cc-safety-net 2.4.15 → 2.5.0

package/dist/openclaw/cc-safety-net/index.js

@@ -1,5 +1,5 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.4.15
+// version: 2.5.0
 var Rl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Ei="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Ve="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Nn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var vi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Dn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},K=Object.freeze({realpathAttempts:{cap:16384,...vi},processedCandidateBytes:{cap:4194304,...vi},pathEnvironmentExpansion:{cap:64,...vi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Dn},trackedHeredocFiles:{cap:64,...Dn},controlFlowStates:{cap:64,...Dn},wrapperPeelIterations:{cap:20,...Dn},derivedCommandShape:Dn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(K[e].reason);this.kind=e}}function Se(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>K[t].cap)throw new N(t)}}}var Bp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function dt(e){return $p(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function $p(e){return Bp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Up={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Hp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Up[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
 `)}function wl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Ln(e={}){return{reason:Nn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var jp={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative"}}};function xi(e,t={}){return{...jp[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function _l(e){return Hp({...e,redact:dt})}function Al(e){return dt(e instanceof Error?e.message:String(e))}import{isAbsolute as Oi,relative as bg,resolve as ql,sep as Sg}from"node:path";import{basename as Il,dirname as Vp,isAbsolute as Kp,join as qp,normalize as Yp,resolve as Pl}from"node:path";var Zp=256,Dr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function ve(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Qe(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ai(e,t){return Ri(e,0,t)}function Ri(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=wi(e,o+2),a=Xp(e,o,t);if(a===null){if(Dr.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Jp(l,t,n),o=a+1;continue}let i=wi(e,o+1);if(!i){r+="$",o++;continue}r+=_i(i,n)??`$${i}`,o+=i.length+1}return r}function Xp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>K.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Jp(e,t,n){let r=e.slice(2,-1),o=wi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return _i(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Dr.has(o))throw new N("pathEnvironmentExpansion");return e}if(!Dr.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=_i(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Ri(i.slice(s.length),t+1,n);return l?Ri(i.slice(s.length),t+1,n):""}function wi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function _i(e,t){if(!Dr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function L(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){kl(n,i);let s=t.realpath(i);if(s!==null)return Tl(n,e,s,o);let a=Vp(i);if(a===i||o.length>=Zp)return Tl(n,e,i,o);o.push(Il(i)),i=a}}function Tl(e,t,n,r){let o=r.length===0?n:qp(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Qp(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;kl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function kl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function le(e,t,n,r){let o=Ml(e,t,n);if(!o)return"";return L(o,n.paths,r).replace(/\\/g,"/")}function Ol(e,t,n,r,o){let i=Ml(e,t,n);if(!i)return null;if(o(Il(i)))return L(i,n.paths,r).replace(/\\/g,"/");let s=Qp(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Ml(e,t,n){let r=n.home,o=Ai(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Pl(r,o.slice(2)):o,s=ve(i);return Yp(Kp(s)?s:Pl(t,s))}import{types as eg}from"node:util";var tg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),ng=new Set(["command","diff","input","patch","patchtext"]),Dl=new TextEncoder,rg=new TextDecoder,og=/\s/,ig=64;class et extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Wn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function sg(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Lr(e){return tg.has(sg(e))}function Fn(e){if(!e||typeof e!=="object")return;jl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ke();return}if(t.get||t.set)Ke();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Fl(e,t){return zl(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function zl(e,t,n,r,o){let i=Hl(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>zl(l,t,i.array?n:t.has(Bl(a)),r,o+1));return r.ancestors.delete(i.object),s}function Bl(e){return e.replace(/-/g,"_").toLowerCase()}function $l(e){return Ul(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(lg)}function Ul(e,t,n,r){let o=Hl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Ul(a,o.array?t:ng.has(Bl(s)),n,r+1));return n.ancestors.delete(o.object),i}function ag(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Wn.maxDepth||t.nodes>Wn.maxNodes)Ke();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Wn.maxStringBytes||t.stringBytes>Wn.maxAggregateStringBytes)Ke()}function Hl(e,t,n){if(ag(e,t,n),!e||typeof e!=="object")return null;let r=jl(e);if(t.ancestors.has(e))Ke();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Wn.maxKeys)Ke();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ke();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function jl(e){if(eg.isProxy(e))Ke();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ke();return t}function Ke(){throw new et}function lg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=cg(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Pi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Pi(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...Ii(Nr(c.slice(4),!0),Nr(u.slice(4),!0))),l++;continue}if(!r)t.push(...Pi(c))}return t}function cg(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Pi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Gl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Gl(n[1]);if(e.startsWith("diff --git "))return ug(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Wl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Wl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return yg(i[1]);return[]}function ug(e){let t=dg(e);if(t.length===2&&t[0]&&t[1])return Ii(t[0],t[1]);let n=fg(e);return n?Ii(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function dg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(It(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!It(e[n]))n++;t.push(e.slice(i,n));continue}let o=Vl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(It(e[n]))n++;return n===e.length?t:[]}function fg(e){let t=0;while(t<e.length&&It(e[t]))t++;let n=e.length;while(n>t&&It(e[n-1]))n--;let r=0,o=t;while(o<n){if(!It(e[o])){o++;continue}let i=o;while(o<n&&It(e[o]))o++;if(i===t||o===n)continue;if(r++,r>ig)Ke();if(mg(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function mg(e,t,n,r,o){if(Ti(e,t,n,r,o))return!0;let i=Nl(e,"/",t,n),s=Nl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ti(e,t,i,r,s))return!1;return Ti(e,i+1,n,s+1,o)}function Ti(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Nl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function It(e){return e!==void 0&&og.test(e)}function Vl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:rg.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Dl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Dl.encode(pg(s[0]??""))),o+=2}return null}function pg(e){return{a:"\x07",b:"\b",f:"\f",n:`
@@ -28,7 +28,7 @@ var Rl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive c
 `||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=Wu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Wu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function NC(e,t){if(S(e,t)!=="\\"||S(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function Wu(e,t,n){if(Gu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Gu(e,t,n,"force"))return{recursive:!1,force:!0};if(S(e,t)!=="-"||S(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=S(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Gu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(S(e,t+i+2)!==r[i])return!1;return!0}function LC(e){let t=!1;for(let n=0;n<Z(e);n++){if(oe(S(e,n))){t=!1;continue}if(tt(e,n,"dd")){t=!0,n++;continue}if(!t||!tt(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!H(S(e,r))&&S(e,r)!=="'"&&S(e,r)!=='"')return!0}return!1}function WC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=S(e,o);if(o===Z(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=FC(e,o);if(s>=0){if(GC(e,s))return!0;let a=s,l=!1;while(H(S(e,a)))l||=S(e,a)===`
 `,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(S(e,o-1)))&&(!S(e,o+2)||H(S(e,o+2))||oe(S(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&nt(e,o+11)||Vs(e,o,"recursive"),r||=j(e,o,"--force")&&nt(e,o+7)||Vs(e,o,"force"),n&&r)return!0;o++}return!1}function Vs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=S(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&nt(e,t+r+2)}function GC(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(H(S(e,n)))n++;let i=n;while(n<Z(e)&&!H(S(e,n)))n++;if(S(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=Fu(e,i,"recursive"),a=Fu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,S(e,i+1)==="-")continue;let l=zC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Fu(e,t,n){return j(e,t,`--${n}`)&&nt(e,t+n.length+2)||Vs(e,t,n)}function FC(e,t){if(t>0&&Gt(S(e,t-1)))return-1;let n=t;if(S(e,n)==="\\")n++;if(S(e,n)!=="r")return-1;if(n++,S(e,n)==="\\")n++;if(S(e,n)!=="m"||!H(S(e,n+1)))return-1;return n+1}function zC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(S(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=S(e,c)??"",f=(u==="r"||u==="f")&&nt(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&f,s||=u==="f"&&f,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&f,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function zu(e,t,n){return rr(e,"reset",pn,!0,(r)=>S(e,r)==="-"&&gn(e,r,t,n)?!0:r)}function BC(e){return rr(e,"clean",pn,!0,(t)=>{if(S(e,t)!=="-")return t;if(gn(e,t,"--fo","rce"))return!0;let n=nr(e,t,pn);for(let r=t+1;r<n;r++)if(S(e,r)==="f")return!0;return n-1})}function Eo(e,t,n){if(!tt(e,t,"git"))return null;let r=t+3;if(!H(S(e,r)))return{commandEnd:-1,next:r};while(H(S(e,r)))r++;while(r<Z(e)){if(oe(S(e,r)))return{commandEnd:-1,next:r};let o=nr(e,r,oe);if(tt(e,r,n))return{commandEnd:r+n.length,next:o};if(S(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=$C(e,r,o);r=o;while(H(S(e,r)))r++;if(i)return{commandEnd:tt(e,r,n)?r+n.length:-1,next:nr(e,r,oe)};if(!s)continue;if(r>=Z(e)||oe(S(e,r)))return{commandEnd:-1,next:r};r=nr(e,r,oe);while(H(S(e,r)))r++}return{commandEnd:-1,next:r}}function $C(e,t,n){for(let r of Ee)if(n-t===r.length&&j(e,t,r))return!0;return!1}function UC(e){return Bu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function HC(e){return rr(e,"push",pn,!0,(t)=>{if(S(e,t)!