cc-safety-net 2.4.15 → 2.5.1

package/dist/bin/hook.js

@@ -3,7 +3,7 @@ var gg=["-h","--help"];function io(e,t){let n=Object.entries(e.booleans??{}),r=O
 
 `)}function es(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function wn(e={}){return{reason:sr,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var bg={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative"}}};function so(e,t={}){return{...bg[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function $l(e){return Bl({...e,redact:Ct})}function Ul(e){return Bl({...e,redact:Ct,askUser:!0})}function jl(e){return Ct(e instanceof Error?e.message:String(e))}var Re=require("node:path");var Sg=256,ao=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function De(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function ar(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z]):(?:[/\\]|$)/,"$1:/")}function bt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function os(e,t){return ts(e,0,t)}function ts(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=ns(e,o+2),a=vg(e,o,t);if(a===null){if(ao.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Eg(l,t,n),o=a+1;continue}let i=ns(e,o+1);if(!i){r+="$",o++;continue}r+=rs(i,n)??`$${i}`,o+=i.length+1}return r}function vg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>J.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Eg(e,t,n){let r=e.slice(2,-1),o=ns(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return rs(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(ao.has(o))throw new N("pathEnvironmentExpansion");return e}if(!ao.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=rs(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":ts(i.slice(s.length),t+1,n);return l?ts(i.slice(s.length),t+1,n):""}function ns(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function rs(e,t){if(!ao.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function O(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Kl(n,i);let s=t.realpath(i);if(s!==null)return Vl(n,e,s,o);let a=Re.dirname(i);if(a===i||o.length>=Sg)return Vl(n,e,i,o);o.push(Re.basename(i)),i=a}}function Vl(e,t,n,r){let o=r.length===0?n:Re.join(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function xg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Kl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Kl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ye(e,t,n,r){let o=Yl(e,t,n);if(!o)return"";return O(o,n.paths,r).replace(/\\/g,"/")}function ql(e,t,n,r,o){let i=Yl(e,t,n);if(!i)return null;if(o(Re.basename(i)))return O(i,n.paths,r).replace(/\\/g,"/");let s=xg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Yl(e,t,n){let r=n.home,o=os(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Re.resolve(r,o.slice(2)):o,s=De(i);return Re.normalize(Re.isAbsolute(s)?s:Re.resolve(t,s))}var tc=require("node:util"),Rg=new Set(["applypatch","patch"]),wg=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),_g=new Set(["grep","grepsearch","rg"]),Ag=new Set(["find","findbyname","glob"]),Pg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Tg=new Set(["command","diff","input","patch","patchtext"]),Zl=new TextEncoder,kg=new TextDecoder,Ig=/\s/,Og=64;class Se extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var lr=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function nc(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function co(e){return Pg.has(nc(e))}function rc(e){let t=nc(e);if(Rg.has(t))return"patch";if(_g.has(t))return"grep";if(Ag.has(t))return"glob";if(wg.has(t))return"path";return"unknown"}function Dt(e){if(!e||typeof e!=="object")return;lc(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)dt();return}if(t.get||t.set)dt();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function uo(e,t){return oc(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function oc(e,t,n,r,o){let i=ac(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>oc(l,t,i.array?n:t.has(ic(a)),r,o+1));return r.ancestors.delete(i.object),s}function ic(e){return e.replace(/-/g,"_").toLowerCase()}function mo(e){return sc(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Dg)}function sc(e,t,n,r){let o=ac(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>sc(a,o.array?t:Tg.has(ic(s)),n,r+1));return n.ancestors.delete(o.object),i}function Mg(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>lr.maxDepth||t.nodes>lr.maxNodes)dt();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>lr.maxStringBytes||t.stringBytes>lr.maxAggregateStringBytes)dt()}function ac(e,t,n){if(Mg(e,t,n),!e||typeof e!=="object")return null;let r=lc(e);if(t.ancestors.has(e))dt();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>lr.maxKeys)dt();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)dt();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function lc(e){if(tc.types.isProxy(e))dt();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)dt();return t}function dt(){throw new Se}function Dg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Ng(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...is(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...is(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...as(lo(c.slice(4),!0),lo(u.slice(4),!0))),l++;continue}if(!r)t.push(...is(c))}return t}function Ng(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function is(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return ec(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return ec(n[1]);if(e.startsWith("diff --git "))return Lg(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Ql(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Ql(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return $g(i[1]);return[]}function Lg(e){let t=Wg(e);if(t.length===2&&t[0]&&t[1])return as(t[0],t[1]);let n=Gg(e);return n?as(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Wg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(en(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!en(e[n]))n++;t.push(e.slice(i,n));continue}let o=cc(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(en(e[n]))n++;return n===e.length?t:[]}function Gg(e){let t=0;while(t<e.length&&en(e[t]))t++;let n=e.length;while(n>t&&en(e[n-1]))n--;let r=0,o=t;while(o<n){if(!en(e[o])){o++;continue}let i=o;while(o<n&&en(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Og)dt();if(Fg(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Fg(e,t,n,r,o){if(ss(e,t,n,r,o))return!0;let i=Xl(e,"/",t,n),s=Xl(e,"/",r,o);if(i<=t||s<=r)return!1;if(ss(e,t,i,r,s))return!1;return ss(e,i+1,n,s+1,o)}function ss(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Xl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function en(e){return e!==void 0&&Ig.test(e)}function cc(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:kg.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Zl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Zl.encode(zg(s[0]??""))),o+=2}return null}function zg(e){return{a:"\x07",b:"\b",f:"\f",n:`
 `,r:"\r",t:"\t",v:"\v"}[e]??e}function Hg(e){return cr(Ug(e))}function as(e,t){if(e==="/dev/null")return Jl(t);if(t==="/dev/null")return Jl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(cr);let n=Bg(e,t)??(e===t?uc(e):null);return[e,t,...n?[n]:[]].flatMap(cr)}function Jl(e){let t=uc(e);return[e,...t?[t]:[]].flatMap(cr)}function uc(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Bg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Ql(e){return Hg(lo(e,!0))}function $g(e){return cr(lo(e,!1))}function lo(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=cc(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Ug(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function cr(e){return e===""||e==="/dev/null"?[]:[e]}function ec(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}var Ze=require("node:path");function St(e,t,n){if(bt(e))return;let r=t.flatMap((i)=>fo(i,n));if(!r[0])return;let o=fo(Ze.isAbsolute(e)?e:Ze.resolve(r[0],e),n)[0];if(!o)return;return r.some((i)=>ur(o,i))?o:void 0}function ls(e,t,n){if(bt(e))return;return fo(Ze.isAbsolute(e)?e:Ze.resolve(t,e),n)[0]}function vt(e,t){return e.flatMap((n)=>fo(n,t))[0]}function Et(e,t,n){return ls(e,t,n)?"outside-workspace":"unusable"}function fo(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function ur(e,t){let n=Ze.relative(t,e);return n===""||n!==".."&&!n.startsWith(`..${Ze.sep}`)&&!Ze.isAbsolute(n)}var jg=8388608;async function dc(e){let t=[],n=0;for await(let r of e){let o=typeof r==="string"?Buffer.from(r,"utf-8"):Buffer.from(r.buffer,r.byteOffset,r.byteLength);if(n+=o.byteLength,n>jg)throw Vg(e),Error("hook input byte limit exceeded");t.push(o)}return Buffer.concat(t,n).toString("utf-8")}function Vg(e){let t=e.destroy??e.cancel;if(!t)return;try{Promise.resolve(t.call(e)).catch(()=>{})}catch{}}function po(e,t,n){try{return JSON.parse(e)}catch{t({reason:n});return}}function ie(e,t){let n=t.get(e);return n?{kind:"command",shell:n}:{kind:rc(e)}}function mc(e,t,n,r,o,i){let s=e===void 0?i:e;if(typeof s!=="string"||s.trim()==="")return ve(r,t,n),null;let a=vt([s],o);if(a)return{configCwd:a,executionCwd:a};return $e(r,t,n,{directory:"session",problem:"unusable",cwd:s}),null}function ve(e,t,n){e(wn({command:fc(t),toolName:n}))}function $e(e,t,n,r){e(so(r,{command:fc(t),toolName:n}))}function fc(e){try{return Dt(e)}catch(t){if(!(t instanceof Se))throw t;return}}var An=require("node:fs"),go=require("node:os");var bc=require("node:fs"),Sc=require("node:path");var gc=require("node:child_process"),H=require("node:fs"),ne=require("node:path"),Kg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],qg=5000;function hc(e,t=dh(),n=qg){let r=Yg(e),o=r===null?null:Zg(r);if(r===null||o===null)return null;let i=ch(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Yg(e){try{let t=H.realpathSync(ne.resolve(e));return H.statSync(t).isDirectory()?t:null}catch{return null}}function Zg(e){let t=lh(e);if(!t)return null;try{let n=H.lstatSync(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=cs(t);if(!r?.commonDir)return null;if(!Qg(r.gitDir,t))return null;return eh(r.gitDir,ne.dirname(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function cs(e){try{let t=Xg(e);if(!t)return null;let n=H.realpathSync(ne.isAbsolute(t)?t:ne.resolve(ne.dirname(e),t));if(!H.statSync(n).isDirectory())return null;return{gitDir:n,commonDir:Jg(n)}}catch{return null}}function Xg(e){let t=H.readFileSync(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Jg(e){try{let t=H.readFileSync(ne.join(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=H.realpathSync(ne.isAbsolute(t)?t:ne.resolve(e,t));return H.statSync(n).isDirectory()?n:null}catch{return null}}function Qg(e,t){let n=th(e);return n===null?!1:yc(e,n,t)}function eh(e,t){let n=nh(e);return n===null?!0:yc(e,n,t)}function th(e){let t=ne.join(e,"gitdir");if(!H.existsSync(t))return null;let n=H.readFileSync(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function nh(e){let t=ne.join(e,"config.worktree");return H.existsSync(t)?oh(t):null}function yc(e,t,n){try{return rh(ne.isAbsolute(t)?t:ne.resolve(e,t),n)}catch{return!1}}function rh(e,t){try{let n=H.statSync(e),r=H.statSync(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return pc(H.realpathSync.native(e))===pc(H.realpathSync.native(t))}function pc(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function oh(e){let t=H.readFileSync(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=ih(s[1]??"")}return r}function ih(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return ah(t.slice(1,-1))}var sh={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function ah(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:sh[n]??t)}function lh(e){try{return us(H.realpathSync(e))}catch{return null}}function us(e){let t=e;while(!0){let n=ne.join(t,".git");if(H.existsSync(n))return n;let r=ne.dirname(t);if(r===t)return null;t=r}}function ch(e,t,n,r){if(uh(t))return!0;if(n===null)return!0;let o=gc.spawnSync(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:mh(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Cc(o.stdout.trim())}function uh(e){return[ne.join(e.commonDir,"config"),ne.join(e.gitDir,"config.worktree")].filter((t)=>H.existsSync(t)).some((t)=>fh(t))}function dh(){return Kg.find((e)=>H.existsSync(e))??null}function dr(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function mh(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!dr(t)))}function fh(e){let t;try{t=H.readFileSync(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(ph(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Cc(c)}return r}function ph(e){return e==="include"||e.startsWith("includeif ")}function Cc(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function vc(e,t){if(e==="")return null;let n=ue(),r=us(ye(e,e,t,n)),o=r?gh(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function gh(e,t,n,r){try{let o=ye(e,t,n,r),i=bc.statSync(e),s=i.isFile()?o:null,a=i.isFile()?cs(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[_n(ye(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[_n(e.replace(/\\/g,"/")),...l]:l)];return{entry:_n(o),markerFile:s?_n(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=_n(Sc.join(u,"hooks").replace(/\\/g,"/"));return[m,_n(ye(m,t,n,r))]}))]}}catch{return null}}function _n(e){return process.platform==="win32"?e.toLowerCase():e}var hh={realpath:(e)=>{try{return An.realpathSync(e)}catch{return null}},entryKind:(e)=>{let t=An.lstatSync(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return An.statSync(e).isDirectory()}catch{return!1}}};function xc(){return yh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:De(process.env.HOME||go.homedir()),tmpdir:go.tmpdir(),paths:hh})}function yh(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Ec(n,i,()=>vc(i,o)),worktreeFacts:(i)=>Ec(r,i,()=>hc(i)),...t};return o}function Ec(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Pn=["fail_closed","paranoid_rm","paranoid_interpreters"],ho={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ae={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},yo=["standard","strict","paranoid"];function Ch(e,t){if(!t)return e;return yo.indexOf(t)>yo.indexOf(e)?t:e}function bh(e){let t=ps(ae.level,e);if(t===void 0||t==="")return;if(yo.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ae.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${yo.join(", ")}.`);return}function Sh(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Rc(e){return Sh(ps(ae.auditScope,e))==="all"}function ms(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function fs(e={},t){let n=e.safety?.level??"standard",r=bh(t),o=Ch(n,r),i=ho[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ae.level.name}=${r}`),l.paranoidRm.push(`env ${ae.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ae.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(tn(ae.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ae.strict.name}`);if(tn(ae.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ae.paranoid.name}`),l.paranoidInterpreters.push(`env ${ae.paranoid.name}`);if(tn(ae.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ae.paranoidRm.name}`);if(tn(ae.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ae.paranoidInterpreters.name}`);let c=!!e.worktreeMode||tn(ae.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:ms(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function tn(e,t){let n=typeof e==="string"?ds(e,t):ps(e,t);return n==="1"||n?.toLowerCase()==="true"}function ds(e,t){return t.get(e)}function ps(e,t){let n=ds(e.name,t);if(n!==void 0)return n;if(e.legacyName)return ds(e.legacyName,t);return}function mr(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}var hr=require("node:path");var F=require("node:fs"),K=require("node:path");function gs(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var vh=Symbol("PolicyFilesystemScope"),Eh=Symbol("PolicyFilesystemTarget"),xh=F.constants.O_NOFOLLOW??0;class Ce extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function nn(e,t){return{[vh]:!0,root:K.resolve(e),label:t}}function wc(e,t){let n=K.normalize(t);if(t===""||K.isAbsolute(t)||n===".."||n.startsWith(`..${K.sep}`))throw new Ce(e.label);return{[Eh]:!0,scope:e,relativePath:n,path:K.join(e.root,n)}}function fr(e,t){return wc(e,K.relative(e.root,K.resolve(t)))}function _c(e,t="rules policy"){let n=K.resolve(e),r=K.parse(n).dir;return wc(nn(r,t),K.relative(r,n))}function bo(e){return Pc(e.scope.label,()=>{if(!Co(e))return null;let t=F.openSync(e.path,F.constants.O_RDONLY|xh);return Rh(t,()=>{let n=F.fstatSync(t);if(!n.isFile())throw new Ce(e.scope.label);let r=F.readFileSync(t,"utf-8"),o=F.lstatSync(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new Ce(e.scope.label);return Co(e),r})})}function Ac(e,t){if(e.path===t.path)return!0;return Pc(e.scope.label,()=>{if(!Co(e)||!Co(t))return!1;let n=(r)=>K.join(F.realpathSync(K.parse(r).dir),K.parse(r).base);return n(e.path)===n(t.path)})}function Pc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof Ce)throw r;throw new Ce(e)}}function Rh(e,t){try{return t()}finally{F.closeSync(e)}}function Co(e,t="file"){let n=wh(e.scope);if(!n)return!1;let r=e.relativePath.split(K.sep);for(let o of r.keys()){let i=K.join(e.scope.root,...r.slice(0,o+1)),s=F.lstatSync(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new Ce(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new Ce(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new Ce(e.scope.label);_h(n,F.realpathSync(i),e.scope.label)}return!0}function wh(e){if(!F.lstatSync(e.root,{throwIfNoEntry:!1}))return null;if(!F.statSync(e.root).isDirectory())throw new Ce(e.label);return F.realpathSync(e.root)}function _h(e,t,n){let r=K.relative(e,t);if(r===".."||r.startsWith(`..${K.sep}`)||K.isAbsolute(r))throw new Ce(n)}var L=require("node:path");var rn=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Tc="rulebook.json",kc=".cc-safety-net/rules";var Ic=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Ah=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Ph=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Th="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),DP=new RegExp(`^${Ph}/(${rn.source.slice(1,-1)})/${Th}$`);function kh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Oc(e){if(So(e))try{return hs(e),null}catch(t){return t instanceof Error?t.message:String(t)}return rn.test(e)?null:`Local rulebook sources must be bare names matching ${rn}: ${e}`}function hs(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Ic);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Ah.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!rn.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:kh(o),name:o}}function So(e){return Ic.test(e)}var Mc="rule.json",vo="policy.json",Dc=".cc-safety-net",Ih="rules",Oh="CC_SAFETY_NET_HOME",Nc="`cc-safety-net rule update`";function Mh(e){return L.resolve(e,kc)}function Dh(e){return L.join(Mh(e),Mc)}function pr(e){return L.join(L.resolve(e),Dc,vo)}function ys(e,t={}){return t.userConfigDir??