA(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function iA(e,t,n,r,o,i){return uA(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...On(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...sA(a,r)?aA(a,r).map((l)=>({target:l,cwd:o})):[]]})}function sA(e,t){let n=Mo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||je(ot(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ot(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function aA(e,t){return Mo(e).flatMap((n)=>n.kind==="word"?[ot(n.text,t)]:n.kind==="redirection"&&n.target?[ot(n.target,t)]:[]).flatMap(fl)}function fl(e){let t=cA(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||lA(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function lA(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function cA(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function uA(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Kn(o,n))continue;if(vp(e,r,n)){let i=dA(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=mA(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function dA(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Kn(i,n))continue;if(vp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function mA(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function vp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function fA(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let m=d[1]??"",u=d[2];if(m===y_)o=!0;if(b_.has(m))r=!0;if(u!==void 0){if(m===rp)t.push(u);continue}if(v_.has(m)){let f=e[l+1];if(m===rp&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),u="",f="";for(let g=0;g<m.length;g++){let h=m[g]??"";if(C_.has(h))r=!0;if(S_.has(h)){u=h,f=m.slice(g+1);break}}if(u==="")continue;if(f.length>0){if(u===np)t.push(f);continue}let p=e[l+1];if(u===np&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function ut(e){let t=e.findIndex((n)=>!Ep(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Ep(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var pA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),gA=".env.",hA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),yA=[".env.example.",".env.sample."];function CA(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function bA(e){return e.length>0&&!/\s/.test(e)}function ll(e,t,n,r){let o=xp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function xp(e,t,n,r){try{return kr(e,t,n,r)}catch(o){if(o instanceof N)throw o;return""}}var SA=new Set(["node_modules","__pycache__"]),vA=[["vendor","bundle"],["vendor","cache"]];function EA(e,t,n,r,o){if(CA(e))return null;let i=Ze(e,t,r,o);if(!i)return null;let s=U(i.split("/").pop()??""),a=U(i),l=()=>bA(s)||ll(e,t,r,o);if(hA.has(s)||yA.some((u)=>s.startsWith(u)))return null;let c=U(PA(e,t,r,o));for(let u of ms){let f=`~/${u.suffixParts.join("/")}`;if((dp(a,f)||dp(c,f))&&ct(u.id,n))return u.id}let d=xA(i,t,n,r,o);if(d)return d;if(pA.has(s))return null;for(let u of ds)if(s===u.basename&&ct(u.id,n))return u.id;if(s.startsWith(gA)&&ct(Zr.id,n)&&l())return Zr.id;for(let u of fs)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let f=s.slice(u.prefix.length)[0];if((f==="-"||f==="_")&&ct(u.id,n)&&l())return u.id}for(let u of ps)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&ct(u.id,n))return u.id}if(_A(a))return null;if(!s.includes(".")&&qn.pattern.test(s)&&ct(qn.id,n))return qn.id;let m=AA(s,n);if(m)return m;return null}function xA(e,t,n,r,o){return Xr.find((i)=>{if(!ct(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return F(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=U(e).split("/");return F(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Ir(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return F(e,Ze("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return F(e,s,["auth.json",".credentials.json"])||Tr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=U(e).split("/").at(-1)??"";return F(e,s,["config.toml"])||a.endsWith(".config.toml")&&F(e,s,[a])}case"secret.cli.gemini":return F(e,ue(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=U(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ue(V(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return F(e,ue(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Ir(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>F(e,Ze(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return F(e,s,["config.json"])||Tr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return F(e,V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return F(e,s,["server.token"])||Tr(e,s,["credentials"])||Tr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=U(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||F(e,V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||F(e,V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ue(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=U(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return F(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&F(e,s,[a])||c.some((d)=>Ir(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ue(V(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(U(e).split("/").at(-1)??"")