=="-")return t;if(S(e,t+1)==="f"&&!Gt(S(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Uu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function jC(e){return rr(e,"push",oe,!1,(t)=>{if(H(S(e,t))&&S(e,t+1)==="+"&&t+2<Z(e)&&!oe(S(e,t+2))&&!H(S(e,t+2)))return!0;if(S(e,t)===":"&&S(e,t+1)==="+")return!0;return t})}function VC(e){return rr(e,"push",oe,!1,(t)=>{if(S(e,t)==="-"&&gn(e,t,"--de","lete"))return!0;if(H(S(e,t))&&S(e,t+1)===":"&&t+2<Z(e)&&!H(S(e,t+2))&&!oe(S(e,t+2)))return!0;return t})}function KC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||oe(S(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Eo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||S(e,o)!=="-")continue;let i=nr(e,o,oe),s=qC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function qC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(S(e,i)!=="-")continue;if(gn(e,i,"--de","lete"))r=!0;if(gn(e,i,"--fo","rce"))o=!0;if(S(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&YC(S(e,s))){let u=S(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!nt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function YC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function ZC(e){return Bu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Bu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=S(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&S(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Eo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(S(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(gn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(S(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&nt(e,r+1))return!0;if(pn(o))i.outerActive=!1}return!1}function rr(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=S(e,s),l=n(a);if(!i&&!l){let c=Eo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(S(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(S(e,u)))i=!1;s=c}if(l)i=!1}return!1}function XC(e){let t=!1;for(let n=0;n<Z(e);n++){if(js(S(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Eo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&S(e,n)==="-"&&S(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function $u(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=S(e,r),i=t?js(o):oe(o);if(n&&H(o)&&S(e,r+1)==="-"&&tt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(tt(e,r,"find"))n=!0,r+=3}return!1}function nr(e,t,n){let r=t;while(r<Z(e)&&!H(S(e,r))&&!n(S(e,r)))r++;return r}function Uu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&S(e,o)===r[i];i++)o++;return nt(e,o)?o:-1}function gn(e,t,n,r){return Uu(e,t,n,r)>=0}function Te(e,t){tr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)we(t,a);if((s.regex?.test(a)??!1)||s.scan&&vo(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var JC=/^[A-Za-z_][A-Za-z0-9_]*=/;function ju(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;tr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Vu(t.nodes,r,i)}function Vu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Vu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return QC(r,t,n)})}function QC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!JC.test(o.text));return e.words.every((o,i)=>o===t||Hu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Hu(o.target.raw,n.anchored,!0)))}function Hu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as eb,resolve as Ku}from"node:path";function or(e,t,n,r){let o=eb(e)?Ku(e):t?Ku(t,e):void 0;if(!o)return;try{return L(o,n,r)}catch{return o}}function qu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var hn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",ir="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",qs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),tb=new Set(["-p","--print"]),nb=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),rb=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),ob=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),ib=new Map([["python",new Set(["m"])]]),sb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),ab=new Set(["always","default","never"]),lb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),cb=/\\\r?\n/g,ub=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Yu(e){return Ro(e).code}function xo(e){return Ro(e).sources}function Zu(e){return ub.get(Zs(e))??[]}function Ro(e){let t=Zs(e[0]??"");if(!qs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Le(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Le(t,n,r,o,i,s);if(t==="node"&&tb.has(s)){let f=e[i+1];if(f===void 0)return Le(t,n,r,o);if(f.startsWith("-"))continue;n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),i++;continue}if(fb(t,s)){let f=e[i+1];if(f===void 0)return Le(t,n,r,o);if(n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),t==="python")return Le(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(mb(t)&&a){let f=a[1]??"";n.push({tokenIndex:i,value:f}),r.push({tokenIndex:i,kind:"inline-code",value:f});continue}if(t==="node"){let f=db(s);if(f){if(f.attached){if(o&&=f.value!=="",f.value!=="")r.push({tokenIndex:i,kind:"module-file",value:f.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Le(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Le(t,n,r,o);if(sb.get(t)?.has(s)){let f=e[i+1];if(f===void 0||f.startsWith("-")&&!(t==="ruby"&&lb.has(s))||t==="python"&&!ab.has(f))return Le(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let f=1;f<s.length;f++){let d=s[f];if(d===void 0)break;if(ib.get(t)?.has(d)){let m=s.slice(f+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return Le(t,n,r,o)}if(nb.get(t)?.has(d)){l=s.slice(f+1)||e[i+1],c=f+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&d==="r"){let m=s.slice(f+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let m=s.slice(f+1);if(!m){if(o=!1,f+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(rb.get(t)?.has(d)){if(f+1===s.length)i++;break}if(ob.get(t)?.has(d)&&f+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Le(t,n,r,o);if(c)i++}return Le(t,n,r,o,void 0,void 0,!0)}function Le(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
 `))||null,sources:r?c:[],optionsOpen:r&&s}}function db(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ys(e,t){return Zs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Zs(e){let t=T(e).toLowerCase();return Hr.test(t)?"python":t}function fb(e,t){return qs.get(e)?.has(t)??!1}function mb(e){return qs.get(e)?.has("--eval")??!1}function sr(e,t,n=!1){let r=hb(e,t);if(!Ks(r,t))return!1;we(t,r);let o=gb(r);if(Ks(o,t))return!0;if(we(t,o),!Xu.test(o))return!1;return!n||pb(r,t)}function pb(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let u=e.startsWith(c.repeat(3),l)?c.repeat(3):c,f=l+u.length,d=f;while(d<e.length&&!e.startsWith(u,d))d+=e[d]==="\\"?2:1;if(d>=e.length)return!0;o.push({start:f,text:e.slice(f,d)}),r.fill(" ",l,d+u.length),l=d+u.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>Xu.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:Xs(i,c)}});if(s.some((l)=>Js(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),u=s.some((f)=>l.start>=f.start&&l.start<f.end);return(c||u)&&Ks(l.text,t)})}function Xs(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Js(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Xu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function gb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Ks(e,t){if(So(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(we(t,e),r.test(e))return!0;if(So(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(we(t,e),r.test(e))return!0;if(So(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(we(t,e),n.some((o)=>vo(o,r))))}function hb(e,t){return we(t,e),e.replace(cb,"")}import{lstatSync as mS,readdirSync as pS}from"node:fs";import{basename as gS,isAbsolute as Ed,join as hS,relative as xd}from"node:path";import{isAbsolute as od,parse as _b}from"node:path";import{dirname as yb,isAbsolute as Cb,parse as bb,sep as Sb}from"node:path";function ht(e,t,n){if(Qe(t))throw Error("Unsupported Windows namespace path");let r=Cb(t)?bb(t).root:"",o=r||e;for(let i of Eb(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=yb(o);continue}let s=vb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function vb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${Sb}${t}`}function Eb(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Qs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],xb=new Set(Qs),Rb=1024,Ju=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Qu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),wb=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function wo(e){return xb.has(e)}function ea(e){return wo(e)||Ju.has(e)||Qu.has(e)||Hn(e)}function rt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function ed(e,t){let n=rt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=Rb?{state:"valid",count:r}:{state:"invalid"}}function _o(e,t,n){let o=e.match(wb)?.[1];if(!o||!ea(o))return null;let i=e.indexOf("=");return{name:o,value:`${rt(o,t,n)??""}${e.slice(i+1)}`}}function td(e){return rd(e,Qu)}function nd(e){return rd(e,Ju)}function rd(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var sd=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ie(e){if(!sd.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Ao(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Ie(_(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function ad(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Ft(e,t,n,r){if(!ad(yn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let f=0;f<K.wrapperPeelIterations.cap;f++){let d=id(i),m=Ao(i);for(let[g,h]of m.envAssignments)s.set(g,h),a.set(g,h);if(i=m.words,i.length===0)break;while(i.length>0&&yn(i).includes("=")&&!Pb(i)){let g=Tb(yn(i),a,t.env)??_o(yn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=O(yn(i));if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=kb(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=Db(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=Nb(i);if(p==="builtin")i=i.slice(We(i,1)==="--"?2:1);if(id(i)===d)break}let u=Ao(i);for(let[f,d]of u.envAssignments)s.set(f,d),a.set(f,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:Ab(u.words,o)}}function Ab(e,t){return e.some((n)=>!t.has(n))}function id(e){return e.map(_).join(" ")}function yn(e){let t=e[0];return t?_(t):""}function We(e,t){let n=e[t];return n?_(n):void 0}function Pb(e){return sd.test(yn(e))}function Tb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var Ib=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function kb(e,t,n){let r=1,o=n;while(r<e.length){let i=We(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=We(e,r+1);o=s?ar(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=ar(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=ar(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(Ib.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Ob=new Set(["-i","-0","--null"]),Mb=new Set(["-u","--unset","-C","--chdir","-P"]);function Db(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=We(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let f of n.keys())o.set(f,"");o.set("TMPDIR",""),a++;continue}if(Ob.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let f=We(e,a+1);if(f!==void 0)o.set(f,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:We(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(Mb.has(c)){if(c==="-C"||c==="--chdir"){let f=We(e,a+1);s=f?ar(s,f,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let f=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=ar(s,f,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Ie(c))break;while(a<e.length){let f=Ie(We(e,a)??"");if(!f)break;o.set(f.name,f.value),a++}if(We(e,a)==="--")a++;return l(a)}return l(a)}function ar(e,t,n){if(t==="")return null;if(!e&&!od(t))return null;let r=od(t)?