(t.userConfigPath?L.dirname(t.userConfigPath):L.join(Nh(e),Ih))}function Nh(e){let t=e.env.get(Oh);return t?L.resolve(De(t)):L.join(e.home,Dc)}function Lh(e,t={}){return L.join(ys(e,t),Mc)}function Tn(e,t={}){return L.join(L.dirname(ys(e,t)),vo)}function Lc(e,t){let n=t.userConfigPath??Lh(e,t),r=t.projectConfigPath??Dh(t.cwd),o=Wh(e,t),i=Gh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:fr(o,n),projectConfigTarget:fr(i,r)}}function Wh(e,t){let n=t.userConfigPath?L.dirname(L.dirname(L.resolve(t.userConfigPath))):L.dirname(L.resolve(t.userConfigDir??ys(e,t)));return nn(n,"user policy")}function Gh(e,t){let n=L.resolve(t),r=L.resolve(e),o=L.relative(n,r);if(o!==".."&&!o.startsWith(`..${L.sep}`)&&!L.isAbsolute(o))return nn(n,"project policy");return nn(L.dirname(L.dirname(r)),"project policy")}function Wc(e,t){return L.join(e,t,Tc)}var Ne=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),Nt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,Lt=256,ee=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Gc=new Set(["python","python3","python2","node","ruby","perl"]),Eo=/^python(?:[23](?:\.\d+)*)?$/,Ue=new Set(["awk","gawk","nawk","mawk"]),xo=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Fc="Rulebook exceeds CC Safety Net's safe validation limits.",zc="Additional rulebook validation errors were omitted.",Xe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Hc(e){if(Cs(e.allowed_commands,Xe.maxAllowedCommands)||Cs(e.rules,Xe.maxRules)||Cs(e.tests,Xe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Xe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Xe.maxStringCodeUnits||i&&o.length>Xe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Xe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Cs(e,t){return Array.isArray(e)&&e.length>t}var bs=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ss=64,vs="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return T(e).toLowerCase()}function T(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function we(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Fh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Es=new Set(["--init-file","--rcfile"]);function xs(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!Fh[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Le(e){let t=T(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Es.has(l)&&!s.includes("="))i++;continue}let a=xs(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function gr(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Ro(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of zh(e))gr(n,t);return t.inSingle||t.inDouble}function zh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`,t:"\t",b:"\b"};function ah(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:sh[n]??t)}function lh(e){try{return us(H.realpathSync(e))}catch{return null}}function us(e){let t=e;while(!0){let n=ne.join(t,".git");if(H.existsSync(n))return n;let r=ne.dirname(t);if(r===t)return null;t=r}}function ch(e,t,n,r){if(uh(t))return!0;if(n===null)return!0;let o=gc.spawnSync(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:mh(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Cc(o.stdout.trim())}function uh(e){return[ne.join(e.commonDir,"config"),ne.join(e.gitDir,"config.worktree")].filter((t)=>H.existsSync(t)).some((t)=>fh(t))}function dh(){return Kg.find((e)=>H.existsSync(e))??null}function dr(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function mh(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!dr(t)))}function fh(e){let t;try{t=H.readFileSync(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(ph(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Cc(c)}return r}function ph(e){return e==="include"||e.startsWith("includeif ")}function Cc(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function vc(e,t){if(e==="")return null;let n=ue(),r=us(ye(e,e,t,n)),o=r?gh(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function gh(e,t,n,r){try{let o=ye(e,t,n,r),i=bc.statSync(e),s=i.isFile()?o:null,a=i.isFile()?cs(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[_n(ye(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[_n(e.replace(/\\/g,"/")),...l]:l)];return{entry:_n(o),markerFile:s?_n(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=_n(Sc.join(u,"hooks").replace(/\\/g,"/"));return[m,_n(ye(m,t,n,r))]}))]}}catch{return null}}function _n(e){return process.platform==="win32"?e.toLowerCase():e}var hh={realpath:(e)=>{try{return An.realpathSync(e)}catch{return null}},entryKind:(e)=>{let t=An.lstatSync(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return An.statSync(e).isDirectory()}catch{return!1}}};function xc(){return yh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:De(process.env.HOME||go.homedir()),tmpdir:go.tmpdir(),paths:hh})}function yh(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Ec(n,i,()=>vc(i,o)),worktreeFacts:(i)=>Ec(r,i,()=>hc(i)),...t};return o}function Ec(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Pn=["fail_closed","paranoid_rm","paranoid_interpreters"],ho={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ae={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},yo=["standard","strict","paranoid"];function Ch(e,t){if(!t)return e;return yo.indexOf(t)>yo.indexOf(e)?t:e}function bh(e){let t=ps(ae.level,e);if(t===void 0||t==="")return;if(yo.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ae.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${yo.join(", ")}.`);return}function Sh(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Rc(e){return Sh(ps(ae.auditScope,e))==="all"}function ms(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function fs(e={},t){let n=e.safety?.level??"standard",r=bh(t),o=Ch(n,r),i=ho[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ae.level.name}=${r}`),l.paranoidRm.push(`env ${ae.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ae.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(tn(ae.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ae.strict.name}`);if(tn(ae.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ae.paranoid.name}`),l.paranoidInterpreters.push(`env ${ae.paranoid.name}`);if(tn(ae.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ae.paranoidRm.name}`);if(tn(ae.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ae.paranoidInterpreters.name}`);let c=!!e.worktreeMode||tn(ae.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:ms(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function tn(e,t){let n=typeof e==="string"?ds(e,t):ps(e,t);return n==="1"||n?.toLowerCase()==="true"}function ds(e,t){return t.get(e)}function ps(e,t){let n=ds(e.name,t);if(n!==void 0)return n;if(e.legacyName)return ds(e.legacyName,t);return}function mr(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}var hr=require("node:path");var F=require("node:fs"),K=require("node:path");function gs(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var vh=Symbol("PolicyFilesystemScope"),Eh=Symbol("PolicyFilesystemTarget"),xh=F.constants.O_NOFOLLOW??0;class Ce extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function nn(e,t){return{[vh]:!0,root:K.resolve(e),label:t}}function wc(e,t){let n=K.normalize(t);if(t===""||K.isAbsolute(t)||n===".."||n.startsWith(`..${K.sep}`))throw new Ce(e.label);return{[Eh]:!0,scope:e,relativePath:n,path:K.join(e.root,n)}}function fr(e,t){return wc(e,K.relative(e.root,K.resolve(t)))}function _c(e,t="rules policy"){let n=K.resolve(e),r=K.parse(n).dir;return wc(nn(r,t),K.relative(r,n))}function bo(e){return Pc(e.scope.label,()=>{if(!Co(e))return null;let t=F.openSync(e.path,F.constants.O_RDONLY|xh);return Rh(t,()=>{let n=F.fstatSync(t);if(!n.isFile())throw new Ce(e.scope.label);let r=F.readFileSync(t,"utf-8"),o=F.lstatSync(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new Ce(e.scope.label);return Co(e),r})})}function Ac(e,t){if(e.path===t.path)return!0;return Pc(e.scope.label,()=>{if(!Co(e)||!Co(t))return!1;let n=(r)=>K.join(F.realpathSync(K.parse(r).dir),K.parse(r).base);return n(e.path)===n(t.path)})}function Pc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof Ce)throw r;throw new Ce(e)}}function Rh(e,t){try{return t()}finally{F.closeSync(e)}}function Co(e,t="file"){let n=wh(e.scope);if(!n)return!1;let r=e.relativePath.split(K.sep);for(let o of r.keys()){let i=K.join(e.scope.root,...r.slice(0,o+1)),s=F.lstatSync(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new Ce(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new Ce(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new Ce(e.scope.label);_h(n,F.realpathSync(i),e.scope.label)}return!0}function wh(e){if(!F.lstatSync(e.root,{throwIfNoEntry:!1}))return null;if(!F.statSync(e.root).isDirectory())throw new Ce(e.label);return F.realpathSync(e.root)}function _h(e,t,n){let r=K.relative(e,t);if(r===".."||r.startsWith(`..${K.sep}`)||K.isAbsolute(r))throw new Ce(n)}var L=require("node:path");var rn=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Tc="rulebook.json",kc=".cc-safety-net/rules";var Ic=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Ah=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Ph=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Th="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),NP=new RegExp(`^${Ph}/(${rn.source.slice(1,-1)})/${Th}$`);function kh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Oc(e){if(So(e))try{return hs(e),null}catch(t){return t instanceof Error?t.message:String(t)}return rn.test(e)?null:`Local rulebook sources must be bare names matching ${rn}: ${e}`}function hs(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Ic);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Ah.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!rn.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:kh(o),name:o}}function So(e){return Ic.test(e)}var Mc="rule.json",vo="policy.json",Dc=".cc-safety-net",Ih="rules",Oh="CC_SAFETY_NET_HOME",Nc="`cc-safety-net rule update`";function Mh(e){return L.resolve(e,kc)}function Dh(e){return L.join(Mh(e),Mc)}function pr(e){return L.join(L.resolve(e),Dc,vo)}function ys(e,t={}){return t.userConfigDir??(t.userConfigPath?L.dirname(t.userConfigPath):L.join(Nh(e),Ih))}function Nh(e){let t=e.env.get(Oh);return t?L.resolve(De(t)):L.join(e.home,Dc)}function Lh(e,t={}){return L.join(ys(e,t),Mc)}function Tn(e,t={}){return L.join(L.dirname(ys(e,t)),vo)}function Lc(e,t){let n=t.userConfigPath??Lh(e,t),r=t.projectConfigPath??Dh(t.cwd),o=Wh(e,t),i=Gh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:fr(o,n),projectConfigTarget:fr(i,r)}}function Wh(e,t){let n=t.userConfigPath?L.dirname(L.dirname(L.resolve(t.userConfigPath))):L.dirname(L.resolve(t.userConfigDir??ys(e,t)));return nn(n,"user policy")}function Gh(e,t){let n=L.resolve(t),r=L.resolve(e),o=L.relative(n,r);if(o!==".."&&!o.startsWith(`..${L.sep}`)&&!L.isAbsolute(o))return nn(n,"project policy");return nn(L.dirname(L.dirname(r)),"project policy")}function Wc(e,t){return L.join(e,t,Tc)}var Ne=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),Nt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,Lt=256,ee=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Gc=new Set(["python","python3","python2","node","ruby","perl"]),Eo=/^python(?:[23](?:\.\d+)*)?$/,Ue=new Set(["awk","gawk","nawk","mawk"]),xo=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Fc="Rulebook exceeds CC Safety Net's safe validation limits.",zc="Additional rulebook validation errors were omitted.",Xe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Hc(e){if(Cs(e.allowed_commands,Xe.maxAllowedCommands)||Cs(e.rules,Xe.maxRules)||Cs(e.tests,Xe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Xe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Xe.maxStringCodeUnits||i&&o.length>Xe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Xe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Cs(e,t){return Array.isArray(e)&&e.length>t}var bs=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ss=64,vs="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return T(e).toLowerCase()}function T(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function we(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Fh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Es=new Set(["--init-file","--rcfile"]);function xs(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!Fh[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Le(e){let t=T(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Es.has(l)&&!s.includes("="))i++;continue}let a=xs(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function gr(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Ro(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of zh(e))gr(n,t);return t.inSingle||t.inDouble}function zh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
 `||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);gr(s,n)}return t}var Rs=new Set(["rm","find","xargs","parallel"]),Hh=new Set(["git","busybox",...Rs,...ee,...Gc,...Ue]),Bh=new Set(["python","node","ruby","perl"]);function Bc(e){let t=M(e);return Hh.has(t)||Je(t)}function Je(e){return Bh.has($h(e))}function $h(e){let t=T(e).toLowerCase();return Eo.test(t)?"python":t}function ws(e){try{let t=bo(Uh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Kh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof Ce)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Uh(e){return typeof e==="string"?_c(e):e}var w=(e,t)=>({path:e,message:t,kind:"typed"}),de=(e,t)=>({path:e,message:t,kind:"custom"});function $c(e){let t=new Set;return e.flatMap((n,r)=>{let o=kn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[de(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var _s=`must be one of ${bs.join(", ")}`,jh=/^[^/]+\/[^/]+$/,Vh=["version","rules","overrides","transparent_wrappers"];function Kh(e){let t=qh(e);return{errors:As(ry(t,Vh,(n)=>n.kind==="custom"),": "," "),sources:ny(e,t)}}function qh(e){if(!kn(e))return[w([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Ss;return[...e.version===1?[]:[w(["version"],"must be 1")],...Yh(e.rules,t),...Jh(e.overrides),...ey(e.transparent_wrappers),...t?[]:Xh(e.rules),...kn(e.overrides)?Object.keys(e.overrides).filter((n)=>!jh.test(n)).map((n)=>de(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...ty(e.transparent_wrappers)]}function Yh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[w(["rules"],"must be an array of rulebook source strings"),...Uc(e,Ss)?[w(["rules"],vs)]:[]];if(t)return[{path:["rules"],message:vs,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[w(["rules",r],"must be a rulebook source string"),...Zh(n,1)?[w(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[w(["rules",r],"must be a non-empty rulebook source string")]:[]})}function Uc(e,t){let n=jc(e);return n!==void 0&&!(n<=t)}function Zh(e,t){let n=jc(e);return n!==void 0&&!(n>=t)}function jc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Xh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[de(["rules",r],"must be a non-empty rulebook source string")];let o=Oc(n);if(o)return[de(["rules",r],o)];if(t.has(n))return[de(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Jh(e){if(e===void 0)return[];if(!kn(e))return[w(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!kn(n))return[w(["overrides",t],'must be "off" or an object')];return[...Qh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Ts(n.intent)?[]:[w(["overrides",t,"intent"],_s)]]})}function Qh(e,t){if(typeof e!=="string")return[w(t,"required non-empty string"),...Uc(e,Lt)?[w(t,`must be at most ${Lt} characters`)]:[]];if(e==="")return[w(t,"required non-empty string")];return e.length>Lt?[w(t,`must be at most ${Lt} characters`)]:[]}function ey(e){if(e===void 0)return[];if(!Array.isArray(e))return[w(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[w(["transparent_wrappers",n],"must be a command string")];return Nt.test(t)?[]:[w(["transparent_wrappers",n],"must match command pattern")]})}function ty(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!Nt.test(n))return[];if(t.has(n))return[de(["transparent_wrappers",r],`duplicate command "${n}"`)];if(Bc(n))return[de(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function ny(e,t){let n=kn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function ry(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function As(e,t,n){return[...new Set(e.map((r)=>{let o=Ps(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Ps(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Ts(e){return bs.includes(e)}function kn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Kc(e){let t=sy(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var oy=`required non-empty string up to ${Lt} characters`,Vc="must be a non-empty array of unique non-empty strings",iy="required non-empty array of non-empty strings";function sy(e){if(!Wt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Hc(e))return{errors:[Fc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...As(ay(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Xe.maxValidationErrors?[...t.slice(0,Xe.maxValidationErrors),zc]:t,ruleNames:new Set(qc(e).map((n)=>n.toLowerCase()))}}function qc(e){let t=Wt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=Wt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function ay(e,t){return[...typeof e.name==="string"&&rn.test(e.name)?[]:[w(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[w(["version"],"required non-empty string")],...ly(e.allowed_commands),...cy(e.rules,t),...fy(e.tests),...py(e),...gy(e)]}function ly(e){if(!Array.isArray(e))return[w(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&Nt.test(n)?[]:[w(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!Nt.test(n))return[];if(t.has(n))return[de(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function cy(e,t){if(!Array.isArray(e))return[w(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!Wt(n))return[w(["rules",r],"must be an object")];return t?dy(n,["rules",r]):uy(n,["rules",r])}),...$c(e)]}function uy(e,t){return[...Yc(e.name,t),...Zc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&Nt.test(e.subcommand)?[]:[w([...t,"subcommand"],"must match command pattern")],...wo(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Xc(e.reason,t),...Jc(e.intent,t)]}function dy(e,t){return[...Yc(e.name,t),...Zc(e.command,t),...Xc(e.reason,t),...Jc(e.intent,t),...my(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[w([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[w([...t,"block_args"],"not supported in rulebook_version 2")]]}function Yc(e,t){if(typeof e!=="string")return[w([...t,"name"],"required string")];return rn.test(e)?[]:[w([...t,"name"],"must match rule name pattern")]}function Zc(e,t){return typeof e==="string"&&Nt.test(e)?[]:[w([...t,"command"],"required string matching command pattern")]}function Xc(e,t){return typeof e==="string"&&e!==""&&e.length<=Lt?[]:[w([...t,"reason"],oy)]}function Jc(e,t){return e===void 0||Ts(e)?[]:[w([...t,"intent"],_s)]}function my(e,t){if(!Wt(e))return[w(t,"required object")];return[...wo(e.command_path,[...t,"command_path"],iy,!1),...e.any_args===void 0?[]:wo(e.any_args,[...t,"any_args"],Vc,!0),...e.exclude_args===void 0?