||F(e,s,["config.json"])||(c?.trim()?Ir(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>F(e,Ze(d,t,r,o),l))}case"secret.cli.pi":return F(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return F(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ze("~",t,r,o);return[ue(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ue(s,".local","share","amp")].some((l)=>F(e,l,["secrets.json"]))||Tr(e,ue(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ue(Ze("~",t,r,o),".config","amp")],l=U(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>F(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Ir(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ue(V(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return F(e,Ze("~/.cursor",t,r,o),["auth.json"])||F(e,s,["auth.json"])||U(e).split("/").at(-1)==="mcp-auth.json"&&Jt(U(e),U(a))}case"secret.cli.cursor.config":{let s=U(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return F(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=U(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||F(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||F(e,Ze("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var up=new WeakMap;function V(e,t,n,r,o){let i=up.get(o)??new Map;up.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ze(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function F(e,t,n){return n.some((r)=>Rp(e,ue(t,r)))}function Tr(e,t,n){return n.some((r)=>Jt(U(e),U(ue(t,r))))}function Ir(e,t,n,r,o){return Rp(e,Ze(t,n,r,o))}function Rp(e,t){return U(e)===U(t)}function ue(e,...t){return He([e,...t].filter(Boolean).join("/"))}function RA(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(kr(e,t,o,i));return n.some((a)=>Jt(s,U(kr(a,r,o,i))))}function wA(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(kr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?He(L(ve(a),o.paths,i)):"",c=U(l),d=o.env.get("CC_SAFETY_NET_HOME"),m=U(d?He(L(yi(ve(d)),o.paths,i)):l&&He(L(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Jt(s,m))return!1;return n.some((u)=>{let f=bs(u);if(f&&mp.basename(s)!==U(f.name))return!1;let p=U(kr(f?.root??u,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return Jt(s,p)&&!(f&&s===p)})}function _A(e){let t=e.split("/");return t.some((n)=>SA.has(n))||vA.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function AA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of gs)if(r===o.extension&&ct(o.id,t))return o.id;for(let o of hs)if(o.pattern.test(r)&&ct(o.id,t))return o.id;return null}function U(e){return e.toLowerCase()}function ct(e,t){return!t?.disabledRules?.includes(e)}function Ze(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i)return"";if(!o)return i;let s=gl(i,o),a=gi(s)?s:He(yi(t,s)),l=He(L(a,n.paths,r));if(!Jt(l,o)){if(gi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function dp(e,t){return e===t||e.startsWith(`${t}/`)}function PA(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i||!o)return"";let s=gl(i,o),a=mp.normalize(gi(s)?s:He(yi(t,s))),l=He(ve(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&Jt(c(a),c(u)));if(d===void 0)return"";let m=a.slice(d.length);return m?`~${m}`:"~"}function kr(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i)return"";let s=o?gl(i,o):i;return He(L(gi(s)?s:yi(t,s),n.paths,r))}function pl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?He(L(ve(r),t.paths,n)):"",i=He(ve(TA(ot(e,t))));return{home:o,normalized:i}}function TA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return n_(e)}catch{return e}}function gl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ue(t,e.slice(2));return e}function IA(e){if(process.platform==="win32")return!0;return t_.parse(e).root.length>1}function He(e){let t=e.trim(),n=(t.includes("\\")&&IA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function je(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Qt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var kA={findPolicyMutation:Qf,findGitMetadataMutation:wd,resolveGitMetadata:MA,loadPolicySnapshot:mu,findSensitiveTarget:yp,analyzeCommand:Hf,getModes:zi},OA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function wp(e,t){let n={...kA,...t.dependencies},r=LA(e),o=Or(e)?e.command:r,i=_t("policy-protection",o,()=>fr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(Or(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Ve,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:jd,intent:"stop_and_explain"}};let l=Se(),c=_t("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),d=_t("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(d){let C=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Jf,intent:"hard_stop",evidence:{command:C,segment:d.target}}}}let m=_t("policy-protection",o,()=>qf(i,t.environment,l));if(m){let C=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Kf,intent:"hard_stop",evidence:{command:C,segment:m.target}}}}let u=_t("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let C=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:ke,intent:"hard_stop",evidence:{command:C,segment:u.target}}}}let f=_t("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...DA(f)},y=p.secretProtection.enabled===!1?null:_t("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:Or(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let C=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:fp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:C,segment:y.target}}}}if(!Or(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...hl("command-validation",o),...h};let b=_t("command-analysis",o,()=>jf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},NA(i),i.store),e.command,t.trace));if(b.decision){let C=!g.strict&&(b.decision.ruleId==="raw-text.dangerous-command"||b.decision.reason===yr&&!OA.test(b.decision.evidence?.segment??"")