_b(t).root:n.realpath(e??"/");if(r===null)return null;try{return ht(r,t,n)}catch{return null}}function Nb(e){if(We(e,1)==="-v")return[...q(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=We(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var Lb=/['"\\$`{}#]/;function Po(e,t){if(e.some((r)=>Lb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function yt(e,t,n){return To(e,t,n).tokens}function Wb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ct(e,t,n,r=0){let o=To(e,t,n),i=(o.envSplitValues??[]).flatMap(Wb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ct(s,t,n,r+1)}function To(e,t,n,r){if(!ad(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Ft(q(e),t,n,r);return{tokens:o.words.map(_),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var oa=Symbol("adopt-as-operand"),Gb=new Set(["env","sudo","command","builtin"]),Fb=new Set(["&&","||","|&","|","&",";"]),zb=new Set(["<<","<<<",">|"]),Bb=new Set(["|","|&"]),$b=/[*@#?$!_-]/,Ub=/^\w+(?::\w+)*/,Hb=Object.freeze([]),lr=Object.freeze({kind:"scope",edge:"enter"}),cr=Object.freeze({kind:"scope",edge:"exit"}),jb=Object.freeze([]),Vb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),ur=new Set(["bash","sh","zsh","dash","ksh"]),Kb=256,fd=new WeakMap;function md(e,t){let n=t.status==="complete"?new Set(ra(t)):new Set,r=Zb(e,n);if(Vr(r))return Io("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=zt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Io("structural-limit",r,t);if(o.invalid)return Io("invalid",r,t);let s=Io("complete",r,t,o.assignmentFallbacks);return fd.set(s,Object.freeze(i)),s}function Oo(e,t,n,r,o){let i=o.word??((f)=>f),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let f of pd(e)){if(f.kind==="scope"){if(f.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let m=u.pop();if(m===void 0)throw Error("scope exit without a matching enter");s=m.state,a=m.segment,l=m.shellWords,c=m.pipeProducer;continue}if(f.kind==="operator"){if(!f.boundary)continue;let d=o.segment(a,s,c,f.operator,l);if(d)return d;s=qb(a,s,n,r),c=a.length>0&&Bb.has(f.operator)?a:null,a=[],l=new Set;continue}if(f.kind==="redirection"){if(f.fd!==void 0)l.add(a.length-1);if(f.target===void 0)continue;let d=o.redirection({operator:f.operator,role:f.role,targetOrder:f.targetOrder,target:f.target,...f.body===void 0?{}:{body:f.body,consumer:f.consumer}},s);if(d===oa){l.add(a.length),a.push(i(f.target));continue}if(d)return d;continue}a.push(i(f.text))}return o.segment(a,s,c,null,l)}function Mo(e){return pd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function dr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function qb(e,t,n,r){let o=dr(e)?new Map([...t.variables,...Yb(e,t.variables)]):t.variables,i=yt([...e],n),s=T(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:le(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function Yb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function pd(e){return fd.get(e)??Hb}function Zb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Io(e,t,n,r=jb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function zt(e,t){return e.nodes.flatMap((n,r)=>Xb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function Xb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Ge(nS(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Ge(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[ko("{"),...zt(e.body,a),...s?[ko("}")]:[]]:[lr,Ge("("),...zt(e.body,a),...s?[Ge(")")]:[],cr]}]}let o=sS(e,r.functions);if(o){if(r.depth>=gt.maxDepth||++r.flags.expansions>Kb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...ld(e,r),ko(";"),...zt(o,{...r,depth:r.depth+1}),ko(";")]},...cd(e,t,n,r)]}return[{start:e.span.start,events:ld(e,r)},...cd(e,t,n,r)]}function ld(e,t){return[...e.words.map((n)=>({start:n.span.start,events:hd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:Jb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function Jb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?hd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ia(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:rS(r),targetOrder:zb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:Cd(t)}:{}}),...s===void 0?o:o.slice(1)]}function cd(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ia(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Ge(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...gd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?Qb(t,n,r):[]]}function Qb(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:gd(n.source.slice(r.span.end,e.span.end),n)}]}function gd(e,t){if(t.depth>=gt.maxDepth)return t.flags.limited=!0,[];let n=Ne(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=zt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function hd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Ge("glob"):s!==""||e.quoted&&o.length===0?ia(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of ta(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(Ge(m));continue}s+=m.text,a||=m.glob}continue}let u=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=ta(m,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=u?zt(u,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(lr,...p,cr);continue}let f=u?zt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(lr,...f,cr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Ge("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),lr,...f,...c.raw.endsWith(")")?[Ge(")")]:[],cr);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>Ge("(")),...d===1?[lr]:[],...f,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>Ge(")")):[],...d===1?[cr]:[])}return l(),o}function ta(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=ud(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=ud(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function ud(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=tS(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return eS(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&$b.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?Ub:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function eS(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=ta(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function tS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function nS(e){return/^[\r\n]+$/.test(e)?";":e}function Ge(e){return Object.freeze({kind:"operator",operator:e,boundary:Fb.has(e)})}function ko(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ia(e){return Object.freeze({kind:"word",text:e})}function rS(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function fr(e){return Vb.has(e)||/^python\d/.test(e)}var oS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function yd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=oS.get(e)?.has(n)??!1;return yd(e,t.slice(r?2:1))}function na(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return na(e.slice(1));if(!Gb.has(t))return[...e];return na(yd(t,e.slice(1)))}function Cd(e){let t=Jn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return na(n<0?[]:e.words.slice(n).map((r)=>r.text))}function iS(e){let t=Cd(e)[0];if(t===void 0)return!1;let n=T(t).toLowerCase();return fr(n)&&!ur.has(n)}function ra(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ra(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>ra(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(iS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!lS(t))return r;return[...r,...o]})}function sS(e,t){let n=Jn(e);return n===void 0?void 0:t.get(n)}function bt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function aS(e){if(bt(e.words[0],"git"))return bt(e.words[1],"commit");if(!bt(e.words[0],"gh")||!bt(e.words[2],"create"))return!1;return bt(e.words[1],"pr")||bt(e.words[1],"issue")}function lS(e){return(bt(e.words[0],"cat")||bt(e.words[0],"tee")||aS(e))&&!e.words.some(dd)&&!e.redirections.some((n)=>dd(n.target))}function dd(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var bd=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Sd=new Set([...bd,"glob"]),cS=new Set([...Sd,"pattern"]);class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function mr(e){let t=uS(),n=Fn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:dS(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ot(e,t){if(!e.includes("$"))return e;return Ai(e,t)}function uS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Ne(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let f={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,f),f}let l=e.get(i);if(l)return l;let c=md(i,a);return e.set(i,c),c},getCommandProgram:r}}function dS(e){let t=e.route.kind==="grep"?Sd:e.route.kind==="glob"?cS:bd;return[...Fl(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?$l(e.input):[]]}var fS=new Set(["-S","--suffix"]);function Cn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Oo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function Do(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&fS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var ke="Git metadata and hooks are protected. Ask the user before modifying them.";function Rd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Lr(e.invocation.toolName))return null;let a=e.paths.find((l)=>vd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=Cn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>ES(a,l,t,n,r),isRedirectionTarget:(a,l)=>vd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Bt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Lo(le(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(sa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(f)=>c?No(f,l):yS(f,l);if(n.markerFiles.some(u))return!0;return r&&aa(n).some(u)}if(sa(a,n))return!0;return r&&aa(n).some((c)=>No(c,a))}function yS(e,t){let n=xd(t,e);if(n===""||n.startsWith("..")||Ed(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function CS(e,t,n,r,o){return Bt(e,t,n,!0,r,o)}function bS(e,t,n,r,o){if(!n)return!1;return sa(Lo(le(e,t,r,o)),n)}function vd(e,t,n,r,o,i){let s=Lo(le(e,t,r,o));return i.includes(s)||_d(s,n)}function wd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>No(i,Lo(le(s,t,r,o)))))}function sa(e,t){return t.entries.includes(e)||t.directories.includes(e)||_d(e,t)}function _d(e,t){return t.hooksDirectories.some((n)=>No(e,n))}var SS=50000;function Ad(e,t){let n=[...new Set(aa(e))];if(n.some((o)=>t(gS(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=vS(o);if(!i)return!0;if(r+=i.length,r>SS)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>hS(o,s.name)))}return!1}function vS(e){try{let t=mS(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return pS(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function aa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function No(e,t){let n=xd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!Ed(n)}function Lo(e){return process.platform==="win32"?e.toLowerCase():e}function ES(e,t,n,r,o){if(dr(e))return null;let i=Ct([...e],r);if(T(i[0]??"").toLowerCase()!=="mv")return null;let s=Do(i.slice(1)),a=s.sources.find((l)=>CS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&bS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as zo,normalize as IS,parse as kS,posix as Nd,resolve as Ut,sep as da}from"node:path";import{isAbsolute as xS,join as Pd,normalize as kd,parse as RS,sep as Td}from"node:path";var wS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],_S=` 	