[]:wo(e.exclude_args,[...t,"exclude_args"],Vc,!0)]}function wo(e,t,n,r){if(!Array.isArray(e))return[w(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[w([...t,s],"must be a non-empty string")];return i===""?[de([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[de(t,n)]:[],...r&&new Set(e).size!==e.length?[de(t,"must not contain duplicate values")]:[]]}function fy(e){if(e===void 0)return[];if(!Array.isArray(e))return[w(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!Wt(t))return[w(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[w(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[w(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[w(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[de(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function py(e){if(!Array.isArray(e.tests))return[];let t=new Set(qc(e));return[...new Set(e.tests.flatMap((n)=>Wt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>de(["tests"],`blocked fixture references unknown rule "${n}"`))}function gy(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=Wt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[de(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function Wt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function ou(e,t){let n=Lc(e,t),r;try{r=Ac(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof Ce)return Ry(n,f.message);throw f}let o=ws(n.userConfigTarget),i=r?{config:null,errors:[]}:ws(n.projectConfigTarget),s=nu(n.userConfigPath,o.errors),a=nu(n.projectConfigPath,i.errors),l=new Set,c=o.config?Qc(o.config,hr.dirname(n.userConfigPath),"user",n.userScope,l):ru(),u=i.config?Qc(i.config,hr.dirname(n.projectConfigPath),"project",n.projectScope,l):ru(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...eu(c.rules,m),...eu(u.rules,d)],transparent_wrappers:Ey(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?tu(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?xy(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?tu(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Qc(e,t,n,r=nn(hr.dirname(hr.dirname(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=yy(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:hy(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function hy(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function yy(e,t,n){let r=Cy(e),o=Wc(t,r),i=Sy(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${by(e)}`]};let s=vy(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Cy(e){return So(e)?hs(e).name:e}function by(e){return So(e)?`run ${Nc} to vendor ${e}`:"create that file or remove that source from the rules config"}function Sy(e,t){try{return{content:bo(fr(t,e))}}catch(n){if(n instanceof Ce)return{error:n.message};throw n}}function vy(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Kc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function Ey(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function eu(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function tu(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function xy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function nu(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Ry(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function ru(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}var Lo=require("node:fs");var iu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ks=new Set(iu.map((e)=>e.id)),_o=iu,wy=new Map(_o.map((e)=>[e.id,e.intent]));function v(e,t){return{id:e,reason:t,intent:wy.get(e)??"manual_only"}}var Is=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Ao={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},_y=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Ay=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Os=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Ay.flatMap((e)=>_y.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Po=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],su=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Py=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Ms=su.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),Ds=su.flatMap((e)=>Py.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),yr={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Ns=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),Ls=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Ty=[...Is,Ao,...Os,...Ms,...Ds,yr,...Ns,...Ls,...Po].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),To=new Set(Po.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),Ws=new Set(Ty.map((e)=>e.id));var We=require("node:path"),ko=process.platform==="win32",au=/[*?]/;function Gs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(ko?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(au.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Cr(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Fs(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Cr(e.trim(),t);if(!We.isAbsolute(n))return"must be an absolute path or start with ~/";return br(n,t)}function zs(e,t){let n=lu(e,t);if(n===null)return"must be a non-empty path string";if(!We.isAbsolute(n))return null;if(br(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var ky="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Iy="cannot cover the guard's own configuration";function lu(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=ko?n.replaceAll("\\","/"):n;return Cr(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Hs(e,t){let n=lu(e,t);if(n===null)return"must be a non-empty path string";let r=Gs(n)?.root??n;if(au.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!We.isAbsolute(r))return null;if(br(r,t)!==null)return ky;return Oy(r,t)?Iy:null}function Oy(e,t){let n=Io(e),r=Io(We.join(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${We.sep}`)}function br(e,t){let n=Io(e),r=Io(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(We.sep)?n:`${n}${We.sep}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Io(e){let t=We.normalize(e);if(ko)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(ko?3:1)&&t.endsWith(We.sep))t=t.slice(0,-1);return t}var cu=30,Oo=1,Mo=365;function uu(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var du=new Set(_o.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(du.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function me(e,t,n){if(du.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function mu(e,t){return Object.freeze(Object.fromEntries(_o.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function fu(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:mu(e,t)})}var pu={standard:0,strict:1,paranoid:2};function yu(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:Bs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:Bs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:Bs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:My(e,t)}}function Bs(e,t){return[...new Set([...e,...t??[]])]}function My(e,t){let n=t.safety?.level,r=ho[e.safety.level];return[...n&&pu[n]<pu[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Pn.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...gu(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...gu(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!To.has(o))),...e.destructive_command_protection.enabled?hu(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?hu(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function gu(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function hu(e,t){return(t??[]).filter((n)=>!e.includes(n))}var js=new Set(["standard","strict","paranoid"]),vu={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:cu}};function Eu(e,t){let n=$y(Tn(e,t),e.home),r=Wo(pr(t.cwd),e.home),o=Ny(r.parsed,e.home),i=Object.keys(o.policy).length>0?yu(n.gui??vu,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?Us(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Dy="project policy audit settings are ignored; audit is user scope only";function Ny(e,t){if(!Ge(e))return{policy:{},diagnostics:[]};let n=Ge(e.safety)?e.safety:{},r=Ge(e.workflow)?e.workflow:{},o=Ge(e.destructive_command_protection)?e.destructive_command_protection:{},i=Ge(e.secret_protection)?e.secret_protection:{},s={...js.has(n.level)?{level:n.level}:{},...Ge(n.overrides)?Cu({overrides:xu(n.overrides,Pn,["safety","overrides"],on)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:No(o.overrides,ks,wu,on)}:{},...o.allow_paths!==void 0?{allow_paths:On(o.allow_paths,Fs,t,["destructive_command_protection","allow_paths"],on)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:No(i.overrides,Ws,_u,on)}:{},...i.deny_paths!==void 0?{deny_paths:On(i.deny_paths,zs,t,["secret_protection","deny_paths"],on)}:{},...i.allow_paths!==void 0?{allow_paths:On(i.allow_paths,Hs,t,["secret_protection","allow_paths"],on)}:{}};return{policy:Cu({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Dy]}}function xu(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(w([...n,o],Vs));return[]}))}function Cu(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var on=()=>{return},Vs="must be a boolean",Ks="must be an object if provided",Ru=`must be an integer between ${Oo} and ${Mo}`,wu={path:["destructive_command_protection","overrides"],label:"destructive command"},_u={path:["secret_protection","overrides"],label:"secret protection"},Ly=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Wy(e,t){let n=[];return{policy:Au(e,t,(o)=>{n.push(o)}),issues:n}}function Gy(e,t){return Au(e,t,on)}function Au(e,t,n){if(!Ge(e))return n(w([],"Config must be an object")),Do();if(e.version!==1)n(w(["version"],"must be 1"));let r=In(e.safety,["safety"],["level","overrides"],n),o=In(r.overrides,["safety","overrides"],Pn,n),i=In(e.workflow,["workflow"],["worktree_mode"],n),s=In(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=In(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=In(e.audit,["audit"],["retention_days"],n);return Pu(e,Ly,[],n),{version:1,safety:{level:Fy(r.level,n),overrides:xu(o,Pn,["safety","overrides"],n)},workflow:{worktree_mode:$s(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:$s(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:No(s.overrides,ks,wu,n),allow_paths:On(s.allow_paths,Fs,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:$s(a.enabled,["secret_protection","enabled"],!0,n),overrides:No(a.overrides,Ws,_u,n),deny_paths:On(a.deny_paths,zs,t,["secret_protection","deny_paths"],n),allow_paths:On(a.allow_paths,Hs,t,["secret_protection","allow_paths"],n)},audit:{retention_days:zy(l.retention_days,n)}}}function In(e,t,n,r){if(e===void 0)return{};if(!Ge(e))return r(w(t,Ks)),{};return Pu(e,n,t,r),e}function Pu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function Fy(e,t){if(e===void 0)return"standard";if(js.has(e))return e;return t(w(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function $s(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(w(t,Vs));return n}function zy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Oo&&e<=Mo))t(w(["audit","retention_days"],Ru));return uu(e)}function No(e,t,n,r){if(e===void 0)return{};if(!Ge(e))return r(w(n.path,Ks)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(w([...n.path,o],'must be "on" or "off"')),[]}))}function On(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(w(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?de([...r,s],a):w([...r,s],a)),[]})}function Ge(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Do(){return structuredClone(vu)}function Wo(e,t){if(!Lo.existsSync(e))return{exists:!1,policy:Do(),errors:[]};try{let n=Lo.readFileSync(e,"utf-8");if(!n.trim())return{exists:!0,policy:Do(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Wy(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${By(i)}`),fallback:Ge(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Do(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var Hy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ks,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Vs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Ru,`not an integer between ${Oo} and ${Mo}`]]);function By(e){let t=Ps(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=Hy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function $y(e,t){let n=Wo(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ge(r))return{policy:Su(),errors:[]};let o=Gy(r,t);return{policy:Us(o),gui:o,errors:[],levelPresent:bu(r)}}if(n.parsed===void 0)return{policy:Su(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:Us(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:bu(n.parsed)}}function bu(e){let t=Ge(e)&&Ge(e.safety)?e.safety:{};return js.has(t.level)}function Tu(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...To].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Su(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Tu({}),denyPaths:[],allowPaths:[]}}}function Us(e){return{safety:Uy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Tu(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function Uy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function ku(e,t){let n=ou(e,t),r=Eu(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...qy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Yy(o,jy(n,r),s,r.policyScopes)}function jy(e,t){let n=Ky(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:Zy(e.errors.length>0?Vy(e.errors):void 0,e.warnings.length>0?Ys(e.warnings.join("; ")):void 0,n)}}function Vy(e){return`${Ys(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Ky(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function qy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Yy(e,t,n=Object.freeze({}),r){let o=qs(structuredClone(e)),i=r?{policyScopes:qs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function qs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))qs(t);return Object.freeze(e)}function Zy(...e){return Ys(e.filter((t)=>!!t).join("; "))}function Ys(e){return/[.!?]$/.test(e)?e:`${e}.`}function Iu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Zs(t.fail_closed,e.strict,"strict"),paranoid_rm:Zs(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Zs(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:fu(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:ms({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Zs(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}var Ye=require("node:path");function Sr(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Xy=/^[A-Za-z_][A-Za-z0-9_]*=/;function Go(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function vr(e){let t=Go(e.words[0],"time")?1:0,n=t===1&&Go(e.words[t],"-p")?t+1:t,r=t===1&&Go(e.words[n],"--")?n+1:n,o=Go(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Xy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var Gt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Fo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Jy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>_e(t)))})}function zo(e,t,n){e.push(n),t.reset()}function Ho(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Xs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function Mn(e,t,n,r,o,i,s){return Xs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function _e(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Jy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:_e(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Js(e,t,n){if(t>=n||Mu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Mu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Ou(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Ou(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
 `||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Qs(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Qy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?eC(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Ou(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
 `&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Mu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Qy(e,t,n){let r=t;while(r<n&&e[r]!==`
@@ -27,7 +27,7 @@ var gg=["-h","--help"];function io(e,t){let n=Object.entries(e.booleans??{}),r=O
 `||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===te(e)){if(o>=0){let l=nd(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(q(s)){if(o<0)continue;if(Y(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=nd(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function WC(e,t){if(S(e,t)!=="\\"||S(e,t-1)==="\\")return-1;if(Y(e,t,String.raw`\n`))return t+2;if(Y(e,t,String.raw`\x0a`)||Y(e,t,String.raw`\x0A`))return t+5;if(Y(e,t,String.raw`\u000a`)||Y(e,t,String.raw`\u000A`))return t+7;return Y(e,t,String.raw`\012`)?t+4:-1}function nd(e,t,n){if(rd(e,t,n,"recursive"))return{recursive:!0,force:!1};if(rd(e,t,n,"force"))return{recursive:!1,force:!0};if(S(e,t)!=="-"||S(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=S(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function rd(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!Y(e,t,"--"))return!1;for(let i=0;i<o;i++)if(S(e,t+i+2)!==r[i])return!1;return!0}function GC(e){let t=!1;for(let n=0;n<te(e);n++){if(fe(S(e,n))){t=!1;continue}if(xt(e,n,"dd")){t=!0,n++;continue}if(!t||!xt(e,n,"of")||!Y(e,n,"of=/dev/"))continue;let r=n+8;if(r<te(e)&&!q(S(e,r))&&S(e,r)!=="'"&&S(e,r)!=='"')return!0}return!1}function FC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=te(e);){let i=S(e,o);if(o===te(e)||fe(i)){t=!1,n=!1,r=!1,o++;continue}let s=HC(e,o);if(s>=0){if(zC(e,s))return!0;let a=s,l=!1;while(q(S(e,a)))l||=S(e,a)===`