&&Te(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in b?{errorCode:b.errorCode}:{},decision:C?{...b.decision,unverifiedByStandardMode:!0}:b.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function MA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function DA(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function NA(e){return ge(e,"declared-command")?.program}function LA(e){try{return zn(e.input)}catch(t){let n=Or(e)?e.command:void 0;throw new Qt("policy-protection",hl("policy-protection",t instanceof Qe?void 0:n,t),t)}}function _t(e,t,n){try{return n()}catch(r){throw new Qt(e,hl(e,r instanceof Qe?void 0:t,r),r)}}function hl(e,t,n){let r=n instanceof N||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?Ei:Ln,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Or(e){return e.route.kind==="command"}import{appendFileSync as YA,mkdirSync as ZA}from"fs";import{isAbsolute as XA,join as bl}from"path";import{lstatSync as Ap,readdirSync as WA,readFileSync as GA,rmdirSync as FA,statSync as Pp,unlinkSync as zA,utimesSync as BA,writeFileSync as $A}from"fs";import{join as Mr}from"path";function _p(e,t={}){return so(ln(e,t),e.home).policy.audit.retention_days}var Cl=86400000,UA=".last-prune",HA=/^\d{4}-\d{2}$/,jA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Tp=(e)=>Math.floor(e/Cl);function kp(e,t,n=()=>new Date){try{let r=n().getTime();if(!Pp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Mr(t,UA),i=Pp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Tp(i)===Tp(r))return;let s=r-_p(e)*Cl,a=new Date(r).toISOString().slice(0,7);for(let l of yl(t)){if(l.isDirectory()){VA(Mr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))KA(Mr(t,l.name),s)}$A(o,"",{mode:384}),BA(o,r/1000,r/1000)}catch{}}function VA(e,t,n){for(let r of yl(e)){if(!r.isDirectory()||!HA.test(r.name))continue;let o=Mr(e,r.name);for(let i of yl(o)){if(!i.isFile())continue;let s=jA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+Cl;if(!Number.isFinite(a)||a>=t)continue;Op(Mr(o,i.name))}if(r.name!==n)Ip(o)}Ip(e)}function KA(e,t){try{let n=Ap(e);if(n.mtimeMs>=t)return;let r=GA(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(qA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Ap(e).mtimeMs!==n.mtimeMs)return;Op(e)}catch{}}function qA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function yl(e){try{return WA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Op(e){try{zA(e)}catch{}}function Ip(e){try{FA(e)}catch{}}var JA="2.4.15",QA=1e4,eP=2000,tP=256,nP=32768;function rP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function oP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Sl(e,t,n,r,o,i,s={}){let a=rP(t);if(!a)return;let l=sP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=bi(dt(n),s.failureStage?Number.POSITIVE_INFINITY:QA),m=bi(dt(r),eP),u=s.toolName?bi(dt(s.toolName),tP):void 0,f=i===null?void 0:bi(dt(i),nP),p=bl(l,oP(f?.value??null),c.slice(0,7));ZA(p,{recursive:!0,mode:448});let g=bl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??$i)(),v:JA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:m.value,...d.truncated||m.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};YA(g,`${JSON.stringify(h)}
+`).filter((o)=>o.trim()).map(qA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Ap(e).mtimeMs!==n.mtimeMs)return;Op(e)}catch{}}function qA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function yl(e){try{return WA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Op(e){try{zA(e)}catch{}}function Ip(e){try{FA(e)}catch{}}var JA="2.5.0",QA=1e4,eP=2000,tP=256,nP=32768;function rP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function oP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Sl(e,t,n,r,o,i,s={}){let a=rP(t);if(!a)return;let l=sP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=bi(dt(n),s.failureStage?Number.POSITIVE_INFINITY:QA),m=bi(dt(r),eP),u=s.toolName?bi(dt(s.toolName),tP):void 0,f=i===null?void 0:bi(dt(i),nP),p=bl(l,oP(f?.value??null),c.slice(0,7));ZA(p,{recursive:!0,mode:448});let g=bl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??$i)(),v:JA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:m.value,...d.truncated||m.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};YA(g,`${JSON.stringify(h)}