-`;function pr(e,t){if(St(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!la(e.get("TMPDIR")??"",t)}function $t(e,t){if(e.has("TMPDIR"))return la(e.get("TMPDIR")??"",t);let n=ca(e,t);if(n===void 0)return!0;return la(n,t)}function ca(e,t){return Md(e,t,"TMPDIR")}function la(e,t){if(!e)return!1;if(PS(e))return!1;return bn(e,t)}function St(e,t){let n=Md(e,t,"IFS");return n!==void 0&&n!==""&&n!==_S}function bn(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Od(t).some((r)=>Sn(n,r))}function Fo(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Od(t).some((r)=>Go(r)===Go(n))}var Id=new WeakMap;function Od(e){let t=Id.get(e);if(t)return t;let n=AS(e);return Id.set(e,n),n}function AS(e){let t=wS.map((r)=>Wo(r,e.paths)??kd(r)),n=Wo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&TS(n))return[...t,n];return t}function PS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Md(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function TS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Wo(e,t){try{let n=kd(e);if(!xS(n))return n;let r=RS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Pd(i,o[s]??"");if(t.entryKind(a)==="missing")return Pd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Sn(e,t){let n=Go(e),r=Go(t);if(n===r)return!0;let o=r.endsWith(Td)?r:`${r}${Td}`;return n.startsWith(o)}function Go(e){return process.platform==="win32"?e.toLowerCase():e}var OS=process.platform==="win32",Dd=64,MS=16384;function gr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function hr(e){let t=Ru(e,Dd,Dd,MS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:DS(e)}}function DS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>NS(e.raw,n.span.start-e.span.start))}function NS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function vt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Se();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:BS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function ze(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&US(e))return{kind:"outside_anchored_cwd"};let o=!r&&Wd(e,t.posixShell);if(Qe(e))return{kind:"outside_anchored_cwd"};if(fa(e,r))return{kind:"root_or_home_target"};if(WS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Bt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(GS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if($S(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&KS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>qS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(YS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(LS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function LS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(zo(r)||r.startsWith("~"))return!1;if(ma(r))return!1;if(Gd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return bn(Ut(t.resolvedCwd,r),t.environment)}function Ld(e,t,n={}){let{containmentTarget:r,...o}=n;if(ze(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(zS(i))return!1;if(Fo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Gd(r??i,s,t.environment.paths,t.budget))}function fa(e,t=!1){let n=e.trim(),r=Nd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function WS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=zo(o)?o:t.resolvedCwd?Ut(t.resolvedCwd,o):null;if(!i)return!1;let s=he(L(i,t.environment.paths,t.budget));if(s===kS(s).root)return!0;return s===he(L(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=IS(e);if(OS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function GS(e,t,n,r,o,i,s,a){let l=e.trim();if(ma(l))return!1;if(!r&&bn(l,a))return!0;return(t||i&&s)&&n&&!o&&FS(l,n)}function FS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Wd(e.slice(n.length+1),t)})}function zS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Nd.normalize(`/${t[1]??""}`)==="/"}function ma(e){return e.split(/[\\/]+/).includes("..")}function BS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Yn(o.trim(),t);if(!zo(i))return[];try{let s=L(i,n,r);if(Zn(s,L(t,n,r)))return[];return[he(s)]}catch{return[]}})}function $S(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(ma(r))return!1;let o=n?r:Yn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=zo(o)?o:i?Ut(i,o):null;if(!s)return!1;try{let a=he(L(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(da)?l:`${l}${da}`))}catch{return!1}}function US(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Wd(e,t=!1){return e.includes("$")||e.includes("`")||HS(e)||t&&jS(e)}function HS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function jS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&VS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function VS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function KS(e,t,n,r){try{return he(L(e,n,r))===he(L(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function qS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(L(Ut(t,e),n,r))===he(L(o,n,r))}catch{try{return he(Ut(t,e))===he(o)}catch{return!1}}}function YS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ua(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ua(Ut(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ua(Ut(a,e),t,i,s)}catch{return!1}}function ua(e,t,n,r){try{return Fd(L(e,n,r),L(t,n,r))}catch{return!1}}function Gd(e,t,n,r){if(!t)return!1;try{return Fd(L(t,n,r),L(e,n,r))}catch{return!0}}function Fd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${da}`)||n===r}var ZS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),zd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",XS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Bd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",$d="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",JS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",QS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",ev={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:$d},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:ke},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Bd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:JS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:zd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:XS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:zd}};function Ud(e,t,n,r=vt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return tv(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function tv(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=rv(o),s=o[i];if(!s||!ZS.has(fv(s.text)))return null;let a=nv(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",QS);for(let l of a.targets)if(!Qe(l.text)&&fa(ga(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",$d);for(let l of a.targets)if(n.resolvedCwd&&Bt(ga(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",ke);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",Bd);for(let l of a.targets){let c=gr(ze(ga(l.text),n),n,r,ev);if(c)return c}return null}function nv(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(ov(l))continue;if(s){t.push(pa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=sv(l.text);if(!c){t.push(pa(l)),i=i||l.dynamic;continue}if(av(c.name)){let u=c.value?iv(c.value,l):e[++a];if(u?.kind==="word"){t.push(pa(u)),i=i||u.dynamic;continue}i=!0;continue}if(lv(c.name)){n=!0;continue}if(cv(c.name)){r=!0;continue}if(uv(c.name))o=dv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function rv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function pa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function ov(e){return e.kind==="word"&&e.text===","}function ga(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function iv(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function sv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function av(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function lv(e){return"recurse".startsWith(e)}function cv(e){return e.length>=2&&"force".startsWith(e)}function uv(e){return e==="wi"||"whatif".startsWith(e)}function dv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function fv(e){return e.toLowerCase()}var vn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Bo="Unsupported heredoc syntax",yr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Hd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var mv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),pv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),gv=new Set(["-o","--output","--query","--subscription"]),hv=new Set;function jd(e){if(e==="aws")return mv;if(e==="gcloud")return pv;if(e==="az")return gv;return hv}var yv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Cv=new Set;function Vd(e){if(e==="git")return Ee;if(e==="docker")return yv;return Cv}function it(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=fe(e);for(let o of t){if(!vv(n,o.command))continue;if(o.match){if(bv(n,e,o.match))return Kd(o);continue}if(!Ev(n,e,o.subcommand))continue;if(Rv(e,new Set(o.block_args),r))return Kd(o)}return null}function Kd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function bv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return Sv(r,n.command_path,jd(e))}function Sv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function vv(e,t){return e===O(t)}function Ev(e,t,n){if(!n)return!0;return qd(t,1,n,Vd(e))}function qd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&xv(e,i,n,r))return!0;continue}return s===n}return!1}function xv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return qd(e,t+2,n,r)}function Rv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var wv=new Set(["-e","--source"]),_v=new Set(["-F","-v","--assign","--field-separator"]),Yd=new Set(["-f","--file"]),Av=new Set(["print","printf","return"]),Zd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Pv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Xd(e,t,n){let r=!1;for(let o of Tv(e)){let i=Iv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",Pv):null}function ya(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&wv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(_v.has(a)||Yd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Yd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function br(e){return ya(e).sources}function Tv(e){return br(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Iv(e,t){we(t,e);let n=e.includes("system")?Ca(e,t):null,r=kv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Ca(e,t){we(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Uo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Jd(e,i+1);continue}if(s==="/"&&Qd(e,i)){i=ef(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,Cr(e[a-1])||Cr(e[i]))continue;let l=$o(e,i);if(e[l]!=="(")continue;l=$o(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Uo(e,l,c);if(!u){r=!0,o=!0;continue}if(l=$o(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function kv(e,t){we(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let m=Uo(e,i,u);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(u==="#"){i=Jd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Qd(e,i)){let m=ef(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