 `,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(Y(e,o,"--")&&(o===0||q(S(e,o-1)))&&(!S(e,o+2)||q(S(e,o+2))||fe(S(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=Y(e,o,"--recursive")&&Rt(e,o+11)||da(e,o,"recursive"),r||=Y(e,o,"--force")&&Rt(e,o+7)||da(e,o,"force"),n&&r)return!0;o++}return!1}function da(e,t,n){if(!Y(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=S(e,t+r+2);if(!o||q(o)||fe(o))break;if(o!==n[r])return!1;r++}return r>0&&Rt(e,t+r+2)}function zC(e,t){let n=t,r=!1,o=!1;while(n<te(e)){while(q(S(e,n)))n++;let i=n;while(n<te(e)&&!q(S(e,n)))n++;if(S(e,i)!=="-"||n-i===2&&Y(e,i,"--"))return!1;let s=od(e,i,"recursive"),a=od(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,S(e,i+1)==="-")continue;let l=BC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function od(e,t,n){return Y(e,t,`--${n}`)&&Rt(e,t+n.length+2)||da(e,t,n)}function HC(e,t){if(t>0&&sn(S(e,t-1)))return-1;let n=t;if(S(e,n)==="\\")n++;if(S(e,n)!=="r")return-1;if(n++,S(e,n)==="\\")n++;if(S(e,n)!=="m"||!q(S(e,n+1)))return-1;return n+1}function BC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(S(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=S(e,c)??"",m=(u==="r"||u==="f")&&Rt(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function id(e,t,n){return _r(e,"reset",Ln,!0,(r)=>S(e,r)==="-"&&Wn(e,r,t,n)?!0:r)}function $C(e){return _r(e,"clean",Ln,!0,(t)=>{if(S(e,t)!=="-")return t;if(Wn(e,t,"--fo","rce"))return!0;let n=wr(e,t,Ln);for(let r=t+1;r<n;r++)if(S(e,r)==="f")return!0;return n-1})}function Jo(e,t,n){if(!xt(e,t,"git"))return null;let r=t+3;if(!q(S(e,r)))return{commandEnd:-1,next:r};while(q(S(e,r)))r++;while(r<te(e)){if(fe(S(e,r)))return{commandEnd:-1,next:r};let o=wr(e,r,fe);if(xt(e,r,n))return{commandEnd:r+n.length,next:o};if(S(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&Y(e,r,"--"),s=UC(e,r,o);r=o;while(q(S(e,r)))r++;if(i)return{commandEnd:xt(e,r,n)?r+n.length:-1,next:wr(e,r,fe)};if(!s)continue;if(r>=te(e)||fe(S(e,r)))return{commandEnd:-1,next:r};r=wr(e,r,fe);while(q(S(e,r)))r++}return{commandEnd:-1,next:r}}function UC(e,t,n){for(let r of Ne)if(n-t===r.length&&Y(e,t,r))return!0;return!1}function jC(e){return sd(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function VC(e){return _r(e,"push",Ln,!0,(t)=>{if(S(e,t)!=="-")return t;if(S(e,t+1)==="f"&&!sn(S(e,t+2))&&!Y(e,t+2,"-with-lease"))return!0;let n=ld(e,t,"--fo","rce");if(n>=0&&!Y(e,n,"-with-lease"))return!0;return t})}function KC(e){return _r(e,"push",fe,!1,(t)=>{if(q(S(e,t))&&S(e,t+1)==="+"&&t+2<te(e)&&!fe(S(e,t+2))&&!q(S(e,t+2)))return!0;if(S(e,t)===":"&&S(e,t+1)==="+")return!0;return t})}function qC(e){return _r(e,"push",fe,!1,(t)=>{if(S(e,t)==="-"&&Wn(e,t,"--de","lete"))return!0;if(q(S(e,t))&&S(e,t+1)===":"&&t+2<te(e)&&!q(S(e,t+2))&&!fe(S(e,t+2)))return!0;return t})}function YC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=te(e);o++){if(o===te(e)||fe(S(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Jo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||S(e,o)!=="-")continue;let i=wr(e,o,fe),s=ZC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function ZC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(S(e,i)!=="-")continue;if(Wn(e,i,"--de","lete"))r=!0;if(Wn(e,i,"--fo","rce"))o=!0;if(S(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&XC(S(e,s))){let u=S(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!Rt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function XC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function JC(e){return sd(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function sd(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<te(e);r++){let o=S(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&S(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(q(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Jo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&q(S(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(Wn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(S(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Rt(e,r+1))return!0;if(Ln(o))i.outerActive=!1}return!1}function _r(e,t,n,r,o){let i=!1;for(let s=0;s<te(e);s++){let a=S(e,s),l=n(a);if(!i&&!l){let c=Jo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||q(S(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(S(e,u)))i=!1;s=c}if(l)i=!1}return!1}function QC(e){let t=!1;for(let n=0;n<te(e);n++){if(ua(S(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Jo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&S(e,n)==="-"&&S(e,n+1)==="-"&&(Y(e,n+2,"staged")||Y(e,n+2,"help")))t=!1}return t}function ad(e,t){let n=!1;for(let r=0;r<te(e);r++){let o=S(e,r),i=t?ua(o):fe(o);if(n&&q(o)&&S(e,r+1)==="-"&&xt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(xt(e,r,"find"))n=!0,r+=3}return!1}function wr(e,t,n){let r=t;while(r<te(e)&&!q(S(e,r))&&!n(S(e,r)))r++;return r}function ld(e,t,n,r){if(!Y(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&S(e,o)===r[i];i++)o++;return Rt(e,o)?o:-1}function Wn(e,t,n,r){return ld(e,t,n,r)>=0}function je(e,t){Rr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Fe(t,a);if((s.regex?.test(a)??!1)||s.scan&&Xo(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var eb=/^[A-Za-z_][A-Za-z0-9_]*=/;function ud(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Rr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return dd(t.nodes,r,i)}function dd(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return dd(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return tb(r,t,n)})}function tb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!eb.test(o.text));return e.words.every((o,i)=>o===t||cd(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||cd(o.target.raw,n.anchored,!0)))}function cd(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var Ar=require("node:path");function Pr(e,t,n,r){let o=Ar.isAbsolute(e)?Ar.resolve(e):t?Ar.resolve(t,e):void 0;if(!o)return;try{return O(o,n,r)}catch{return o}}function md(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var Gn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Tr="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",fa=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),nb=new Set(["-p","--print"]),rb=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),ob=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),ib=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),sb=new Map([["python",new Set(["m"])]]),ab=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),lb=new Set(["always","default","never"]),cb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),ub=/\\\r?\n/g,db=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function fd(e){return ei(e).code}function Qo(e){return ei(e).sources}function pd(e){return db.get(ga(e))??[]}function ei(e){let t=ga(e[0]??"");if(!fa.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return et(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return et(t,n,r,o,i,s);if(t==="node"&&nb.has(s)){let m=e[i+1];if(m===void 0)return et(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(fb(t,s)){let m=e[i+1];if(m===void 0)return et(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return et(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(pb(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=mb(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,et(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return et(t,n,r,o);if(ab.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&cb.has(s))||t==="python"&&!lb.has(m))return et(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(sb.get(t)?.has(d)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return et(t,n,r,o)}if(rb.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(ob.get(t)?.has(d)){if(m+1===s.length)i++;break}if(ib.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return et(t,n,r,o);if(c)i++}return et(t,n,r,o,void 0,void 0,!0)}function et(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
 `))||null,sources:r?c:[],optionsOpen:r&&s}}function mb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function pa(e,t){return ga(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function ga(e){let t=T(e).toLowerCase();return Eo.test(t)?"python":t}function fb(e,t){return fa.get(e)?.has(t)??!1}function pb(e){return fa.get(e)?.has("--eval")??!1}function kr(e,t,n=!1){let r=yb(e,t);if(!ma(r,t))return!1;Fe(t,r);let o=hb(r);if(ma(o,t))return!0;if(Fe(t,o),!gd.test(o))return!1;return!n||gb(r,t)}function gb(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let u=e.startsWith(c.repeat(3),l)?c.repeat(3):c,m=l+u.length,d=m;while(d<e.length&&!e.startsWith(u,d))d+=e[d]==="\\"?2:1;if(d>=e.length)return!0;o.push({start:m,text:e.slice(m,d)}),r.fill(" ",l,d+u.length),l=d+u.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>gd.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:ha(i,c)}});if(s.some((l)=>ya(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),u=s.some((m)=>l.start>=m.start&&l.start<m.end);return(c||u)&&ma(l.text,t)})}function ha(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function ya(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var gd=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function hb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function ma(e,t){if(Zo(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Fe(t,e),r.test(e))return!0;if(Zo(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Fe(t,e),r.test(e))return!0;if(Zo(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Fe(t,e),n.some((o)=>Xo(o,r))))}function yb(e,t){return Fe(t,e),e.replace(ub,"")}var mi=require("node:fs"),mt=require("node:path");var Or=require("node:path");var Ft=require("node:path");function zt(e,t,n){if(bt(t))throw Error("Unsupported Windows namespace path");let r=Ft.isAbsolute(t)?Ft.parse(t).root:"",o=r||e;for(let i of bb(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=Ft.dirname(o);continue}let s=Cb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function Cb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${Ft.sep}${t}`}function bb(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Ca=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],Sb=new Set(Ca),vb=1024,hd=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),yd=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),Eb=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function ti(e){return Sb.has(e)}function ba(e){return ti(e)||hd.has(e)||yd.has(e)||dr(e)}function wt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Cd(e,t){let n=wt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=vb?{state:"valid",count:r}:{state:"invalid"}}function ni(e,t,n){let o=e.match(Eb)?.[1];if(!o||!ba(o))return null;let i=e.indexOf("=");return{name:o,value:`${wt(o,t,n)??""}${e.slice(i+1)}`}}function bd(e){return vd(e,yd)}function Sd(e){return vd(e,hd)}function vd(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var xd=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ve(e){if(!xd.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function ri(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Ve(_(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Rd(e){let t=M(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function an(e,t,n,r){if(!Rd(Fn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<J.wrapperPeelIterations.cap;m++){let d=Ed(i),f=ri(i);for(let[g,h]of f.envAssignments)s.set(g,h),a.set(g,h);if(i=f.words,i.length===0)break;while(i.length>0&&Fn(i).includes("=")&&!Rb(i)){let g=wb(Fn(i),a,t.env)??ni(Fn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=M(Fn(i));if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=Ab(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=kb(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=Ib(i);if(p==="builtin")i=i.slice(tt(i,1)==="--"?2:1);if(Ed(i)===d)break}let u=ri(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:xb(u.words,o)}}function xb(e,t){return e.some((n)=>!t.has(n))}function Ed(e){return e.map(_).join(" ")}function Fn(e){let t=e[0];return t?_(t):""}function tt(e,t){let n=e[t];return n?_(n):void 0}function Rb(e){return xd.test(Fn(e))}function wb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var _b=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Ab(e,t,n){let r=1,o=n;while(r<e.length){let i=tt(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=tt(e,r+1);o=s?Ir(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Ir(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Ir(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(_b.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Pb=new Set(["-i","-0","--null"]),Tb=new Set(["-u","--unset","-C","--chdir","-P"]);function kb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=tt(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(Pb.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=tt(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:tt(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(Tb.has(c)){if(c==="-C"||c==="--chdir"){let m=tt(e,a+1);s=m?Ir(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Ir(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Ve(c))break;while(a<e.length){let m=Ve(tt(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(tt(e,a)==="--")a++;return l(a)}return l(a)}function Ir(e,t,n){if(t==="")return null;if(!e&&!Or.isAbsolute(t))return null;let r=Or.isAbsolute(t)?Or.parse(t).root:n.realpath(e??"/");if(r===null)return null;try{return zt(r,t,n)}catch{return null}}function Ib(e){if(tt(e,1)==="-v")return[...Q(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=tt(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var Ob=/['"\\$`{}#]/;function oi(e,t){if(e.some((r)=>Ob.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function Ht(e,t,n){return ii(e,t,n).tokens}function Mb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Bt(e,t,n,r=0){let o=ii(e,t,n),i=(o.envSplitValues??[]).flatMap(Mb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Bt(s,t,n,r+1)}function ii(e,t,n,r){if(!Rd(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=an(Q(e),t,n,r);return{tokens:o.words.map(_),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var xa=Symbol("adopt-as-operand"),Db=new Set(["env","sudo","command","builtin"]),Nb=new Set(["&&","||","|&","|","&",";"]),Lb=new Set(["<<","<<<",">|"]),Wb=new Set(["|","|&"]),Gb=/[*@#?$!_-]/,Fb=/^\w+(?::\w+)*/,zb=Object.freeze([]),Mr=Object.freeze({kind:"scope",edge:"enter"}),Dr=Object.freeze({kind:"scope",edge:"exit"}),Hb=Object.freeze([]),Bb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Nr=new Set(["bash","sh","zsh","dash","ksh"]),$b=256,Td=new WeakMap;function kd(e,t){let n=t.status==="complete"?new Set(Ea(t)):new Set,r=Vb(e,n);if(Ro(r))return si("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=ln(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return si("structural-limit",r,t);if(o.invalid)return si("invalid",r,t);let s=si("complete",r,t,o.assignmentFallbacks);return Td.set(s,Object.freeze(i)),s}function li(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of Id(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=Ub(a,s,n,r),c=a.length>0&&Wb.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===xa){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function ci(e){return Id(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function Ae(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:Ae(i,t);return a?Ae(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function Lr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function Ub(e,t,n,r){let o=Lr(e)?new Map([...t.variables,...jb(e,t.variables)]):t.variables,i=Ht([...e],n),s=T(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ye(Ae(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function jb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],Ae(o,t)]]:[]})}function Id(e){return Td.get(e)??zb}function Vb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function si(e,t,n,r=Hb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function ln(e,t){return e.nodes.flatMap((n,r)=>Kb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function Kb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[nt(Jb(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[nt(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[ai("{"),...ln(e.body,a),...s?[ai("}")]:[]]:[Mr,nt("("),...ln(e.body,a),...s?[nt(")")]:[],Dr]}]}let o=nS(e,r.functions);if(o){if(r.depth>=Gt.maxDepth||++r.flags.expansions>$b)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...wd(e,r),ai(";"),...ln(o,{...r,depth:r.depth+1}),ai(";")]},..._d(e,t,n,r)]}return[{start:e.span.start,events:wd(e,r)},..._d(e,t,n,r)]}function wd(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Md(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:qb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function qb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Md(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[Ra(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:Qb(r),targetOrder:Lb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:Nd(t)}:{}}),...s===void 0?o:o.slice(1)]}function _d(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[Ra(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[nt(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...Od(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?Yb(t,n,r):[]]}function Yb(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:Od(n.source.slice(r.span.end,e.span.end),n)}]}function Od(e,t){if(t.depth>=Gt.maxDepth)return t.flags.limited=!0,[];let n=Qe(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=ln(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Md(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?nt("glob"):s!==""||e.quoted&&o.length===0?Ra(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of Sa(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(nt(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=Sa(f,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=u?ln(u,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(Mr,...p,Dr);continue}let m=u?ln(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Mr,...m,Dr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?nt("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Mr,...m,...c.raw.endsWith(")")?[nt(")")]:[],Dr);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>nt("(")),...d===1?[Mr]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>nt(")")):[],...d===1?[Dr]:[])}return l(),o}function Sa(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Ad(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Ad(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Ad(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=Xb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return Zb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&Gb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?Fb:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function Zb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Sa(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function Xb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Jb(e){return/^[\r\n]+$/.test(e)?";":e}function nt(e){return Object.freeze({kind:"operator",operator:e,boundary:Nb.has(e)})}function ai(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function Ra(e){return Object.freeze({kind:"word",text:e})}function Qb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function Wr(e){return Bb.has(e)||/^python\d/.test(e)}var eS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Dd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=eS.get(e)?.has(n)??!1;return Dd(e,t.slice(r?2:1))}function va(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return va(e.slice(1));if(!Db.has(t))return[...e];return va(Dd(t,e.slice(1)))}function Nd(e){let t=vr(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return va(n<0?[]:e.words.slice(n).map((r)=>r.text))}function tS(e){let t=Nd(e)[0];if(t===void 0)return!1;let n=T(t).toLowerCase();return Wr(n)&&!Nr.has(n)}function Ea(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Ea(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Ea(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(tS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!oS(t))return r;return[...r,...o]})}function nS(e,t){let n=vr(e);return n===void 0?void 0:t.get(n)}function $t(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function rS(e){if($t(e.words[0],"git"))return $t(e.words[1],"commit");if(!$t(e.words[0],"gh")||!