 `,{encoding:"utf-8",mode:384}),kp(e,l,s.now)}catch{}}function bi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function iP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&XA(n)?n:null}function sP(e){let t=iP(e);return t?bl(t,".cc-safety-net","logs"):null}function Dp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Mp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Mp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Mp(e){return"command"in e?e.command??"":""}function Np(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Sl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Lp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Sl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Gp(e,t,n){try{let r=wp(t,{environment:e,...n.guard});return Wp(e,t,r,n),r}catch(r){if(!(r instanceof Qt))throw r;throw Wp(e,t,r.evaluation,n,!(r.cause instanceof Qe),{stage:r.stage,errorCode:aP(r.cause)}),r}}function Wp(e,t,n,r,o=!0,i){Np(e,Dp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function aP(e){if(e instanceof N)return K[e.kind].errorCode;if(e instanceof Qe)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}function en(e,t={}){return{malformed:!0,denial:Wn(t),cwd:e}}function vl(e,t){return{malformed:!0,denial:xi(e,t),cwd:e.cwd}}function Fp(e,t={}){return(n,r)=>{try{return lP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Wn())}}}function lP(e,t,n,r){let o=rc();if(n.cancelled?.(t))return n.block(Wn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Lp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let d=Rl(l,{includeEvidence:c});return d?n.block(d):n.allow};try{let l=Gp(o,i,{guard:{auditAllowed:oc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Qt))throw l;if(It(ee.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${_l(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var cP={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>dP(e,t,n),getSessionId:(e)=>pP(e),allow:{action:"allow"},block:(e)=>gP(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},zp=uP();function uP(e={}){return Fp(cP,e)}function dP(e,t,n){if(!e||typeof e!=="object")return en(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return en(null);if(!r.input||typeof r.input!=="object")return en(null,{toolName:r.tool});let o=mP(t);if(!o)return en(null,{toolName:r.tool});let i=Yl(".",[o],n);if(!i)return vl({directory:"session",problem:"unusable",cwd:o},{toolName:r.tool});let s=fP(t,e);if(!s.ok)return en(i,{toolName:r.tool});if(!s.command)return nn(r.tool,r.input,{kind:Ai(r.tool)},{configCwd:i,executionCwd:i},null);if(typeof s.command.command!=="string"||s.command.command.trim()==="")return en(i,{toolName:r.tool});let a=typeof s.command.dir==="string"?s.command.dir:".",l=Zl(a,i,n);if(!l)return vl({directory:"requested",problem:"unusable",cwd:a},{command:s.command.command,toolName:r.tool});return nn(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:i,executionCwd:l},s.command.command)}function mP(e){let t=e.system.workspaceRoot;if(!t)return;try{let n=e.helpers.filePathFromURI(t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function fP(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function pP(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function gP(e){return{action:"reject-and-continue",message:wl(e)}}function hP(e){e.on("tool.call",(t)=>zp(t,e))}export{hP as default};

package/dist/api.js

@@ -1 +1 @@
-import{A,c,ce,d,p,B}from"./chunks/index-gj6afr0n.js";import{isAbsolute as o,resolve as n}from"node:path";function w(e){if(typeof e!=="object"||e===null)throw TypeError("checkCommand requires an input object with command and cwd");if(typeof e.command!=="string"||e.command.trim()==="")throw TypeError("command must be a non-empty string");if(typeof e.cwd!=="string"||e.cwd.trim()===""||!o(e.cwd))throw TypeError("cwd must be an absolute directory path");let r=n(e.cwd);if(!ce(r))return{kind:"deny",reason:A({directory:"requested",problem:"unusable",cwd:r}).reason};return a(t(d("library-api",{command:e.command},{kind:"command",shell:"auto"},{configCwd:r,executionCwd:r},e.command)))}function t(e){try{return B(e,{environment:c()}).decision}catch(r){if(!(r instanceof p))throw r;return r.evaluation.decision}}function a(e){if(e.kind==="allow")return{kind:"allow"};return{kind:"deny",reason:e.reason,...e.ruleId===void 0?{}:{ruleId:e.ruleId}}}export{w as checkCommand};
+import{O,c,de,l,p,V}from"./chunks/index-8cqwk53d.js";import{isAbsolute as o,resolve as n}from"node:path";function w(e){if(typeof e!=="object"||e===null)throw TypeError("checkCommand requires an input object with command and cwd");if(typeof e.command!=="string"||e.command.trim()==="")throw TypeError("command must be a non-empty string");if(typeof e.cwd!=="string"||e.cwd.trim()===""||!o(e.cwd))throw TypeError("cwd must be an absolute directory path");let r=n(e.cwd);if(!de(r))return{kind:"deny",reason:O({directory:"requested",problem:"unusable",cwd:r}).reason};return a(t(l("library-api",{command:e.command},{kind:"command",shell:"auto"},{configCwd:r,executionCwd:r},e.command)))}function t(e){try{return V(e,{environment:c()}).decision}catch(r){if(!(r instanceof p))throw r;return r.evaluation.decision}}function a(e){if(e.kind==="allow")return{kind:"allow"};return{kind:"deny",reason:e.reason,...e.ruleId===void 0?{}:{ruleId:e.ruleId}}}export{w as checkCommand};