+`;function pr(e,t){if(St(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!la(e.get("TMPDIR")??"",t)}function $t(e,t){if(e.has("TMPDIR"))return la(e.get("TMPDIR")??"",t);let n=ca(e,t);if(n===void 0)return!0;return la(n,t)}function ca(e,t){return Md(e,t,"TMPDIR")}function la(e,t){if(!e)return!1;if(PS(e))return!1;return bn(e,t)}function St(e,t){let n=Md(e,t,"IFS");return n!==void 0&&n!==""&&n!==_S}function bn(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Od(t).some((r)=>Sn(n,r))}function Fo(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Od(t).some((r)=>Go(r)===Go(n))}var Id=new WeakMap;function Od(e){let t=Id.get(e);if(t)return t;let n=AS(e);return Id.set(e,n),n}function AS(e){let t=wS.map((r)=>Wo(r,e.paths)??kd(r)),n=Wo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&TS(n))return[...t,n];return t}function PS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Md(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function TS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Wo(e,t){try{let n=kd(e);if(!xS(n))return n;let r=RS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Pd(i,o[s]??"");if(t.entryKind(a)==="missing")return Pd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Sn(e,t){let n=Go(e),r=Go(t);if(n===r)return!0;let o=r.endsWith(Td)?r:`${r}${Td}`;return n.startsWith(o)}function Go(e){return process.platform==="win32"?e.toLowerCase():e}var OS=process.platform==="win32",Dd=64,MS=16384;function gr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function hr(e){let t=Ru(e,Dd,Dd,MS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:DS(e)}}function DS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>NS(e.raw,n.span.start-e.span.start))}function NS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function vt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Se();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:BS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function ze(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&US(e))return{kind:"outside_anchored_cwd"};let o=!r&&Wd(e,t.posixShell);if(Qe(e))return{kind:"outside_anchored_cwd"};if(fa(e,r))return{kind:"root_or_home_target"};if(WS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Bt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(GS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if($S(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&KS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>qS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(YS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(LS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function LS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(zo(r)||r.startsWith("~"))return!1;if(ma(r))return!1;if(Gd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return bn(Ut(t.resolvedCwd,r),t.environment)}function Ld(e,t,n={}){let{containmentTarget:r,...o}=n;if(ze(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(zS(i))return!1;if(Fo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Gd(r??i,s,t.environment.paths,t.budget))}function fa(e,t=!1){let n=e.trim(),r=Nd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function WS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=zo(o)?o:t.resolvedCwd?Ut(t.resolvedCwd,o):null;if(!i)return!1;let s=he(L(i,t.environment.paths,t.budget));if(s===kS(s).root)return!0;return s===he(L(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=IS(e);if(OS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function GS(e,t,n,r,o,i,s,a){let l=e.trim();if(ma(l))return!1;if(!r&&bn(l,a))return!0;return(t||i&&s)&&n&&!o&&FS(l,n)}function FS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Wd(e.slice(n.length+1),t)})}function zS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Nd.normalize(`/${t[1]??""}`)==="/"}function ma(e){return e.split(/[\\/]+/).includes("..")}function BS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Yn(o.trim(),t);if(!zo(i))return[];try{let s=L(i,n,r);if(Zn(s,L(t,n,r)))return[];return[he(s)]}catch{return[]}})}function $S(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(ma(r))return!1;let o=n?r:Yn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=zo(o)?o:i?Ut(i,o):null;if(!s)return!1;try{let a=he(L(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(da)?l:`${l}${da}`))}catch{return!1}}function US(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Wd(e,t=!1){return e.includes("$")||e.includes("`")||HS(e)||t&&jS(e)}function HS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function jS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&VS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function VS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function KS(e,t,n,r){try{return he(L(e,n,r))===he(L(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function qS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(L(Ut(t,e),n,r))===he(L(o,n,r))}catch{try{return he(Ut(t,e))===he(o)}catch{return!1}}}function YS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ua(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ua(Ut(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ua(Ut(a,e),t,i,s)}catch{return!1}}function ua(e,t,n,r){try{return Fd(L(e,n,r),L(t,n,r))}catch{return!1}}function Gd(e,t,n,r){if(!t)return!1;try{return Fd(L(t,n,r),L(e,n,r))}catch{return!0}}function Fd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${da}`)||n===r}var ZS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),zd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",XS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Bd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",$d="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",JS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",QS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",ev={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:$d},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:ke},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Bd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:JS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:zd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:XS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:zd}};function Ud(e,t,n,r=vt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return tv(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function tv(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=rv(o),s=o[i];if(!s||!ZS.has(fv(s.text)))return null;let a=nv(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",QS);for(let l of a.targets)if(!Qe(l.text)&&fa(ga(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",$d);for(let l of a.targets)if(n.resolvedCwd&&Bt(ga(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",ke);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",Bd);for(let l of a.targets){let c=gr(ze(ga(l.text),n),n,r,ev);if(c)return c}return null}function nv(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(ov(l))continue;if(s){t.push(pa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=sv(l.text);if(!c){t.push(pa(l)),i=i||l.dynamic;continue}if(av(c.name)){let u=c.value?iv(c.value,l):e[++a];if(u?.kind==="word"){t.push(pa(u)),i=i||u.dynamic;continue}i=!0;continue}if(lv(c.name)){n=!0;continue}if(cv(c.name)){r=!0;continue}if(uv(c.name))o=dv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function rv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function pa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function ov(e){return e.kind==="word"&&e.text===","}function ga(e){let t=e.replace(/\\/g,"/"),n=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function iv(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function sv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function av(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function lv(e){return"recurse".startsWith(e)}function cv(e){return e.length>=2&&"force".startsWith(e)}function uv(e){return e==="wi"||"whatif".startsWith(e)}function dv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function fv(e){return e.toLowerCase()}var vn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Bo="Unsupported heredoc syntax",yr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Hd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var mv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),pv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),gv=new Set(["-o","--output","--query","--subscription"]),hv=new Set;function jd(e){if(e==="aws")return mv;if(e==="gcloud")return pv;if(e==="az")return gv;return hv}var yv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Cv=new Set;function Vd(e){if(e==="git")return Ee;if(e==="docker")return yv;return Cv}function it(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=fe(e);for(let o of t){if(!vv(n,o.command))continue;if(o.match){if(bv(n,e,o.match))return Kd(o);continue}if(!Ev(n,e,o.subcommand))continue;if(Rv(e,new Set(o.block_args),r))return Kd(o)}return null}function Kd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function bv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return Sv(r,n.command_path,jd(e))}function Sv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function vv(e,t){return e===O(t)}function Ev(e,t,n){if(!n)return!0;return qd(t,1,n,Vd(e))}function qd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&xv(e,i,n,r))return!0;continue}return s===n}return!1}function xv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return qd(e,t+2,n,r)}function Rv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var wv=new Set(["-e","--source"]),_v=new Set(["-F","-v","--assign","--field-separator"]),Yd=new Set(["-f","--file"]),Av=new Set(["print","printf","return"]),Zd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Pv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Xd(e,t,n){let r=!1;for(let o of Tv(e)){let i=Iv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",Pv):null}function ya(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&wv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(_v.has(a)||Yd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Yd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function br(e){return ya(e).sources}function Tv(e){return br(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Iv(e,t){we(t,e);let n=e.includes("system")?Ca(e,t):null,r=kv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Ca(e,t){we(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Uo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Jd(e,i+1);continue}if(s==="/"&&Qd(e,i)){i=ef(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,Cr(e[a-1])||Cr(e[i]))continue;let l=$o(e,i);if(e[l]!=="(")continue;l=$o(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Uo(e,l,c);if(!u){r=!0,o=!0;continue}if(l=$o(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function kv(e,t){we(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let m=Uo(e,i,u);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(u==="#"){i=Jd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Qd(e,i)){let m=ef(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
 {}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ha(e,i,"print")||ha(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let f=e[i+1]==="&"?i+2:i+1,d=$o(e,f);if(ha(e,d,"getline")){o=!0;let m=Dv(s,l,c);if(r||=m===null,m!==null)n.push(m);c=f,i=f;continue}if(Lv(s,a)){o=!0;let m=Mv(e,d);if(!m){r=!0,c=f,i=f;continue}if(!Ov(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=f,i++}if(!o)return null;return{dynamic:r,commands:n}}function Cr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function $o(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Ov(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
 }#`.includes(r)}function Uo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Nv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function Mv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Uo(e,t,n)}function Dv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Nv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