$t(e.words[2],"create"))return!1;return $t(e.words[1],"pr")||$t(e.words[1],"issue")}function oS(e){return($t(e.words[0],"cat")||$t(e.words[0],"tee")||rS(e))&&!e.words.some(Pd)&&!e.redirections.some((n)=>Pd(n.target))}function Pd(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Ld=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Wd=new Set([...Ld,"glob"]),iS=new Set([...Wd,"pattern"]);class rt extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Gr(e){let t=sS(),n=Dt(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:aS(e),store:t}}function Pe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function _t(e,t){if(!e.includes("$"))return e;return os(e,t)}function sS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Qe(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=kd(i,a);return e.set(i,c),c},getCommandProgram:r}}function aS(e){let t=e.route.kind==="grep"?Wd:e.route.kind==="glob"?iS:Ld;return[...uo(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?mo(e.input):[]]}var lS=new Set(["-S","--suffix"]);function zn(e,t,n,r,o){if(e.status==="structural-limit")throw new rt;if(e.status!=="complete")return o.findMalformedTarget(e.source);return li(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(Ae(i.target,s.variables),s)?i.target:null})}function ui(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&lS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Ke="Git metadata and hooks are protected. Ask the user before modifying them.";function Fd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(co(e.invocation.toolName))return null;let a=e.paths.find((l)=>Gd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=Pe(e,"input-candidate");if(!i)return null;let s=zn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>pS(a,l,t,n,r),isRedirectionTarget:(a,l)=>Gd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function cn(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=fi(ye(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(wa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?di(m,l):cS(m,l);if(n.markerFiles.some(u))return!0;return r&&_a(n).some(u)}if(wa(a,n))return!0;return r&&_a(n).some((c)=>di(c,a))}function cS(e,t){let n=mt.relative(t,e);if(n===""||n.startsWith("..")||mt.isAbsolute(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function uS(e,t,n,r,o){return cn(e,t,n,!0,r,o)}function dS(e,t,n,r,o){if(!n)return!1;return wa(fi(ye(e,t,r,o)),n)}function Gd(e,t,n,r,o,i){let s=fi(ye(e,t,r,o));return i.includes(s)||Hd(s,n)}function zd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>di(i,fi(ye(s,t,r,o)))))}function wa(e,t){return t.entries.includes(e)||t.directories.includes(e)||Hd(e,t)}function Hd(e,t){return t.hooksDirectories.some((n)=>di(e,n))}var mS=50000;function Bd(e,t){let n=[...new Set(_a(e))];if(n.some((o)=>t(mt.basename(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=fS(o);if(!i)return!0;if(r+=i.length,r>mS)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>mt.join(o,s.name)))}return!1}function fS(e){try{let t=mi.lstatSync(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return mi.readdirSync(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function _a(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function di(e,t){let n=mt.relative(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!mt.isAbsolute(n)}function fi(e){return process.platform==="win32"?e.toLowerCase():e}function pS(e,t,n,r,o){if(Lr(e))return null;let i=Bt([...e],r);if(T(i[0]??"").toLowerCase()!=="mv")return null;let s=ui(i.slice(1)),a=s.sources.find((l)=>uS(Ae(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&dS(Ae(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}var Z=require("node:path");var ze=require("node:path"),gS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],hS=` 	
-`;function Fr(e,t){if(Ut(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Aa(e.get("TMPDIR")??"",t)}function un(e,t){if(e.has("TMPDIR"))return Aa(e.get("TMPDIR")??"",t);let n=Pa(e,t);if(n===void 0)return!0;return Aa(n,t)}function Pa(e,t){return jd(e,t,"TMPDIR")}function Aa(e,t){if(!e)return!1;if(CS(e))return!1;return Hn(e,t)}function Ut(e,t){let n=jd(e,t,"IFS");return n!==void 0&&n!==""&&n!==hS}function Hn(e,t){let n=pi(e,t.paths);if(n===null)return!1;return Ud(t).some((r)=>Bn(n,r))}function hi(e,t){let n=pi(e,t.paths);if(n===null)return!1;return Ud(t).some((r)=>gi(r)===gi(n))}var $d=new WeakMap;function Ud(e){let t=$d.get(e);if(t)return t;let n=yS(e);return $d.set(e,n),n}function yS(e){let t=gS.map((r)=>pi(r,e.paths)??ze.normalize(r)),n=pi(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&bS(n))return[...t,n];return t}function CS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function jd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function bS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function pi(e,t){try{let n=ze.normalize(e);if(!ze.isAbsolute(n))return n;let r=ze.parse(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=ze.join(i,o[s]??"");if(t.entryKind(a)==="missing")return ze.join(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Bn(e,t){let n=gi(e),r=gi(t);if(n===r)return!0;let o=r.endsWith(ze.sep)?r:`${r}${ze.sep}`;return n.startsWith(o)}function gi(e){return process.platform==="win32"?e.toLowerCase():e}var SS=process.platform==="win32",Vd=64,vS=16384;function zr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!me(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!me(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function Hr(e){let t=$u(e,Vd,Vd,vS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:ES(e)}}function ES(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>xS(e.raw,n.span.start-e.span.start))}function xS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function jt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??ue();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:TS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function ot(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&IS(e))return{kind:"outside_anchored_cwd"};let o=!r&&qd(e,t.posixShell);if(bt(e))return{kind:"outside_anchored_cwd"};if(ka(e,r))return{kind:"root_or_home_target"};if(wS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&cn(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(_S(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(kS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&NS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>LS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(WS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(RS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function RS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Z.isAbsolute(r)||r.startsWith("~"))return!1;if(Ia(r))return!1;if(Yd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return Hn(Z.resolve(t.resolvedCwd,r),t.environment)}function Kd(e,t,n={}){let{containmentTarget:r,...o}=n;if(ot(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(PS(i))return!1;if(hi(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Yd(r??i,s,t.environment.paths,t.budget))}function ka(e,t=!1){let n=e.trim(),r=Z.posix.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function wS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Z.isAbsolute(o)?o:t.resolvedCwd?Z.resolve(t.resolvedCwd,o):null;if(!i)return!1;let s=Te(O(i,t.environment.paths,t.budget));if(s===Z.parse(s).root)return!0;return s===Te(O(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function Te(e){let t=Z.normalize(e);if(SS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function _S(e,t,n,r,o,i,s,a){let l=e.trim();if(Ia(l))return!1;if(!r&&Hn(l,a))return!0;return(t||i&&s)&&n&&!o&&AS(l,n)}function AS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!qd(e.slice(n.length+1),t)})}function PS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Z.posix.normalize(`/${t[1]??""}`)==="/"}function Ia(e){return e.split(/[\\/]+/).includes("..")}function TS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Cr(o.trim(),t);if(!Z.isAbsolute(i))return[];try{let s=O(i,n,r);if(br(s,O(t,n,r)))return[];return[Te(s)]}catch{return[]}})}function kS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(Ia(r))return!1;let o=n?r:Cr(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Z.isAbsolute(o)?o:i?Z.resolve(i,o):null;if(!s)return!1;try{let a=Te(O(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Z.sep)?l:`${l}${Z.sep}`))}catch{return!1}}function IS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function qd(e,t=!1){return e.includes("$")||e.includes("`")||OS(e)||t&&MS(e)}function OS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function MS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&DS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function DS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function NS(e,t,n,r){try{return Te(O(e,n,r))===Te(O(t,n,r))}catch{try{return Te(e)===Te(t)}catch{return!1}}}function LS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return Te(O(Z.resolve(t,e),n,r))===Te(O(o,n,r))}catch{try{return Te(Z.resolve(t,e))===Te(o)}catch{return!1}}}function WS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Ta(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Ta(Z.resolve(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Ta(Z.resolve(a,e),t,i,s)}catch{return!1}}function Ta(e,t,n,r){try{return Zd(O(e,n,r),O(t,n,r))}catch{return!1}}function Yd(e,t,n,r){if(!t)return!1;try{return Zd(O(t,n,r),O(e,n,r))}catch{return!0}}function Zd(e,t){let n=Te(e),r=Te(t);return n.startsWith(`${r}${Z.sep}`)||n===r}var GS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Xd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",FS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Jd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Qd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",zS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",HS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",BS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Qd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Ke},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Jd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:zS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Xd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:FS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Xd}};function em(e,t,n,r=jt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return $S(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function $S(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=jS(o),s=o[i];if(!s||!GS.has(ev(s.text)))return null;let a=US(o.slice(i+1));if(a.whatIfProtected)return null;if(me(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",HS);for(let l of a.targets)if(!bt(l.text)&&ka(Ma(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Qd);for(let l of a.targets)if(n.resolvedCwd&&cn(Ma(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",Ke);if(!a.recursive||!a.force)return null;if(me(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",Jd);for(let l of a.targets){let c=zr(ot(Ma(l.text),n),n,r,BS);if(c)return c}return null}function US(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(VS(l))continue;if(s){t.push(Oa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=qS(l.text);if(!c){t.push(Oa(l)),i=i||l.dynamic;continue}if(YS(c.name)){let u=c.value?KS(c.value,l):e[++a];if(u?.kind==="word"){t.push(Oa(u)),i=i||u.dynamic;continue}i=!0;continue}if(ZS(c.name)){n=!0;continue}if(XS(c.name)){r=!0;continue}if(JS(c.name))o=QS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function jS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Oa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function VS(e){return e.kind==="word"&&e.text===","}function Ma(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function KS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function qS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function YS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function ZS(e){return"recurse".startsWith(e)}function XS(e){return e.length>=2&&"force".startsWith(e)}function JS(e){return e==="wi"||"whatif".startsWith(e)}function QS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function ev(e){return e.toLowerCase()}var $n="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",yi="Unsupported heredoc syntax",Br="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",tm="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var tv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),nv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),rv=new Set(["-o","--output","--query","--subscription"]),ov=new Set;function nm(e){if(e==="aws")return tv;if(e==="gcloud")return nv;if(e==="az")return rv;return ov}var iv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),sv=new Set;function rm(e){if(e==="git")return Ne;if(e==="docker")return iv;return sv}function At(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=we(e);for(let o of t){if(!cv(n,o.command))continue;if(o.match){if(av(n,e,o.match))return om(o);continue}if(!uv(n,e,o.subcommand))continue;if(mv(e,new Set(o.block_args),r))return om(o)}return null}function om(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function av(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return lv(r,n.command_path,nm(e))}function lv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function cv(e,t){return e===M(t)}function uv(e,t,n){if(!n)return!0;return im(t,1,n,rm(e))}function im(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&dv(e,i,n,r))return!0;continue}return s===n}return!1}function dv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return im(e,t+2,n,r)}function mv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var fv=new Set(["-e","--source"]),pv=new Set(["-F","-v","--assign","--field-separator"]),sm=new Set(["-f","--file"]),gv=new Set(["print","printf","return"]),am=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],hv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function lm(e,t,n){let r=!1;for(let o of yv(e)){let i=Cv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",hv):null}function Na(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&fv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(pv.has(a)||sm.has(a))){let l=e[s+1];if(i&&=l!==void 0,sm.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function Ur(e){return Na(e).sources}function yv(e){return Ur(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Cv(e,t){Fe(t,e);let n=e.includes("system")?La(e,t):null,r=bv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function La(e,t){Fe(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=bi(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=cm(e,i+1);continue}if(s==="/"&&um(e,i)){i=dm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,$r(e[a-1])||$r(e[i]))continue;let l=Ci(e,i);if(e[l]!=="(")continue;l=Ci(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=bi(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Ci(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function bv(e,t){Fe(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=bi(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=cm(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&um(e,i)){let f=dm(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+`;function Fr(e,t){if(Ut(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Aa(e.get("TMPDIR")??"",t)}function un(e,t){if(e.has("TMPDIR"))return Aa(e.get("TMPDIR")??"",t);let n=Pa(e,t);if(n===void 0)return!0;return Aa(n,t)}function Pa(e,t){return jd(e,t,"TMPDIR")}function Aa(e,t){if(!e)return!1;if(CS(e))return!1;return Hn(e,t)}function Ut(e,t){let n=jd(e,t,"IFS");return n!==void 0&&n!==""&&n!==hS}function Hn(e,t){let n=pi(e,t.paths);if(n===null)return!1;return Ud(t).some((r)=>Bn(n,r))}function hi(e,t){let n=pi(e,t.paths);if(n===null)return!1;return Ud(t).some((r)=>gi(r)===gi(n))}var $d=new WeakMap;function Ud(e){let t=$d.get(e);if(t)return t;let n=yS(e);return $d.set(e,n),n}function yS(e){let t=gS.map((r)=>pi(r,e.paths)??ze.normalize(r)),n=pi(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&bS(n))return[...t,n];return t}function CS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function jd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function bS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function pi(e,t){try{let n=ze.normalize(e);if(!ze.isAbsolute(n))return n;let r=ze.parse(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=ze.join(i,o[s]??"");if(t.entryKind(a)==="missing")return ze.join(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Bn(e,t){let n=gi(e),r=gi(t);if(n===r)return!0;let o=r.endsWith(ze.sep)?r:`${r}${ze.sep}`;return n.startsWith(o)}function gi(e){return process.platform==="win32"?e.toLowerCase():e}var SS=process.platform==="win32",Vd=64,vS=16384;function zr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!me(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!me(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function Hr(e){let t=$u(e,Vd,Vd,vS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:ES(e)}}function ES(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>xS(e.raw,n.span.start-e.span.start))}function xS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function jt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??ue();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:TS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function ot(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&IS(e))return{kind:"outside_anchored_cwd"};let o=!r&&qd(e,t.posixShell);if(bt(e))return{kind:"outside_anchored_cwd"};if(ka(e,r))return{kind:"root_or_home_target"};if(wS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&cn(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(_S(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(kS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&NS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>LS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(WS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(RS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function RS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Z.isAbsolute(r)||r.startsWith("~"))return!1;if(Ia(r))return!1;if(Yd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return Hn(Z.resolve(t.resolvedCwd,r),t.environment)}function Kd(e,t,n={}){let{containmentTarget:r,...o}=n;if(ot(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(PS(i))return!1;if(hi(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Yd(r??i,s,t.environment.paths,t.budget))}function ka(e,t=!1){let n=e.trim(),r=Z.posix.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function wS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Z.isAbsolute(o)?o:t.resolvedCwd?Z.resolve(t.resolvedCwd,o):null;if(!i)return!1;let s=Te(O(i,t.environment.paths,t.budget));if(s===Z.parse(s).root)return!0;return s===Te(O(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function Te(e){let t=Z.normalize(e);if(SS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function _S(e,t,n,r,o,i,s,a){let l=e.trim();if(Ia(l))return!1;if(!r&&Hn(l,a))return!0;return(t||i&&s)&&n&&!o&&AS(l,n)}function AS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!qd(e.slice(n.length+1),t)})}function PS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Z.posix.normalize(`/${t[1]??""