 `,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ha(e,t,n){return e.startsWith(n,t)&&!Cr(e[t-1])&&!Cr(e[t+n.length])}function Lv(e,t){return t!==null&&t>=e}function Jd(e,t){let n=e.indexOf(`
@@ -44,5 +44,5 @@ var Rl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive c
 `).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function D_(e,t,n,r,o,i){let s=ut(e);if(s.length===0||je(s[0]??"").toLowerCase()!=="xargs")return!1;let a=qt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,ol]:l.map((f)=>f.split(c).join(ol));return Ci(u,t,n,r,o,i).some((f)=>f.target.includes(ol))}function N_(e){let t=ut(e);if(t.length===0)return null;let n=je(t[0]??"").toLowerCase();if(!fr(n))return null;return L_(n,t.slice(1))?n:null}function L_(e,t){let n=fl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(gp.has(o)||bp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(w_.get(n)?.has(o))r++;continue}return!1}return!0}function fl(e){return/^python\d/.test(e)?"python":e}function W_(e){let t=[];for(let n of e){if(vp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var ap=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function G_(e,t){if(!t||!ap.test(e))return e;return`~${e.replace(ap,"").replace(/\\/g,"/")}`}function Xe(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function F_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Xe("jq",i))}return e.flatMap((r,o)=>o===t?[]:Xe("jq",r))}function z_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...f_.has(r)?al("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),m_):al("git",e.slice(n),p_)];if(t.push(...Xe("git",r)),!Ee.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Xe("git",o)),n++}return t}function al(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Xe(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Xe(e,i))}return r}function B_(e){return e.flatMap((t,n)=>{let r=U_(t);if(r!==null)return lp(r.flag,r.value);let o=$_(e[n-1]);return o===null?[]:lp(o,t)})}function lp(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return il(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return il(t.slice(n+1))}return t.startsWith("@")?il(t.slice(1)):[]}function $_(e){if(e===void 0)return null;if(pp.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function U_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return pp.has(r)?{flag:r,value:e.slice(n+1)}:null}function il(e){return e===""||e==="-"?[]:[e]}function H_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!r_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((m)=>o_.has(m)),f=u===-1?c:c.slice(0,u),d=Ci(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...d.filter((m)=>m!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,g)=>{if(!s_.has(m))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function j_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(gp.has(c)||bp(e,c)){let f=t[l+1];if(f!==void 0)a.push(...hi(e,f,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...hi(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function bp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return c_.get(t[t.length-1]??"")?.has(fl(e))??!1}function V_(e,t,n,r,o,i){if(!e.includes("system"))return[];return Ca(e)?.commands.flatMap((s)=>kn(t.getShellSyntax(s),t,n,r,o,i))??[]}function K_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function q_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(ml),...e.match(sl)??[]]}function hi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=Z_(t,Y_(e));if(l.kind==="unmaskable")return q_(t).map(a);let c=l.masked.match(rp)!==null||l.literals.some((g)=>op.test(l.masked.slice(0,g.start))),u=l.masked.match(x_)!==null||l.literals.some((g)=>R_.test(l.masked.slice(0,g.start))),f=r.inlineLiteralsPresumedData===!0&&!ur.has(e),d=f&&!(eA(l.masked)||c||u)?[]:l.literals,m=f?Array.from(l.masked.matchAll(rp),(g)=>{let h=g.index+g[0].length;return{start:h,end:Xs(l.masked,h)}}):[],p=!f||m.some((g)=>Js(l.masked,g.start))?l.literals:l.literals.filter((g)=>op.test(l.masked.slice(0,g.start))||m.some((h)=>g.start>=h.start&&g.start<h.end));return[...d.map((g)=>g.text).filter((g)=>g!=="").map(a),...d.flatMap((g)=>ml(g.text)).map(a),...f?[]:l.literals.flatMap((g)=>g.text.match(sl)??[]).map(a),...c?p.flatMap((g)=>ul(g.text,n,r,o,i,s)??[a(g.text)]):[],...u?l.literals.flatMap((g)=>hi(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
 `:y),n,r,o,i,s)):[],...(l.masked.match(sl)??[]).map(a)]}function Y_(e){let t=fl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function Z_(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(v_.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&Q_(e,o))return{kind:"unmaskable"};let a=t==="python"?X_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=J_(e,c,l);if(u===null)return{kind:"unmaskable"};let f=e.slice(c,u);if(/[fF]/.test(a)&&f.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&E_.test(f))return{kind:"unmaskable"};r.push({start:c,text:f});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function X_(e,t){return S_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function J_(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
 `||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function Q_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function eA(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(a_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>l_.has(i)))continue;if(o.length>1)return!0;if(tA(e,r)===".")return!0;if(nA(e,r+n.length)==="(")return!0}return!1}function tA(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function nA(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function rA(e,t,n,r,o,i){return lA(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...kn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...oA(a,r)?iA(a,r).map((l)=>({target:l,cwd:o})):[]]})}function oA(e,t){let n=Mo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||je(ot(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ot(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function iA(e,t){return Mo(e).flatMap((n)=>n.kind==="word"?[ot(n.text,t)]:n.kind==="redirection"&&n.target?[ot(n.target,t)]:[]).flatMap(ml)}function ml(e){let t=aA(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||sA(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function sA(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function aA(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function lA(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Kn(o,n))continue;if(Sp(e,r,n)){let i=cA(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=uA(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function cA(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Kn(i,n))continue;if(Sp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function uA(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Sp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function dA(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let f=u[1]??"",d=u[2];if(f===g_)o=!0;if(y_.has(f))r=!0;if(d!==void 0){if(f===np)t.push(d);continue}if(b_.has(f)){let m=e[l+1];if(f===np&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),d="",m="";for(let g=0;g<f.length;g++){let h=f[g]??"";if(h_.has(h))r=!0;if(C_.has(h)){d=h,m=f.slice(g+1);break}}if(d==="")continue;if(m.length>0){if(d===tp)t.push(m);continue}let p=e[l+1];if(d===tp&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function ut(e){let t=e.findIndex((n)=>!vp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function vp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var fA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),mA=".env.",pA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),gA=[".env.example.",".env.sample."];function hA(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function yA(e){return e.length>0&&!/\s/.test(e)}function ll(e,t,n,r){let o=Ep(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function Ep(e,t,n,r){try{return kr(e,t,n,r)}catch(o){if(o instanceof N)throw o;return""}}var CA=new Set(["node_modules","__pycache__"]),bA=[["vendor","bundle"],["vendor","cache"]];function SA(e,t,n,r,o){if(hA(e))return null;let i=Ze(e,t,r,o);if(!i)return null;let s=U(i.split("/").pop()??""),a=U(i),l=()=>yA(s)||ll(e,t,r,o);if(pA.has(s)||gA.some((d)=>s.startsWith(d)))return null;let c=U(_A(e,t,r,o));for(let d of fs){let m=`~/${d.suffixParts.join("/")}`;if((up(a,m)||up(c,m))&&ct(d.id,n))return d.id}let u=vA(i,t,n,r,o);if(u)return u;if(fA.has(s))return null;for(let d of ds)if(s===d.basename&&ct(d.id,n))return d.id;if(s.startsWith(mA)&&ct(Zr.id,n)&&l())return Zr.id;for(let d of ms)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let m=s.slice(d.prefix.length)[0];if((m==="-"||m==="_")&&ct(d.id,n)&&l())return d.id}for(let d of ps)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&ct(d.id,n))return d.id}if(RA(a))return null;if(!s.includes(".")&&qn.pattern.test(s)&&ct(qn.id,n))return qn.id;let f=wA(s,n);if(f)return f;return null}function vA(e,t,n,r,o){return Xr.find((i)=>{if(!ct(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return F(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=U(e).split("/");return F(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Ir(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return F(e,Ze("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return F(e,s,["auth.json",".credentials.json"])||Tr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=U(e).split("/").at(-1)??"";return F(e,s,["config.toml"])||a.endsWith(".config.toml")&&F(e,s,[a])}case"secret.cli.gemini":return F(e,ue(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=U(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ue(V(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return F(e,ue(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Ir(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>F(e,Ze(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return F(e,s,["config.json"])||Tr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return F(e,V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return F(e,s,["server.token"])||Tr(e,s,["credentials"])||Tr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=U(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||F(e,V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||F(e,V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ue(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=U(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return F(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&F(e,s,[a])||c.some((u)=>Ir(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ue(V(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(U(e).split("/").at(-1)??"")||F(e,s,["config.json"])||(c?.trim()?Ir(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>F(e,Ze(u,t,r,o),l))}case"secret.cli.pi":return F(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return F(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ze("~",t,r,o);return[ue(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ue(s,".local","share","amp")].some((l)=>F(e,l,["secrets.json"]))||Tr(e,ue(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ue(Ze("~",t,r,o),".config","amp")],l=U(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>F(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Ir(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ue(V(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return F(e,Ze("~/.cursor",t,r,o),["auth.json"])||F(e,s,["auth.json"])||U(e).split("/").at(-1)==="mcp-auth.json"&&Qt(U(e),U(a))}case"secret.cli.cursor.config":{let s=U(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return F(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=U(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||F(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||F(e,Ze("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var cp=new WeakMap;function V(e,t,n,r,o){let i=cp.get(o)??new Map;cp.