}`)==="/"}function Ia(e){return e.split(/[\\/]+/).includes("..")}function TS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Cr(o.trim(),t);if(!Z.isAbsolute(i))return[];try{let s=O(i,n,r);if(br(s,O(t,n,r)))return[];return[Te(s)]}catch{return[]}})}function kS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(Ia(r))return!1;let o=n?r:Cr(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Z.isAbsolute(o)?o:i?Z.resolve(i,o):null;if(!s)return!1;try{let a=Te(O(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Z.sep)?l:`${l}${Z.sep}`))}catch{return!1}}function IS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function qd(e,t=!1){return e.includes("$")||e.includes("`")||OS(e)||t&&MS(e)}function OS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function MS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&DS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function DS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function NS(e,t,n,r){try{return Te(O(e,n,r))===Te(O(t,n,r))}catch{try{return Te(e)===Te(t)}catch{return!1}}}function LS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return Te(O(Z.resolve(t,e),n,r))===Te(O(o,n,r))}catch{try{return Te(Z.resolve(t,e))===Te(o)}catch{return!1}}}function WS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Ta(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Ta(Z.resolve(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Ta(Z.resolve(a,e),t,i,s)}catch{return!1}}function Ta(e,t,n,r){try{return Zd(O(e,n,r),O(t,n,r))}catch{return!1}}function Yd(e,t,n,r){if(!t)return!1;try{return Zd(O(t,n,r),O(e,n,r))}catch{return!0}}function Zd(e,t){let n=Te(e),r=Te(t);return n.startsWith(`${r}${Z.sep}`)||n===r}var GS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Xd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",FS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Jd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Qd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",zS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",HS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",BS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Qd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Ke},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Jd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:zS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Xd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:FS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Xd}};function em(e,t,n,r=jt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return $S(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function $S(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=jS(o),s=o[i];if(!s||!GS.has(ev(s.text)))return null;let a=US(o.slice(i+1));if(a.whatIfProtected)return null;if(me(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",HS);for(let l of a.targets)if(!bt(l.text)&&ka(Ma(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Qd);for(let l of a.targets)if(n.resolvedCwd&&cn(Ma(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",Ke);if(!a.recursive||!a.force)return null;if(me(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",Jd);for(let l of a.targets){let c=zr(ot(Ma(l.text),n),n,r,BS);if(c)return c}return null}function US(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(VS(l))continue;if(s){t.push(Oa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=qS(l.text);if(!c){t.push(Oa(l)),i=i||l.dynamic;continue}if(YS(c.name)){let u=c.value?KS(c.value,l):e[++a];if(u?.kind==="word"){t.push(Oa(u)),i=i||u.dynamic;continue}i=!0;continue}if(ZS(c.name)){n=!0;continue}if(XS(c.name)){r=!0;continue}if(JS(c.name))o=QS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function jS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Oa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function VS(e){return e.kind==="word"&&e.text===","}function Ma(e){let t=e.replace(/\\/g,"/"),n=/^(?:\$env:(?:userprofile|home)|\$home|\$\{home\})(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function KS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function qS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function YS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function ZS(e){return"recurse".startsWith(e)}function XS(e){return e.length>=2&&"force".startsWith(e)}function JS(e){return e==="wi"||"whatif".startsWith(e)}function QS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function ev(e){return e.toLowerCase()}var $n="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",yi="Unsupported heredoc syntax",Br="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",tm="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var tv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),nv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),rv=new Set(["-o","--output","--query","--subscription"]),ov=new Set;function nm(e){if(e==="aws")return tv;if(e==="gcloud")return nv;if(e==="az")return rv;return ov}var iv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),sv=new Set;function rm(e){if(e==="git")return Ne;if(e==="docker")return iv;return sv}function At(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=we(e);for(let o of t){if(!cv(n,o.command))continue;if(o.match){if(av(n,e,o.match))return om(o);continue}if(!uv(n,e,o.subcommand))continue;if(mv(e,new Set(o.block_args),r))return om(o)}return null}function om(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function av(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return lv(r,n.command_path,nm(e))}function lv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function cv(e,t){return e===M(t)}function uv(e,t,n){if(!n)return!0;return im(t,1,n,rm(e))}function im(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&dv(e,i,n,r))return!0;continue}return s===n}return!1}function dv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return im(e,t+2,n,r)}function mv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var fv=new Set(["-e","--source"]),pv=new Set(["-F","-v","--assign","--field-separator"]),sm=new Set(["-f","--file"]),gv=new Set(["print","printf","return"]),am=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],hv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function lm(e,t,n){let r=!1;for(let o of yv(e)){let i=Cv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",hv):null}function Na(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&fv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(pv.has(a)||sm.has(a))){let l=e[s+1];if(i&&=l!==void 0,sm.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function Ur(e){return Na(e).sources}function yv(e){return Ur(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Cv(e,t){Fe(t,e);let n=e.includes("system")?La(e,t):null,r=bv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function La(e,t){Fe(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=bi(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=cm(e,i+1);continue}if(s==="/"&&um(e,i)){i=dm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,$r(e[a-1])||$r(e[i]))continue;let l=Ci(e,i);if(e[l]!=="(")continue;l=Ci(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=bi(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Ci(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function bv(e,t){Fe(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=bi(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=cm(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&um(e,i)){let f=dm(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
 {}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Da(e,i,"print")||Da(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=Ci(e,m);if(Da(e,d,"getline")){o=!0;let f=Ev(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Rv(s,a)){o=!0;let f=vv(e,d);if(!f){r=!0,c=m,i=m;continue}if(!Sv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function $r(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Ci(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Sv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
 }#`.includes(r)}function bi(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=xv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function vv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return bi(e,t,n)}function Ev(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function xv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
 `,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Da(e,t,n){return e.startsWith(n,t)&&!$r(e[t-1])&&!$r(e[t+n.length])}function Rv(e,t){return t!==null&&t>=e}function cm(e,t){let n=e.indexOf(`
@@ -43,5 +43,5 @@ var gg=["-h","--help"];function io(e,t){let n=Object.entries(e.booleans??{}),r=O
 `).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function l_(e,t,n,r,o,i){let s=Mt(e);if(s.length===0||ct(s[0]??"").toLowerCase()!=="xargs")return!1;let a=gn(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,El]:l.map((m)=>m.split(c).join(El));return ji(u,t,n,r,o,i).some((m)=>m.target.includes(El))}function c_(e){let t=Mt(e);if(t.length===0)return null;let n=ct(t[0]??"").toLowerCase();if(!Wr(n))return null;return u_(n,t.slice(1))?n:null}function u_(e,t){let n=kl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Pp.has(o)||Op(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(Qw.get(n)?.has(o))r++;continue}return!1}return!0}function kl(e){return/^python\d/.test(e)?"python":e}function d_(e){let t=[];for(let n of e){if(Dp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Sp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function m_(e,t){if(!t||!Sp.test(e))return e;return`~${e.replace(Sp,"").replace(/\\/g,"/")}`}function ht(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function f_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>ht("jq",i))}return e.flatMap((r,o)=>o===t?[]:ht("jq",r))}function p_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...zw.has(r)?wl("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),Hw):wl("git",e.slice(n),Bw)];if(t.push(...ht("git",r)),!Ne.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:ht("git",o)),n++}return t}function wl(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>ht(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...ht(e,i))}return r}function g_(e){return e.flatMap((t,n)=>{let r=y_(t);if(r!==null)return vp(r.flag,r.value);let o=h_(e[n-1]);return o===null?[]:vp(o,t)})}function vp(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return xl(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return xl(t.slice(n+1))}return t.startsWith("@")?xl(t.slice(1)):[]}function h_(e){if(e===void 0)return null;if(Ap.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function y_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Ap.has(r)?{flag:r,value:e.slice(n+1)}:null}function xl(e){return e===""||e==="-"?[]:[e]}function C_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!Iw.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>Ow.has(f)),m=u===-1?c:c.slice(0,u),d=ji(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,g)=>{if(!Dw.has(f))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function b_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Pp.has(c)||Op(e,c)){let m=t[l+1];if(m!==void 0)a.push(...Ui(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...Ui(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Op(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return Ww.get(t[t.length-1]??"")?.has(kl(e))??!1}function S_(e,t,n,r,o,i){if(!e.includes("system"))return[];return La(e)?.commands.flatMap((s)=>Qn(t.getShellSyntax(s),t,n,r,o,i))??[]}function v_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function E_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Il),...e.match(Rl)??[]]}function Ui(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=R_(t,x_(e));if(l.kind==="unmaskable")return E_(t).map(a);let c=l.masked.match(hp)!==null||l.literals.some((g)=>yp.test(l.masked.slice(0,g.start))),u=l.masked.match(Xw)!==null||l.literals.some((g)=>Jw.test(l.masked.slice(0,g.start))),m=r.inlineLiteralsPresumedData===!0&&!Nr.has(e),d=m&&!(P_(l.masked)||c||u)?[]:l.literals,f=m?Array.from(l.masked.matchAll(hp),(g)=>{let h=g.index+g[0].length;return{start:h,end:ha(l.masked,h)}}):[],p=!m||f.some((g)=>ya(l.masked,g.start))?l.literals:l.literals.filter((g)=>yp.test(l.masked.slice(0,g.start))||f.some((h)=>g.start>=h.start&&g.start<h.end));return[...d.map((g)=>g.text).filter((g)=>g!=="").map(a),...d.flatMap((g)=>Il(g.text)).map(a),...m?[]:l.literals.flatMap((g)=>g.text.match(Rl)??[]).map(a),...c?p.flatMap((g)=>Pl(g.text,n,r,o,i,s)??[a(g.text)]):[],...u?l.literals.flatMap((g)=>Ui(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
 `:y),n,r,o,i,s)):[],...(l.masked.match(Rl)??[]).map(a)]}function x_(e){let t=kl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function R_(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(Yw.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&A_(e,o))return{kind:"unmaskable"};let a=t==="python"?w_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=__(e,c,l);if(u===null)return{kind:"unmaskable"};let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&Zw.test(m))return{kind:"unmaskable"};r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function w_(e,t){return qw.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function __(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
 `||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function A_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function P_(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(Nw.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>Lw.has(i)))continue;if(o.length>1)return!0;if(T_(e,r)===".")return!0;if(k_(e,r+n.length)==="(")return!0}return!1}function T_(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function k_(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function I_(e,t,n,r,o,i){return L_(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Qn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...O_(a,r)?M_(a,r).map((l)=>({target:l,cwd:o})):[]]})}function O_(e,t){let n=ci(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||ct(_t(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=_t(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function M_(e,t){return ci(e).flatMap((n)=>n.kind==="word"?[_t(n.text,t)]:n.kind==="redirection"&&n.target?[_t(n.target,t)]:[]).flatMap(Il)}function Il(e){let t=N_(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||D_(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function D_(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function N_(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function L_(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(gr(o,n))continue;if(Mp(e,r,n)){let i=W_(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=G_(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function W_(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(gr(i,n))continue;if(Mp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function G_(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Mp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function F_(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===$w)o=!0;if(jw.has(m))r=!0;if(d!==void 0){if(m===gp)t.push(d);continue}if(Kw.has(m)){let f=e[l+1];if(m===gp&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let g=0;g<m.length;g++){let h=m[g]??"";if(Uw.has(h))r=!0;if(Vw.has(h)){d=h,f=m.slice(g+1);break}}if(d==="")continue;if(f.length>0){if(d===pp)t.push(f);continue}let p=e[l+1];if(d===pp&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Mt(e){let t=e.findIndex((n)=>!Dp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Dp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var z_=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),H_=".env.",B_=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),$_=[".env.example.",".env.sample."];function U_(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function j_(e){return e.length>0&&!/\s/.test(e)}function _l(e,t,n,r){let o=Np(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function Np(e,t,n,r){try{return ro(e,t,n,r)}catch(o){if(o instanceof N)throw o;return""}}var V_=new Set(["node_modules","__pycache__"]),K_=[["vendor","bundle"],["vendor","cache"]];function q_(e,t,n,r,o){if(U_(e))return null;let i=gt(e,t,r,o);if(!i)return null;let s=V(i.split("/").pop()??""),a=V(i),l=()=>j_(s)||_l(e,t,r,o);if(B_.has(s)||$_.some((d)=>s.startsWith(d)))return null;let c=V(eA(e,t,r,o));for(let d of Os){let f=`~/${d.suffixParts.join("/")}`;if((xp(a,f)||xp(c,f))&&Ot(d.id,n))return d.id}let u=Y_(i,t,n,r,o);if(u)return u;if(z_.has(s))return null;for(let d of Is)if(s===d.basename&&Ot(d.id,n))return d.id;if(s.startsWith(H_)&&Ot(Ao.id,n)&&l())return Ao.id;for(let d of Ms)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&Ot(d.id,n)&&l())return d.id}for(let d of Ds)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&Ot(d.id,n))return d.id}if(J_(a))return null;if(!s.includes(".")&&yr.pattern.test(s)&&Ot(yr.id,n))return yr.id;let m=Q_(s,n);if(m)return m;return null}function Y_(e,t,n,r,o){return Po.find((i)=>{if(!Ot(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return B(e,X(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=V(e).split("/");return B(e,X(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||no(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return B(e,gt("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=X(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return B(e,s,["auth.json",".credentials.json"])||to(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=X(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=V(e).split("/").at(-1)??"";return B(e,s,["config.toml"])||a.endsWith(".config.toml")&&B(e,s,[a])}case"secret.cli.gemini":return B(e,be(X(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=V(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[be(X(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return B(e,be(X(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?no(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>B(e,gt(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=X(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return B(e,s,["config.json"])||to(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return B(e,X(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=X(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=X(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return B(e,s,["server.token"])||to(e,s,["credentials"])||to(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=V(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||B(e,X(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||B(e,X(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=be(X(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=V(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return B(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&B(e,s,[a])||c.some((u)=>no(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=be(X(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[be(X(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(V(e).split("/").at(-1)??"")