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ze(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function F(e,t,n){return n.some((r)=>xp(e,ue(t,r)))}function Tr(e,t,n){return n.some((r)=>Qt(U(e),U(ue(t,r))))}function Ir(e,t,n,r,o){return xp(e,Ze(t,n,r,o))}function xp(e,t){return U(e)===U(t)}function ue(e,...t){return He([e,...t].filter(Boolean).join("/"))}function EA(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(kr(e,t,o,i));return n.some((a)=>Qt(s,U(kr(a,r,o,i))))}function xA(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(kr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?He(L(ve(a),o.paths,i)):"",c=U(l),u=o.env.get("CC_SAFETY_NET_HOME"),f=U(u?He(L(yi(ve(u)),o.paths,i)):l&&He(L(`${l}/.cc-safety-net`,o.paths,i)));if(f&&Qt(s,f))return!1;return n.some((d)=>{let m=bs(d);if(m&&dp.basename(s)!==U(m.name))return!1;let p=U(kr(m?.root??d,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return Qt(s,p)&&!(m&&s===p)})}function RA(e){let t=e.split("/");return t.some((n)=>CA.has(n))||bA.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function wA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of gs)if(r===o.extension&&ct(o.id,t))return o.id;for(let o of hs)if(o.pattern.test(r)&&ct(o.id,t))return o.id;return null}function U(e){return e.toLowerCase()}function ct(e,t){return!t?.disabledRules?.includes(e)}function Ze(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i)return"";if(!o)return i;let s=gl(i,o),a=gi(s)?s:He(yi(t,s)),l=He(L(a,n.paths,r));if(!Qt(l,o)){if(gi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function up(e,t){return e===t||e.startsWith(`${t}/`)}function _A(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i||!o)return"";let s=gl(i,o),a=dp.normalize(gi(s)?s:He(yi(t,s))),l=He(ve(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Qt(c(a),c(d)));if(u===void 0)return"";let f=a.slice(u.length);return f?`~${f}`:"~"}function kr(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i)return"";let s=o?gl(i,o):i;return He(L(gi(s)?s:yi(t,s),n.paths,r))}function pl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?He(L(ve(r),t.paths,n)):"",i=He(ve(AA(ot(e,t))));return{home:o,normalized:i}}function AA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return e_(e)}catch{return e}}function gl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ue(t,e.slice(2));return e}function PA(e){if(process.platform==="win32")return!0;return Qw.parse(e).root.length>1}function He(e){let t=e.trim(),n=(t.includes("\\")&&PA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Qt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function je(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class en extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var TA={findPolicyMutation:Jm,findGitMetadataMutation:Rd,resolveGitMetadata:kA,loadPolicySnapshot:du,findSensitiveTarget:hp,analyzeCommand:Um,getModes:zi},IA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function Rp(e,t){let n={...TA,...t.dependencies},r=DA(e),o=Or(e)?e.command:r,i=_t("policy-protection",o,()=>mr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(Or(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Ve,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Hd,intent:"stop_and_explain"}};let l=Se(),c=_t("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=_t("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let C=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Xm,intent:"hard_stop",evidence:{command:C,segment:u.target}}}}let f=_t("policy-protection",o,()=>Km(i,t.environment,l));if(f){let C=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Vm,intent:"hard_stop",evidence:{command:C,segment:f.target}}}}let d=_t("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let C=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:ke,intent:"hard_stop",evidence:{command:C,segment:d.target}}}}let m=_t("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...OA(m)},y=p.secretProtection.enabled===!1?null:_t("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:Or(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let C=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:fp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:C,segment:y.target}}}}if(!Or(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...hl("command-validation",o),...h};let b=_t("command-analysis",o,()=>Hm(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},MA(i),i.store),e.command,t.trace));if(b.decision){let C=!g.strict&&(b.decision.ruleId==="raw-text.dangerous-command"||b.decision.reason===yr&&!IA.test(b.decision.evidence?.segment??"")&&Te(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in b?{errorCode:b.errorCode}:{},decision:C?{...b.decision,unverifiedByStandardMode:!0}:b.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function kA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function OA(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function MA(e){return ge(e,"declared-command")?.program}function DA(e){try{return Fn(e.input)}catch(t){let n=Or(e)?e.command:void 0;throw new en("policy-protection",hl("policy-protection",t instanceof et?void 0:n,t),t)}}function _t(e,t,n){try{return n()}catch(r){throw new en(e,hl(e,r instanceof et?void 0:t,r),r)}}function hl(e,t,n){let r=n instanceof N||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?Ei:Nn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Or(e){return e.route.kind==="command"}import{appendFileSync as KA,mkdirSync as qA}from"node:fs";import{isAbsolute as YA,join as bl}from"node:path";import{lstatSync as _p,readdirSync as NA,readFileSync as LA,rmdirSync as WA,statSync as Ap,unlinkSync as GA,utimesSync as FA,writeFileSync as zA}from"node:fs";import{join as Mr}from"node:path";function wp(e,t={}){return so(an(e,t),e.home).policy.audit.retention_days}var Cl=86400000,BA=".last-prune",$A=/^\d{4}-\d{2}$/,UA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Pp=(e)=>Math.floor(e/Cl);function Ip(e,t,n=()=>new Date){try{let r=n().getTime();if(!Ap(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Mr(t,BA),i=Ap(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Pp(i)===Pp(r))return;let s=r-wp(e)*Cl,a=new Date(r).toISOString().slice(0,7);for(let l of yl(t)){if(l.isDirectory()){HA(Mr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))jA(Mr(t,l.name),s)}zA(o,"",{mode:384}),FA(o,r/1000,r/1000)}catch{}}function HA(e,t,n){for(let r of yl(e)){if(!r.isDirectory()||!$A.test(r.name))continue;let o=Mr(e,r.name);for(let i of yl(o)){if(!i.isFile())continue;let s=UA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+Cl;if(!Number.isFinite(a)||a>=t)continue;kp(Mr(o,i.name))}if(r.name!==n)Tp(o)}Tp(e)}function jA(e,t){try{let n=_p(e);if(n.mtimeMs>=t)return;let r=LA(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(VA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(_p(e).mtimeMs!==n.mtimeMs)return;kp(e)}catch{}}function VA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function yl(e){try{return NA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function kp(e){try{GA(e)}catch{}}function Tp(e){try{WA(e)}catch{}}var ZA="2.4.15",XA=1e4,JA=2000,QA=256,eP=32768;function tP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function nP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Sl(e,t,n,r,o,i,s={}){let a=tP(t);if(!a)return;let l=oP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=bi(dt(n),s.failureStage?Number.POSITIVE_INFINITY:XA),f=bi(dt(r),JA),d=s.toolName?bi(dt(s.toolName),QA):void 0,m=i===null?void 0:bi(dt(i),eP),p=bl(l,nP(m?.value??null),c.slice(0,7));qA(p,{recursive:!0,mode:448});let g=bl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??$i)(),v:ZA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};KA(g,`${JSON.stringify(h)}
+`).filter((o)=>o.trim()).map(VA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(_p(e).mtimeMs!==n.mtimeMs)return;kp(e)}catch{}}function VA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function yl(e){try{return NA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function kp(e){try{GA(e)}catch{}}function Tp(e){try{WA(e)}catch{}}var ZA="2.5.0",XA=1e4,JA=2000,QA=256,eP=32768;function tP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function nP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Sl(e,t,n,r,o,i,s={}){let a=tP(t);if(!a)return;let l=oP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=bi(dt(n),s.failureStage?Number.POSITIVE_INFINITY:XA),f=bi(dt(r),JA),d=s.toolName?bi(dt(s.toolName),QA):void 0,m=i===null?void 0:bi(dt(i),eP),p=bl(l,nP(m?.value??null),c.slice(0,7));qA(p,{recursive:!0,mode:448});let g=bl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??$i)(),v:ZA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};KA(g,`${JSON.stringify(h)}
 `,{encoding:"utf-8",mode:384}),Ip(e,l,s.now)}catch{}}function bi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function rP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&YA(n)?n:null}function oP(e){let t=rP(e);return t?bl(t,".cc-safety-net","logs"):null}function Mp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Op(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Op(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Op(e){return"command"in e?e.command??"":""}function Dp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Sl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Np(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Sl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Wp(e,t,n){try{let r=Rp(t,{environment:e,...n.guard});return Lp(e,t,r,n),r}catch(r){if(!(r instanceof en))throw r;throw Lp(e,t,r.evaluation,n,!(r.cause instanceof et),{stage:r.stage,errorCode:iP(r.cause)}),r}}function Lp(e,t,n,r,o=!0,i){Dp(e,Mp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function iP(e){if(e instanceof N)return K[e.kind].errorCode;if(e instanceof et)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}function At(e,t={}){return{malformed:!0,denial:Ln(t),cwd:e}}function vl(e,t){return{malformed:!0,denial:xi(e,t),cwd:e.cwd}}function Gp(e,t={}){return(n,r)=>{try{return sP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Ln())}}}function sP(e,t,n,r){let o=nc();if(n.cancelled?.(t))return n.block(Ln());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Np(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=wl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=Wp(o,i,{guard:{auditAllowed:rc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof en))throw l;if(kt(ee.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${Al(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var Fp="exec",aP=new Set(["auto","gateway"]);function zp(e){e.on("before_tool_call",lP(e),{matcher:[Fp],priority:50})}function lP(e,t={}){return Gp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>cP(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>dP(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function cP(e,t,n,r){if(!e||typeof e!=="object")return At(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return At(null);if(o!==Fp)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return At(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return At(null,{toolName:o});if(s.host!==void 0&&!aP.has(s.host))return At(null,{command:a,toolName:o});let l=uP(n,t.agentId);if(!l)return At(null,{command:a,toolName:o});let c=Mi(".",[l],r);if(!c)return vl({directory:"session",problem:"unusable",cwd:l},{command:a,toolName:o});let u=s.workdir;if(u!==void 0&&(typeof u!=="string"||u.trim()===""))return At(c,{command:a,toolName:o});let f=typeof u==="string"?u:".",d=Mi(f,[c],r);if(!d)return vl({directory:"requested",problem:Yl(f,c,r),cwd:f},{command:a,toolName:o});return zn(o,s,{kind:"command",shell:"auto"},{configCwd:c,executionCwd:d},a)}function uP(e,t){if(typeof t!=="string"||t.trim()==="")return;try{let n=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function dP(e){return{block:!0,blockReason:_l(e)}}var k1={...Rl,register:zp};export{k1 as default};

package/dist/openclaw/cc-safety-net/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "cc-safety-net",
   "name": "CC Safety Net",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
-  "version": "2.4.15",
+  "version": "2.5.0",
   "activation": {
     "onStartup": true
   },

package/dist/openclaw/cc-safety-net/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.4.15",
+  "version": "2.5.0",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
   "type": "module",
   "openclaw": {

package/dist/pi/index.js

@@ -1,5 +1,5 @@
-import{ye,P,A,be,Xe,c,o,xe,L,q,et,d,p}from"../chunks/index-gj6afr0n.js";import{ee}from"../chunks/index-pm924a1e.js";import{he,N}from"../chunks/index-96rww7g0.js";var E="cc-safety-net",x="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",b="Help me with CC Safety Net.";function f(e){e.registerCommand(E,{description:x,handler:async(n,l)=>{e.sendUserMessage(I(n),l.isIdle()?void 0:{deliverAs:"followUp"})}})}function I(e){return`${ee.slice(ee.indexOf("# CC Safety Net")).trimEnd()}
+import{J,_,ot,l}from"../chunks/index-8cqwk53d.js";import{ne}from"../chunks/index-1sddy8kp.js";import{L,ue,xe}from"../chunks/index-yya83mcj.js";import"../chunks/index-mrn9mahg.js";var C="cc-safety-net",u="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",p="Help me with CC Safety Net.";function d(o){o.registerCommand(C,{description:u,handler:async(n,t)=>{o.sendUserMessage(c(n),t.isIdle()?void 0:{deliverAs:"followUp"})}})}function c(o){return`${ne.slice(ne.indexOf("# CC Safety Net")).trimEnd()}
 
 ## User request
 
-${e.trim()||b}`}function g(e,n={}){return{malformed:!0,denial:P(n),cwd:e}}function T(e,n){return{malformed:!0,denial:A(e,n),cwd:e.cwd}}function y(e,n={}){return(l,t)=>{try{return D(l,t,e,n)}catch(i){return console.error("CC Safety Net error:",i),e.block(P())}}}function D(e,n,l,t){let i=c();if(l.cancelled?.(n))return l.block(P());let r=l.extract(e,n,i.paths);if(!r)return l.allow;let s=()=>l.getSessionId(e,n);if("malformed"in r)return he(i,r.denial,s,{agent:l.agent,toolName:r.denial.toolName,cwd:r.cwd}),l.block(r.denial);let m=(a,w)=>{let C=ye(a,{includeEvidence:w});return C?l.block(C):l.allow};try{let a=N(i,r,{guard:{auditAllowed:xe(i.env),policyOptions:t.policyOptions,dependencies:t.guardDependencies},audit:{agent:l.agent,getSessionId:s}});return m(a,!0)}catch(a){if(!(a instanceof p))throw a;if(L(o.debug,i.env))console.error(`CC Safety Net debug: ${l.debugLabel} analysis failed: ${Xe(a.cause)}`);return m(a.evaluation,l.includeEvidenceOnError(r))}}var R=new Map([["bash","posix"],["powershell","powershell"]]),O={agent:"pi",debugLabel:"pi tool_call",extract:(e,n,l)=>M(e,n,l),getSessionId:(e,n)=>n.sessionManager.getSessionId(),allow:void 0,block:(e)=>_(e),includeEvidenceOnError:(e)=>e.route.kind==="command"};function v(e){e.on("tool_call",S)}var S=k();function k(e={}){return y(O,e)}function M(e,n,l){if(!e||typeof e!=="object")return;let t=e;if(t.type!==void 0&&t.type!=="tool_call")return;if(typeof t.toolName!=="string"||t.toolName.trim()==="")return u(n);if(typeof n.cwd!=="string"||n.cwd.trim()==="")return u(n,t.toolName);let i=et(".",[n.cwd],l);if(!i)return T({directory:"session",problem:"unusable",cwd:n.cwd},{toolName:t.toolName});let r=R.get(t.toolName);if(!t.input||typeof t.input!=="object")return r?u(n,t.toolName):void 0;if(!r)return d(t.toolName,t.input,{kind:q(t.toolName)},{configCwd:i,executionCwd:i},null);let s=t.input.command;if(typeof s!=="string"||s.trim()==="")return u(n,t.toolName);return d(t.toolName,t.input,{kind:"command",shell:r},{configCwd:i,executionCwd:i},s)}function u(e,n){return g(typeof e.cwd==="string"&&e.cwd.trim()?e.cwd:null,{toolName:n})}function _(e){return{block:!0,reason:be(e)}}function H(e){v(e),f(e)}export{H as default};
+${o.trim()||p}`}var f=new Map([["bash","posix"],["powershell","powershell"]]),g={agent:"pi",debugLabel:"pi tool_call",extract:(o,n,t)=>y(o,n,t),getSessionId:(o,n)=>n.sessionManager.getSessionId(),allow:void 0,block:(o)=>w(o),includeEvidenceOnError:(o)=>o.route.kind==="command"};function m(o){o.on("tool_call",T)}var T=P();function P(o={}){return xe(g,o)}function y(o,n,t){if(!o||typeof o!=="object")return;let e=o;if(e.type!==void 0&&e.type!=="tool_call")return;if(typeof e.toolName!=="string"||e.toolName.trim()==="")return r(n);if(typeof n.cwd!=="string"||n.cwd.trim()==="")return r(n,e.toolName);let i=ot(".",[n.cwd],t);if(!i)return ue({directory:"session",problem:"unusable",cwd:n.cwd},{toolName:e.toolName});let a=f.get(e.toolName);if(!e.input||typeof e.input!=="object")return a?r(n,e.toolName):void 0;if(!a)return l(e.toolName,e.input,{kind:_(e.toolName)},{configCwd:i,executionCwd:i},null);let s=e.input.command;if(typeof s!=="string"||s.trim()==="")return r(n,e.toolName);return l(e.toolName,e.input,{kind:"command",shell:a},{configCwd:i,executionCwd:i},s)}function r(o,n){return L(typeof o.cwd==="string"&&o.cwd.trim()?o.cwd:null,{toolName:n})}function w(o){return{block:!0,reason:J(o)}}function v(o){m(o),d(o)}export{v as default};

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "cc-safety-net",
-  "version": "2.4.15",
+  "version": "2.5.0",
   "description": "A coding agent CLI hook - block destructive commands and secret file access",
   "keywords": [
     "amp",
     "claude-code",
     "cursor",
+    "deepseek-harness",
     "grok",
     "grok-build",
     "opencode",
@@ -118,10 +119,15 @@
     "node": ">=18"
   },
   "packageManager": "bun@1.4.2",
+  "dsh": {
+    "bundle": {
+      "patch": "./dist/deepseek-harness/cordis.patch.yml"
+    }
+  },
   "pi": {
     "extensions": [
       "./dist/pi/index.js"
     ]
   },
-  "gitHead": "8459b51d72d96c56ca60b3fdb3ae5b19eb5603ed"
+  "gitHead": "f9b1fa860cbb5c678555b6126a6ef15f1bce01ff"
 }

package/dist/chunks/index-96rww7g0.js

@@ -1,4 +0,0 @@
-import{a,s,V,f,Re,u,Ie,y,p,B}from"./index-gj6afr0n.js";import{appendFileSync as re,mkdirSync as oe}from"node:fs";import{isAbsolute as ie,join as I}from"node:path";import{lstatSync as L,readdirSync as j,readFileSync as U,rmdirSync as K,statSync as O,unlinkSync as X,utimesSync as Y,writeFileSync as Z}from"node:fs";import{join as m}from"node:path";function te(t,e={}){return Ie(u(t,e),t.home).policy.audit.retention_days}var S=86400000,J=".last-prune",Q=/^\d{4}-\d{2}$/,W=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,G=(t)=>Math.floor(t/S);function z(t,e,r=()=>new Date){try{let n=r().getTime();if(!O(e,{throwIfNoEntry:!1})?.isDirectory())return;let o=m(e,J),c=O(o,{throwIfNoEntry:!1})?.mtimeMs;if(c!==void 0&&G(c)===G(n))return;let i=n-te(t)*S,d=new Date(n).toISOString().slice(0,7);for(let l of A(e)){if(l.isDirectory()){q(m(e,l.name),i,d);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))ee(m(e,l.name),i)}Z(o,"",{mode:384}),Y(o,n/1000,n/1000)}catch{}}function q(t,e,r){for(let n of A(t)){if(!n.isDirectory()||!Q.test(n.name))continue;let o=m(t,n.name);for(let c of A(o)){if(!c.isFile())continue;let i=W.exec(c.name);if(!i||i[2]!==n.name)continue;let d=Date.parse(`${i[1]}T00:00:00.000Z`)+S;if(!Number.isFinite(d)||d>=e)continue;b(m(o,c.name))}if(n.name!==r)T(o)}T(t)}function ee(t,e){try{let r=L(t);if(r.mtimeMs>=e)return;let n=U(t,"utf-8").split(`
-`).filter((o)=>o.trim()).map(ne);if(n.length===0)return;if(n.some((o)=>o===void 0||o>=e))return;if(L(t).mtimeMs!==r.mtimeMs)return;b(t)}catch{}}function ne(t){try{let e=JSON.parse(t).ts,r=typeof e==="string"?Date.parse(e):Number.NaN;return Number.isFinite(r)?r:void 0}catch{return}}function A(t){try{return j(t,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function b(t){try{X(t)}catch{}}function T(t){try{K(t)}catch{}}var ae="2.4.15",ce=1e4,de=2000,ue=256,se=32768;function le(t){let e=t.trim();if(!e)return null;let r=e.replace(/[^A-Za-z0-9_.-]+/g,"_");if(r=r.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!r||r==="."||r==="..")return null;return r}function me(t){return(t??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function _(t,e,r,n,o,c,i={}){let d=le(e);if(!d)return;let l=D(t);if(!l)return;try{let E=(i.now??(()=>new Date))().toISOString(),h=g(V(r),i.failureStage?Number.POSITIVE_INFINITY:ce),w=g(V(n),de),F=i.toolName?g(V(i.toolName),ue):void 0,v=c===null?void 0:g(V(c),se),C=I(l,me(v?.value??null),E.slice(0,7));oe(C,{recursive:!0,mode:448});let H=I(C,`${E.slice(0,10)}-${d}.jsonl`),P={ts:E,id:(i.createId??Re)(),v:ae,sessionId:d,decision:i.decision??"deny",agent:i.agent,shape:i.shape,level:i.level,configFallback:i.configFallback,toolName:F?.value,command:h.value,segment:w.value,...h.truncated||w.truncated||F?.truncated||v?.truncated?{truncated:!0}:{},reason:o,ruleId:i.ruleId,intent:i.intent,failureStage:i.failureStage,errorCode:i.errorCode,cwd:v?.value??null};re(H,`${JSON.stringify(P)}
-`,{encoding:"utf-8",mode:384}),z(t,l,i.now)}catch{}}function g(t,e){return{value:t.slice(0,e),truncated:t.length>e}}function je(t){let e=t.env.get("CC_SAFETY_NET_AUDIT_HOME");if(t.env.get("NODE_ENV")==="test"&&!e)return null;let r=e||t.home;return r&&ie(r)?r:null}function D(t){let e=je(t);return e?I(e,".cc-safety-net","logs"):null}function x(t,e,r,n=!0,o){if(e.decision.kind==="allow"){if(!r||t.route.kind!=="command")return;let d=k(t);return{decision:"allow",command:d,segment:d,reason:"allowed",cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{}}}let c=e.decision.evidence,i=c?.command??(n?k(t):"");return{decision:"deny",command:i,segment:c?.segment??i,reason:e.decision.reason,cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{},ruleId:e.decision.ruleId,intent:e.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function k(t){return"command"in t?t.command??"":""}function M(t,e,r,n){if(!e)return;let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;_(t,o,e.command,e.segment,e.reason,e.cwd,{decision:e.decision,agent:n.agent,shape:n.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function he(t,e,r,n){let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;_(t,o,e.command??"",e.segment??e.command??"",e.reason,n.cwd??null,{decision:"deny",agent:n.agent,shape:n.shape,toolName:n.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function N(t,e,r){try{let n=B(e,{environment:t,...r.guard});return R(t,e,n,r),n}catch(n){if(!(n instanceof p))throw n;throw R(t,e,n.evaluation,r,!(n.cause instanceof f),{stage:n.stage,errorCode:fe(n.cause)}),n}}function R(t,e,r,n,o=!0,c){M(t,x(e,r,n.guard?.auditAllowed??!1,o,c),n.audit.getSessionId,{agent:n.audit.agent,shape:n.audit.shape})}function fe(t){if(t instanceof s)return a[t.kind].errorCode;if(t instanceof f)return"tool-input-limit";if(t instanceof y)return"structural-shell-syntax-limit";return"unexpected-error"}
-export{te,z,je,D,he,N};