||B(e,s,["config.json"])||(c?.trim()?no(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>B(e,gt(u,t,r,o),l))}case"secret.cli.pi":return B(e,X(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return B(e,X(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=gt("~",t,r,o);return[be(X(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),be(s,".local","share","amp")].some((l)=>B(e,l,["secrets.json"]))||to(e,be(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[be(X(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),be(gt("~",t,r,o),".config","amp")],l=V(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>B(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?no(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=be(X(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=be(X(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return B(e,gt("~/.cursor",t,r,o),["auth.json"])||B(e,s,["auth.json"])||V(e).split("/").at(-1)==="mcp-auth.json"&&Sn(V(e),V(a))}case"secret.cli.cursor.config":{let s=V(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return B(e,X(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=V(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||B(e,X(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||B(e,gt("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Ep=new WeakMap;function X(e,t,n,r,o){let i=Ep.get(o)??new Map;Ep.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=gt(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function B(e,t,n){return n.some((r)=>Lp(e,be(t,r)))}function to(e,t,n){return n.some((r)=>Sn(V(e),V(be(t,r))))}function no(e,t,n,r,o){return Lp(e,gt(t,n,r,o))}function Lp(e,t){return V(e)===V(t)}function be(e,...t){return lt([e,...t].filter(Boolean).join("/"))}function Z_(e,t,n,r,o,i){if(n.length===0)return!1;let s=V(ro(e,t,o,i));return n.some((a)=>Sn(s,V(ro(a,r,o,i))))}function X_(e,t,n,r,o,i){if(n.length===0)return!1;let s=V(ro(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?lt(O(De(a),o.paths,i)):"",c=V(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=V(u?lt(O(xe.resolve(De(u)),o.paths,i)):l&&lt(O(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Sn(s,m))return!1;return n.some((d)=>{let f=Gs(d);if(f&&xe.posix.basename(s)!==V(f.name))return!1;let p=V(ro(f?.root??d,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return Sn(s,p)&&!(f&&s===p)})}function J_(e){let t=e.split("/");return t.some((n)=>V_.has(n))||K_.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Q_(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Ns)if(r===o.extension&&Ot(o.id,t))return o.id;for(let o of Ls)if(o.pattern.test(r)&&Ot(o.id,t))return o.id;return null}function V(e){return e.toLowerCase()}function Ot(e,t){return!t?.disabledRules?.includes(e)}function gt(e,t,n,r){let{home:o,normalized:i}=Ol(e,n,r);if(!i)return"";if(!o)return i;let s=Ml(i,o),a=xe.isAbsolute(s)?s:lt(xe.resolve(t,s)),l=lt(O(a,n.paths,r));if(!Sn(l,o)){if(xe.isAbsolute(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function xp(e,t){return e===t||e.startsWith(`${t}/`)}function eA(e,t,n,r){let{home:o,normalized:i}=Ol(e,n,r);if(!i||!o)return"";let s=Ml(i,o),a=xe.posix.normalize(xe.isAbsolute(s)?s:lt(xe.resolve(t,s))),l=lt(De(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Sn(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function ro(e,t,n,r){let{home:o,normalized:i}=Ol(e,n,r);if(!i)return"";let s=o?Ml(i,o):i;return lt(O(xe.isAbsolute(s)?s:xe.resolve(t,s),n.paths,r))}function Ol(e,t,n){let r=t.env.get("HOME")??t.home,o=r?lt(O(De(r),t.paths,n)):"",i=lt(De(tA(_t(e,t))));return{home:o,normalized:i}}function tA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return Rp.fileURLToPath(e)}catch{return e}}function Ml(e,t){if(e==="~")return t;if(e.startsWith("~/"))return be(t,e.slice(2));return e}function nA(e){if(process.platform==="win32")return!0;return xe.win32.parse(e).root.length>1}function lt(e){let t=e.trim(),n=(t.includes("\\")&&nA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Sn(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function ct(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class vn extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var rA={findPolicyMutation:dp,findGitMetadataMutation:Fd,resolveGitMetadata:iA,loadPolicySnapshot:ku,findSensitiveTarget:Tp,analyzeCommand:np,getModes:fs},oA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function Wp(e,t){let n={...rA,...t.dependencies},r=lA(e),o=oo(e)?e.command:r,i=Zt("policy-protection",o,()=>Gr(e)),s=Pe(i,"input-candidate"),a=Pe(i,"declared-command");if(oo(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:ut,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:tm,intent:"stop_and_explain"}};let l=ue(),c=Zt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=Zt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let C=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:up,intent:"hard_stop",evidence:{command:C,segment:u.target}}}}let m=Zt("policy-protection",o,()=>sp(i,t.environment,l));if(m){let C=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:ip,intent:"hard_stop",evidence:{command:C,segment:m.target}}}}let d=Zt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let C=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ke,intent:"hard_stop",evidence:{command:C,segment:d.target}}}}let f=Zt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...sA(f)},y=p.secretProtection.enabled===!1?null:Zt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:oo(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let C=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:wp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:C,segment:y.target}}}}if(!oo(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Dl("command-validation",o),...h};let b=Zt("command-analysis",o,()=>rp(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},aA(i),i.store),e.command,t.trace));if(b.decision){let C=!g.strict&&(b.decision.ruleId==="raw-text.dangerous-command"||b.decision.reason===Br&&!oA.test(b.decision.evidence?.segment??"")&&je(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in b?{errorCode:b.errorCode}:{},decision:C?{...b.decision,unverifiedByStandardMode:!0}:b.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function iA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function sA(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function aA(e){return Pe(e,"declared-command")?.program}function lA(e){try{return Dt(e.input)}catch(t){let n=oo(e)?e.command:void 0;throw new vn("policy-protection",Dl("policy-protection",t instanceof Se?void 0:n,t),t)}}function Zt(e,t,n){try{return n()}catch(r){throw new vn(e,Dl(e,r instanceof Se?void 0:t,r),r)}}function Dl(e,t,n){let r=n instanceof N||n instanceof rt;return{stage:e,decision:{kind:"deny",reason:r?Qi:sr,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function oo(e){return e.route.kind==="command"}var Ki=require("node:fs"),tr=require("node:path");var le=require("node:fs"),er=require("node:path");function Gp(e,t={}){return Wo(Tn(e,t),e.home).policy.audit.retention_days}var Ll=86400000,cA=".last-prune",uA=/^\d{4}-\d{2}$/,dA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Fp=(e)=>Math.floor(e/Ll);function Hp(e,t,n=()=>new Date){try{let r=n().getTime();if(!le.statSync(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=er.join(t,cA),i=le.statSync(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Fp(i)===Fp(r))return;let s=r-Gp(e)*Ll,a=new Date(r).toISOString().slice(0,7);for(let l of Nl(t)){if(l.isDirectory()){mA(er.join(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))fA(er.join(t,l.name),s)}le.writeFileSync(o,"",{mode:384}),le.utimesSync(o,r/1000,r/1000)}catch{}}function mA(e,t,n){for(let r of Nl(e)){if(!r.isDirectory()||!uA.test(r.name))continue;let o=er.join(e,r.name);for(let i of Nl(o)){if(!i.isFile())continue;let s=dA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+Ll;if(!Number.isFinite(a)||a>=t)continue;Bp(er.join(o,i.name))}if(r.name!==n)zp(o)}zp(e)}function fA(e,t){try{let n=le.lstatSync(e);if(n.mtimeMs>=t)return;let r=le.readFileSync(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(pA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(le.lstatSync(e).mtimeMs!==n.mtimeMs)return;Bp(e)}catch{}}function pA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Nl(e){try{return le.readdirSync(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Bp(e){try{le.unlinkSync(e)}catch{}}function zp(e){try{le.rmdirSync(e)}catch{}}var gA="2.4.15",hA=1e4,yA=2000,CA=256,bA=32768;function SA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function vA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Wl(e,t,n,r,o,i,s={}){let a=SA(t);if(!a)return;let l=xA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=Vi(Ct(n),s.failureStage?Number.POSITIVE_INFINITY:hA),m=Vi(Ct(r),yA),d=s.toolName?Vi(Ct(s.toolName),CA):void 0,f=i===null?void 0:Vi(Ct(i),bA),p=tr.join(l,vA(f?.value??null),c.slice(0,7));Ki.mkdirSync(p,{recursive:!0,mode:448});let g=tr.join(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??gs)(),v:gA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Ki.appendFileSync(g,`${JSON.stringify(h)}
-`,{encoding:"utf-8",mode:384}),Hp(e,l,s.now)}catch{}}function Vi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function EA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&tr.isAbsolute(n)?n:null}function xA(e){let t=EA(e);return t?tr.join(t,".cc-safety-net","logs"):null}function Up(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=$p(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?$p(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function $p(e){return"command"in e?e.command??"":""}function jp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Wl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Vp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Wl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function qp(e,t,n){try{let r=Wp(t,{environment:e,...n.guard});return Kp(e,t,r,n),r}catch(r){if(!(r instanceof vn))throw r;throw Kp(e,t,r.evaluation,n,!(r.cause instanceof Se),{stage:r.stage,errorCode:RA(r.cause)}),r}}function Kp(e,t,n,r,o=!0,i){jp(e,Up(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function RA(e){if(e instanceof N)return J[e.kind].errorCode;if(e instanceof Se)return"tool-input-limit";if(e instanceof rt)return"structural-shell-syntax-limit";return"unexpected-error"}var En=(e,t,n,r,o)=>mc(e.cwd,t,n,r,o.paths,process.cwd()),qi=(e,t,n)=>(r,o,i,s,a)=>{let l=En(r,o,i,s,a);if(!l)return null;let c=r.tool_input;if(!t.has(i)||!c||!Object.hasOwn(c,e))return l;let u=c[e];if(n?.emptyMeansSessionCwd&&u==="")return l;if(typeof u!=="string"||u.trim()==="")return ve(s,o,i),null;let m=n?.allowOutsideSessionCwd?ls(u,l.configCwd,a.paths):St(u,[l.configCwd],a.paths);if(m)return{configCwd:l.configCwd,executionCwd:m};return $e(s,o,i,{directory:"requested",problem:Et(u,l.configCwd,a.paths),cwd:u}),null};function wA(e,t){console.log(JSON.stringify(e($l(t))))}async function _A(e){let t;try{t=(await dc(process.stdin)).trim()}catch{e({reason:"Failed to parse hook input JSON."});return}if(!t){e({reason:"Missing hook input JSON."});return}return po(t,e,"Failed to parse hook input JSON.")}async function AA(e){let t=xc(),n=await _A(e.outputDeny);if(n===void 0)return;if(!n||typeof n!=="object"||Array.isArray(n)){ve(e.outputDeny);return}if(!e.isSupported(n))return;let r=e.getAgent?.(n,t)??e.agent,o=e.agent===r?void 0:e.agent,i=IA(n),s=(p,g)=>{Vp(t,p,()=>e.getSessionId(n),{agent:r,shape:o,toolName:g,cwd:p.cwd??i}),e.outputDeny(p)},a=e.getToolName(n);if(typeof a!=="string"||a.trim()===""){ve((p)=>s(p),kA(n));return}let l=a,c=(p)=>s(p,l),u;try{u=e.getToolInput(n,l,c,t)}catch(p){if(!(p instanceof Se))throw p;ve(c,void 0,l);return}if(!u.ok)return;let m=e.getContext(n,u.input,l,c,t);if(!m)return;let d;try{d=Dt(u.input)}catch(p){if(!(p instanceof Se))throw p;ve(c,void 0,l);return}let f=mr(l,u.input,u.route,m,d??null);try{let p=qp(t,f,{guard:{auditAllowed:Rc(t.env),dependencies:e.guardDependencies},audit:{agent:r,shape:o,getSessionId:()=>e.getSessionId(n)}}),g=es(p,{includeEvidence:!0,toolName:p.stage==="command-analysis"?void 0:l});if(g){if(g.unverifiedByStandardMode&&e.outputAsk&&e.canPromptPerson?.(n)){e.outputAsk(g);return}e.outputDeny(g);return}e.outputAllow?.()}catch(p){if(!(p instanceof vn))throw p;PA(p,t.env);let g=es(p.evaluation,{includeEvidence:!0,toolName:p.evaluation.stage==="command-analysis"?void 0:l});if(g)e.outputDeny(g);return}}function PA(e,t){if(!tn(ae.debug,t))return;console.error(`CC Safety Net debug: ${TA(e.stage)}: ${jl(e.cause)}`)}function TA(e){if(e==="policy-protection")return"hook policy protection failed";if(e==="config-load")return"hook config loading failed";if(e==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function kA(e){if(!e||typeof e!=="object"||Array.isArray(e))return;if(Object.hasOwn(e,"tool_input"))return e.tool_input;let t=e.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function IA(e){if(!e||typeof e!=="object"||Array.isArray(e))return null;let t=e.cwd;if(typeof t==="string")return t;let n=e.toolCall;if(!n||typeof n!=="object"||Array.isArray(n))return null;let r=n.args;if(!r||typeof r!=="object"||Array.isArray(r))return null;let o=r.Cwd;return typeof o==="string"?o:null}async function Ie(e){let t=(s)=>wA(e.createDenyOutput,s),n=e.createAskOutput,r=n?(s)=>console.log(JSON.stringify(n(Ul(s)))):void 0,o=e.createAllowOutput,i=o?()=>console.log(JSON.stringify(o())):void 0;try{await AA({...e,outputDeny:t,outputAsk:r,outputAllow:i})}catch(s){console.error("CC Safety Net error:",s),t(wn())}}var OA=new Map([["run_command","auto"]]),MA=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function Yp(e){return ie(e,OA)}async function Zp(){await Ie({agent:"antigravity-cli",createDenyOutput:(e)=>({decision:"deny",reason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolCall?.name,getToolInput:(e,t)=>({ok:!0,input:WA(e.toolCall?.args,t),route:Yp(t)}),getContext:DA,getSessionId:(e)=>e.conversationId})}function DA(e,t,n,r,o){let i=LA(e);if(!i[0])return Xt(r,t,n),null;let s=i.flatMap((u)=>{let m=vt([u],o.paths);return m?[m]:[]});if(!s[0])return Xt(r,t,n,{directory:"session",problem:"unusable",cwd:i[0]}),null;if(n!=="run_command"){let u;try{u=NA(t,n,s,o.paths)}catch(m){if(m instanceof Se)return Xt(r,void 0,n),null;if(!(m instanceof N))throw m;return Xt(r,t,n),null}if(!u)return Xt(r,t,n),null;return{configCwd:u,executionCwd:u}}let a=e.toolCall?.args;if(!a||!Object.hasOwn(a,"Cwd"))return{configCwd:s[0],executionCwd:s[0]};let l=a.Cwd;if(typeof l!=="string"||l.trim()==="")return Xt(r,t,n),null;let c=St(l,s,o.paths);if(c){let u=Xp(c,s);if(!u)return Xt(r,t,n),null;return{configCwd:u,executionCwd:c}}return Xt(r,t,n,{directory:"requested",problem:Et(l,s[0],o.paths),cwd:l}),null}function NA(e,t,n,r){let o=Yp(t),i=[...uo(e,MA),...o.kind==="patch"?mo(e):[]].filter(Gl.isAbsolute),s=ue(),a=new Set(i.flatMap((l)=>{let c=Xp(O(l,r,s),n);return c?[c]:[]}));if(a.size>1)return null;return[...a][0]??n[0]??null}function Xp(e,t){return t.filter((n)=>ur(e,n)).reduce((n,r)=>r.length>n.length?r:n,"")||null}function Xt(e,t,n,r){let o=t&&typeof t==="object"?t.command:void 0,i={command:typeof o==="string"?o:void 0,toolName:n};e(r?so(r,i):wn(i))}function LA(e){if(e.workspacePaths===void 0)return[process.cwd()];return Array.isArray(e.workspacePaths)?e.workspacePaths.filter((t)=>typeof t==="string"&&t.trim()!==""):[]}function WA(e,t){if(!e)return;if(t!=="run_command")return e;return{...e,command:typeof e.CommandLine==="string"&&e.CommandLine!==""?e.CommandLine:void 0}}var Yi=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,runtime:{order:3,flags:["-cx","--codex"],description:"Run as a Codex PreToolUse hook",legacyTopLevelFlags:[]},install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:7,runtime:{order:6,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:7,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:6,runtime:{order:5,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:6,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:8,runtime:{order:7,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:9,runtime:{order:8,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:10,runtime:{order:9,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:10,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:11,install:{order:11,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:12,install:{order:12,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:13,install:{order:13,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:4,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],GL=Yi.slice().sort((e,t)=>e.doctorOrder-t.doctorOrder).map((e)=>e.id),Jp=Yi.filter((e)=>("runtime"in e)).slice().sort((e,t)=>e.runtime.order-t.runtime.order).map((e)=>({id:e.id,displayName:"displayName"in e.runtime?e.runtime.displayName:e.displayName,flags:e.runtime.flags,legacyFlags:"legacyFlags"in e.runtime?e.runtime.legacyFlags:[],description:e.runtime.description,legacyTopLevelFlags:e.runtime.legacyTopLevelFlags})),FL=Yi.slice().sort((e,t)=>e.install.order-t.install.order).map((e)=>({id:e.id,...e.install})).map(({order:e,...t})=>t),zL=Object.fromEntries(Yi.map((e)=>[e.id,e.displayName]));var xn=require("node:path");function Qp(e,t){if(e!==void 0&&e!==null&&typeof e!=="string")return"unknown";if(typeof e==="string"&&!xn.isAbsolute(e))return"unknown";try{let n=ue(),r=typeof e==="string"&&e?O(e,t.paths,n):void 0,o=t.home,i=[["codex",t.env.get("CODEX_HOME")||xn.join(o,".codex")],["copilot-cli",t.env.get("COPILOT_HOME")||xn.join(o,".copilot")],["claude-code",t.env.get("CLAUDE_CONFIG_DIR")||xn.join(o,".claude")]],s=r?i.flatMap(([a,l])=>{if(!xn.isAbsolute(l))return[];return ur(r,O(l,t.paths,n))?[a]:[]}):[];if(s.length===1)return s[0]??"unknown";if(s.length>1)return"unknown"}catch{return"unknown"}if(t.env.get("COPILOT_CLI")==="1")return"copilot-cli";if(t.env.get("CLAUDECODE")==="1"||Boolean(t.env.get("CLAUDE_CODE_ENTRYPOINT")))return"claude-code";return"unknown"}var Zi="PreToolUse",eg="BeforeTool",tg="pre_tool_call";async function nr(e){await Ie({agent:e.agent,...e.getAgent?{getAgent:e.getAgent}:{},createDenyOutput:(t)=>({hookSpecificOutput:{hookEventName:Zi,permissionDecision:"deny",permissionDecisionReason:t}}),...e.canPromptPerson?{canPromptPerson:e.canPromptPerson,createAskOutput:(t)=>({hookSpecificOutput:{hookEventName:Zi,permissionDecision:"ask",permissionDecisionReason:t}})}:{},isSupported:(t)=>t.hook_event_name===Zi,getToolName:(t)=>t.tool_name,getToolInput:(t,n,r,o)=>({ok:!0,input:t.tool_input,route:e.getToolRoute(n,t.tool_input,o)}),getContext:e.getContext??En,getSessionId:(t)=>t.session_id})}var GA=new Map([["Bash","posix"],["PowerShell","powershell"],["Monitor","posix"]]);function FA(e,t,n){if(e==="Bash"&&n.env.get("COPILOT_CLI")==="1")return{kind:"command",shell:"auto"};return e==="Monitor"&&t?.command===void 0?ie(e,new Map):ie(e,GA)}async function ng(){await nr({agent:"claude-code",getAgent:(e,t)=>Qp(e.transcript_path,t),canPromptPerson:(e)=>["default","acceptEdits","plan"].includes(e.permission_mode??""),getToolRoute:FA})}var zA=new Map([["Bash","auto"]]);async function rg(){await nr({agent:"codex",getToolRoute:(e)=>ie(e,zA)})}var HA=new Map([["bash","auto"],["Bash","auto"],["powershell","powershell"],["PowerShell","powershell"]]);function BA(e){return ie(e,HA)}async function og(){await Ie({agent:"copilot-cli",createDenyOutput:(e)=>({permissionDecision:"deny",permissionDecisionReason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{let r=BA(t);if(typeof e.toolArgs==="object"&&e.toolArgs!==null)return{ok:!0,input:e.toolArgs,route:r};if(typeof e.toolArgs!=="string")return n({reason:"Failed to parse toolArgs JSON."}),{ok:!1};if(r.kind==="patch"&&e.toolArgs.trimStart().startsWith("*** Begin Patch"))return{ok:!0,input:e.toolArgs,route:r};let i=po(e.toolArgs,n,"Failed to parse toolArgs JSON.");if(i===void 0)return{ok:!1};return{ok:!0,input:i,route:r}},getContext:En,getSessionId:(e)=>typeof e.sessionId==="string"&&e.sessionId.trim()?e.sessionId:void 0})}var $A=new Map([["Shell","auto"]]);function UA(e){return ie(e,$A)}async function ig(){await Ie({agent:"cursor",createDenyOutput:(e)=>({permission:"deny",user_message:e,agent_message:e}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:UA(t)}),getContext:jA,getSessionId:(e)=>e.conversation_id})}function jA(e,t,n,r,o){let i=VA(e);if(!i[0])return ve(r,t,n),null;let s=i.flatMap((d)=>{let f=vt([d],o.paths);return f?[f]:[]});if(!s[0])return $e(r,t,n,{directory:"session",problem:"unusable",cwd:i[0]}),null;let a=KA(e.cwd),l=St(a,s,o.paths);if(!l)return $e(r,t,n,{directory:"session",problem:Et(a,s[0],o.paths),cwd:a}),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:l,executionCwd:l};if(!Object.hasOwn(t,"working_directory"))return{configCwd:l,executionCwd:l};let c=t.working_directory;if(typeof c!=="string"||c.trim()==="")return ve(r,t,n),null;let u=ar(c),m=St(u,s,o.paths);if(!m)return $e(r,t,n,{directory:"requested",problem:Et(u,s[0],o.paths),cwd:u}),null;return{configCwd:l,executionCwd:m}}function VA(e){if(e.workspace_roots===void 0)return typeof e.cwd==="string"&&e.cwd.trim()!==""?[ar(e.cwd)]:[];if(!Array.isArray(e.workspace_roots))return[];return e.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="").map((t)=>ar(t))}function KA(e){return typeof e==="string"&&e.trim()!==""?ar(e):"."}var sg=new Map([["run_shell_command","auto"]]);function qA(e){return ie(e,sg)}async function ag(){await Ie({agent:"gemini-cli",createDenyOutput:(e)=>({decision:"deny",reason:e,systemMessage:e}),isSupported:(e)=>e.hook_event_name===eg,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:qA(t)}),getContext:qi("dir_path",sg,{emptyMeansSessionCwd:!0,allowOutsideSessionCwd:!0}),getSessionId:(e)=>e.session_id})}var YA=new Map([["run_terminal_command","auto"],["monitor","auto"]]);function ZA(e){return ie(e,YA)}async function lg(){await Ie({agent:"grok-build",createDenyOutput:(e)=>({decision:"deny",reason:e}),createAllowOutput:()=>({decision:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(e.toolInputTruncated===!0)return ve(n,e.toolInput,t),{ok:!1};return{ok:!0,input:e.toolInput,route:ZA(t)}},getContext:XA,getSessionId:(e)=>e.sessionId})}function XA(e,t,n,r,o){let i=JA(e);if(!i)return ve(r,t,n),null;let s=vt([i],o.paths);if(!s)return $e(r,t,n,{directory:"session",problem:"unusable",cwd:i}),null;let a=QA(e.cwd),l=St(a,[s],o.paths);if(!l)return $e(r,t,n,{directory:"session",problem:Et(a,s,o.paths),cwd:a}),null;return{configCwd:l,executionCwd:l}}function JA(e){let t=e.workspaceRoot===void 0?e.cwd:e.workspaceRoot;return typeof t==="string"&&t.trim()!==""?t:void 0}function QA(e){return typeof e==="string"&&e.trim()!==""?e:"."}var cg=require("node:path");var eP=new Map([["terminal","posix"]]);async function ug(){await Ie({agent:"hermes-agent",createDenyOutput:(e)=>({action:"block",message:e}),isSupported:(e)=>e.hook_event_name===tg,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:ie(t,eP)}),getContext:tP,getSessionId:(e)=>e.session_id})}function tP(e,t,n,r,o){let i=En(e,t,n,r,o);if(!i)return null;if(!t||typeof t!=="object"||Array.isArray(t))return i;if(!Object.hasOwn(t,"workdir"))return i;let s=t.workdir;if(typeof s!=="string"||s.trim()==="")return ve(r,t,n),null;let a=vt([cg.resolve(i.configCwd,s)],o.paths);if(!a)return $e(r,t,n,{directory:"requested",problem:"unusable",cwd:s}),null;return{...i,executionCwd:a}}var dg=new Map([["Bash","posix"]]);function nP(e){return ie(e,dg)}async function mg(){await nr({agent:"kimi-code",getToolRoute:nP,getContext:qi("cwd",dg)})}var rP={"antigravity-cli":Zp,"claude-code":ng,codex:rg,"copilot-cli":og,cursor:ig,"gemini-cli":ag,"grok-build":lg,"hermes-agent":ug,"kimi-code":mg},Fl=Jp.map((e)=>({...e,run:rP[e.id]}));function fg(e){let t=io({label:"hook",booleans:Object.fromEntries(Fl.map((r)=>[r.id,[...r.flags,...r.legacyFlags]]))},e);if(t.errors.length>0)return;let n=Fl.filter((r)=>t.flags[r.id]);return n.length===1?n[0]:void 0}function pg(e){return Fl.find((t)=>t.legacyTopLevelFlags.some((n)=>n===e))}async function oP(){let e=process.argv.slice(2),t=e[0],n=io({label:"cc-safety-net",booleans:{version:["-V","--version"]},positionals:"list"},e);if(!n.help&&!n.flags.version){if(t?.toLowerCase()==="hook"){let i=fg(e.slice(1));if(i){await i.run();return}}let o=pg(t);if(o){await o.run();return}}let r=await import("../cli.js");await r.runCli(e)}oP().catch((e)=>{console.error("CC Safety Net error:",e),process.exit(1)});
+`).filter((o)=>o.trim()).map(pA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(le.lstatSync(e).mtimeMs!==n.mtimeMs)return;Bp(e)}catch{}}function pA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Nl(e){try{return le.readdirSync(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Bp(e){try{le.unlinkSync(e)}catch{}}function zp(e){try{le.rmdirSync(e)}catch{}}var gA="2.5.1",hA=1e4,yA=2000,CA=256,bA=32768;function SA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function vA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Wl(e,t,n,r,o,i,s={}){let a=SA(t);if(!a)return;let l=xA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=Vi(Ct(n),s.failureStage?Number.POSITIVE_INFINITY:hA),m=Vi(Ct(r),yA),d=s.toolName?Vi(Ct(s.toolName),CA):void 0,f=i===null?void 0:Vi(Ct(i),bA),p=tr.join(l,vA(f?.value??null),c.slice(0,7));Ki.mkdirSync(p,{recursive:!0,mode:448});let g=tr.join(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??gs)(),v:gA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Ki.appendFileSync(g,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),Hp(e,l,s.now)}catch{}}function Vi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function EA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&tr.isAbsolute(n)?n:null}function xA(e){let t=EA(e);return t?tr.join(t,".cc-safety-net","logs"):null}function Up(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=$p(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?$p(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function $p(e){return"command"in e?e.command??"":""}function jp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Wl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Vp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Wl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function qp(e,t,n){try{let r=Wp(t,{environment:e,...n.guard});return Kp(e,t,r,n),r}catch(r){if(!(r instanceof vn))throw r;throw Kp(e,t,r.evaluation,n,!(r.cause instanceof Se),{stage:r.stage,errorCode:RA(r.cause)}),r}}function Kp(e,t,n,r,o=!0,i){jp(e,Up(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function RA(e){if(e instanceof N)return J[e.kind].errorCode;if(e instanceof Se)return"tool-input-limit";if(e instanceof rt)return"structural-shell-syntax-limit";return"unexpected-error"}var En=(e,t,n,r,o)=>mc(e.cwd,t,n,r,o.paths,process.cwd()),qi=(e,t,n)=>(r,o,i,s,a)=>{let l=En(r,o,i,s,a);if(!l)return null;let c=r.tool_input;if(!t.has(i)||!c||!Object.hasOwn(c,e))return l;let u=c[e];if(n?.emptyMeansSessionCwd&&u==="")return l;if(typeof u!=="string"||u.trim()==="")return ve(s,o,i),null;let m=n?.allowOutsideSessionCwd?ls(u,l.configCwd,a.paths):St(u,[l.configCwd],a.paths);if(m)return{configCwd:l.configCwd,executionCwd:m};return $e(s,o,i,{directory:"requested",problem:Et(u,l.configCwd,a.paths),cwd:u}),null};function wA(e,t){console.log(JSON.stringify(e($l(t))))}async function _A(e){let t;try{t=(await dc(process.stdin)).trim()}catch{e({reason:"Failed to parse hook input JSON."});return}if(!t){e({reason:"Missing hook input JSON."});return}return po(t,e,"Failed to parse hook input JSON.")}async function AA(e){let t=xc(),n=await _A(e.outputDeny);if(n===void 0)return;if(!n||typeof n!=="object"||Array.isArray(n)){ve(e.outputDeny);return}if(!e.isSupported(n))return;let r=e.getAgent?.(n,t)??e.agent,o=e.agent===r?void 0:e.agent,i=IA(n),s=(p,g)=>{Vp(t,p,()=>e.getSessionId(n),{agent:r,shape:o,toolName:g,cwd:p.cwd??i}),e.outputDeny(p)},a=e.getToolName(n);if(typeof a!=="string"||a.trim()===""){ve((p)=>s(p),kA(n));return}let l=a,c=(p)=>s(p,l),u;try{u=e.getToolInput(n,l,c,t)}catch(p){if(!(p instanceof Se))throw p;ve(c,void 0,l);return}if(!u.ok)return;let m=e.getContext(n,u.input,l,c,t);if(!m)return;let d;try{d=Dt(u.input)}catch(p){if(!(p instanceof Se))throw p;ve(c,void 0,l);return}let f=mr(l,u.input,u.route,m,d??null);try{let p=qp(t,f,{guard:{auditAllowed:Rc(t.env),dependencies:e.guardDependencies},audit:{agent:r,shape:o,getSessionId:()=>e.getSessionId(n)}}),g=es(p,{includeEvidence:!0,toolName:p.stage==="command-analysis"?void 0:l});if(g){if(g.unverifiedByStandardMode&&e.outputAsk&&e.canPromptPerson?.(n)){e.outputAsk(g);return}e.outputDeny(g);return}e.outputAllow?.()}catch(p){if(!(p instanceof vn))throw p;PA(p,t.env);let g=es(p.evaluation,{includeEvidence:!0,toolName:p.evaluation.stage==="command-analysis"?void 0:l});if(g)e.outputDeny(g);return}}function PA(e,t){if(!tn(ae.debug,t))return;console.error(`CC Safety Net debug: ${TA(e.stage)}: ${jl(e.cause)}`)}function TA(e){if(e==="policy-protection")return"hook policy protection failed";if(e==="config-load")return"hook config loading failed";if(e==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function kA(e){if(!e||typeof e!=="object"||Array.isArray(e))return;if(Object.hasOwn(e,"tool_input"))return e.tool_input;let t=e.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function IA(e){if(!e||typeof e!=="object"||Array.isArray(e))return null;let t=e.cwd;if(typeof t==="string")return t;let n=e.toolCall;if(!n||typeof n!=="object"||Array.isArray(n))return null;let r=n.args;if(!r||typeof r!=="object"||Array.isArray(r))return null;let o=r.Cwd;return typeof o==="string"?o:null}async function Ie(e){let t=(s)=>wA(e.createDenyOutput,s),n=e.createAskOutput,r=n?(s)=>console.log(JSON.stringify(n(Ul(s)))):void 0,o=e.createAllowOutput,i=o?()=>console.log(JSON.stringify(o())):void 0;try{await AA({...e,outputDeny:t,outputAsk:r,outputAllow:i})}catch(s){console.error("CC Safety Net error:",s),t(wn())}}var OA=new Map([["run_command","auto"]]),MA=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function Yp(e){return ie(e,OA)}async function Zp(){await Ie({agent:"antigravity-cli",createDenyOutput:(e)=>({decision:"deny",reason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolCall?.name,getToolInput:(e,t)=>({ok:!0,input:WA(e.toolCall?.args,t),route:Yp(t)}),getContext:DA,getSessionId:(e)=>e.conversationId})}function DA(e,t,n,r,o){let i=LA(e);if(!i[0])return Xt(r,t,n),null;let s=i.flatMap((u)=>{let m=vt([u],o.paths);return m?[m]:[]});if(!s[0])return Xt(r,t,n,{directory:"session",problem:"unusable",cwd:i[0]}),null;if(n!=="run_command"){let u;try{u=NA(t,n,s,o.paths)}catch(m){if(m instanceof Se)return Xt(r,void 0,n),null;if(!(m instanceof N))throw m;return Xt(r,t,n),null}if(!u)return Xt(r,t,n),null;return{configCwd:u,executionCwd:u}}let a=e.toolCall?.args;if(!a||!Object.hasOwn(a,"Cwd"))return{configCwd:s[0],executionCwd:s[0]};let l=a.Cwd;if(typeof l!=="string"||l.trim()==="")return Xt(r,t,n),null;let c=St(l,s,o.paths);if(c){let u=Xp(c,s);if(!u)return Xt(r,t,n),null;return{configCwd:u,executionCwd:c}}return Xt(r,t,n,{directory:"requested",problem:Et(l,s[0],o.paths),cwd:l}),null}function NA(e,t,n,r){let o=Yp(t),i=[...uo(e,MA),...o.kind==="patch"?mo(e):[]].filter(Gl.isAbsolute),s=ue(),a=new Set(i.flatMap((l)=>{let c=Xp(O(l,r,s),n);return c?[c]:[]}));if(a.size>1)return null;return[...a][0]??n[0]??null}function Xp(e,t){return t.filter((n)=>ur(e,n)).reduce((n,r)=>r.length>n.length?r:n,"")||null}function Xt(e,t,n,r){let o=t&&typeof t==="object"?t.command:void 0,i={command:typeof o==="string"?o:void 0,toolName:n};e(r?so(r,i):wn(i))}function LA(e){if(e.workspacePaths===void 0)return[process.cwd()];return Array.isArray(e.workspacePaths)?e.workspacePaths.filter((t)=>typeof t==="string"&&t.trim()!==""):[]}function WA(e,t){if(!e)return;if(t!=="run_command")return e;return{...e,command:typeof e.CommandLine==="string"&&e.CommandLine!==""?e.CommandLine:void 0}}var GA=["npx","--offline","--no-install","@deepseek-ai/dsh","--version"],Yi=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,runtime:{order:3,flags:["-cx","--codex"],description:"Run as a Codex PreToolUse hook",legacyTopLevelFlags:[]},install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:8,runtime:{order:6,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:8,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:7,runtime:{order:5,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:7,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:9,runtime:{order:7,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:10,runtime:{order:8,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:10,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:11,runtime:{order:9,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:11,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:12,install:{order:12,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:13,install:{order:13,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:14,install:{order:14,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:4,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"deepseek-harness",displayName:"DeepSeek Harness",doctorOrder:6,install:{order:6,flag:"--deepseek-harness",artifactKind:"package",probeCommand:GA}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],FL=Yi.slice().sort((e,t)=>e.doctorOrder-t.doctorOrder).map((e)=>e.id),Jp=Yi.filter((e)=>("runtime"in e)).slice().sort((e,t)=>e.runtime.order-t.runtime.order).map((e)=>({id:e.id,displayName:"displayName"in e.runtime?e.runtime.displayName:e.displayName,flags:e.runtime.flags,legacyFlags:"legacyFlags"in e.runtime?e.runtime.legacyFlags:[],description:e.runtime.description,legacyTopLevelFlags:e.runtime.legacyTopLevelFlags})),zL=Yi.slice().sort((e,t)=>e.install.order-t.install.order).map((e)=>({id:e.id,...e.install})).map(({order:e,...t})=>t),HL=Object.fromEntries(Yi.map((e)=>[e.id,e.displayName]));var xn=require("node:path");function Qp(e,t){if(e!==void 0&&e!==null&&typeof e!=="string")return"unknown";if(typeof e==="string"&&!xn.isAbsolute(e))return"unknown";try{let n=ue(),r=typeof e==="string"&&e?O(e,t.paths,n):void 0,o=t.home,i=[["codex",t.env.get("CODEX_HOME")||xn.join(o,".codex")],["copilot-cli",t.env.get("COPILOT_HOME")||xn.join(o,".copilot")],["claude-code",t.env.get("CLAUDE_CONFIG_DIR")||xn.join(o,".claude")]],s=r?i.flatMap(([a,l])=>{if(!xn.isAbsolute(l))return[];return ur(r,O(l,t.paths,n))?[a]:[]}):[];if(s.length===1)return s[0]??"unknown";if(s.length>1)return"unknown"}catch{return"unknown"}if(t.env.get("COPILOT_CLI")==="1")return"copilot-cli";if(t.env.get("CLAUDECODE")==="1"||Boolean(t.env.get("CLAUDE_CODE_ENTRYPOINT")))return"claude-code";return"unknown"}var Zi="PreToolUse",eg="BeforeTool",tg="pre_tool_call";async function nr(e){await Ie({agent:e.agent,...e.getAgent?{getAgent:e.getAgent}:{},createDenyOutput:(t)=>({hookSpecificOutput:{hookEventName:Zi,permissionDecision:"deny",permissionDecisionReason:t}}),...e.canPromptPerson?{canPromptPerson:e.canPromptPerson,createAskOutput:(t)=>({hookSpecificOutput:{hookEventName:Zi,permissionDecision:"ask",permissionDecisionReason:t}})}:{},isSupported:(t)=>t.hook_event_name===Zi,getToolName:(t)=>t.tool_name,getToolInput:(t,n,r,o)=>({ok:!0,input:t.tool_input,route:e.getToolRoute(n,t.tool_input,o)}),getContext:e.getContext??En,getSessionId:(t)=>t.session_id})}var FA=new Map([["Bash","posix"],["PowerShell","powershell"],["Monitor","posix"]]);function zA(e,t,n){if(e==="Bash"&&n.env.get("COPILOT_CLI")==="1")return{kind:"command",shell:"auto"};return e==="Monitor"&&t?.command===void 0?ie(e,new Map):ie(e,FA)}async function ng(){await nr({agent:"claude-code",getAgent:(e,t)=>Qp(e.transcript_path,t),canPromptPerson:(e)=>["default","acceptEdits","plan"].includes(e.permission_mode??""),getToolRoute:zA})}var HA=new Map([["Bash","auto"]]);async function rg(){await nr({agent:"codex",getToolRoute:(e)=>ie(e,HA)})}var BA=new Map([["bash","auto"],["Bash","auto"],["powershell","powershell"],["PowerShell","powershell"]]);function $A(e){return ie(e,BA)}async function og(){await Ie({agent:"copilot-cli",createDenyOutput:(e)=>({permissionDecision:"deny",permissionDecisionReason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{let r=$A(t);if(typeof e.toolArgs==="object"&&e.toolArgs!==null)return{ok:!0,input:e.toolArgs,route:r};if(typeof e.toolArgs!=="string")return n({reason:"Failed to parse toolArgs JSON."}),{ok:!1};if(r.kind==="patch"&&e.toolArgs.trimStart().startsWith("*** Begin Patch"))return{ok:!0,input:e.toolArgs,route:r};let i=po(e.toolArgs,n,"Failed to parse toolArgs JSON.");if(i===void 0)return{ok:!1};return{ok:!0,input:i,route:r}},getContext:En,getSessionId:(e)=>typeof e.sessionId==="string"&&e.sessionId.trim()?e.sessionId:void 0})}var UA=new Map([["Shell","auto"]]);function jA(e){return ie(e,UA)}async function ig(){await Ie({agent:"cursor",createDenyOutput:(e)=>({permission:"deny",user_message:e,agent_message:e}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:jA(t)}),getContext:VA,getSessionId:(e)=>e.conversation_id})}function VA(e,t,n,r,o){let i=KA(e);if(!i[0])return ve(r,t,n),null;let s=i.flatMap((d)=>{let f=vt([d],o.paths);return f?[f]:[]});if(!s[0])return $e(r,t,n,{directory:"session",problem:"unusable",cwd:i[0]}),null;let a=qA(e.cwd),l=St(a,s,o.paths);if(!l)return $e(r,t,n,{directory:"session",problem:Et(a,s[0],o.paths),cwd:a}),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:l,executionCwd:l};if(!Object.hasOwn(t,"working_directory"))return{configCwd:l,executionCwd:l};let c=t.working_directory;if(typeof c!=="string"||c.trim()==="")return ve(r,t,n),null;let u=ar(c),m=St(u,s,o.paths);if(!m)return $e(r,t,n,{directory:"requested",problem:Et(u,s[0],o.paths),cwd:u}),null;return{configCwd:l,executionCwd:m}}function KA(e){if(e.workspace_roots===void 0)return typeof e.cwd==="string"&&e.cwd.trim()!==""?[ar(e.cwd)]:[];if(!Array.isArray(e.workspace_roots))return[];return e.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="").map((t)=>ar(t))}function qA(e){return typeof e==="string"&&e.trim()!==""?ar(e):"."}var sg=new Map([["run_shell_command","auto"]]);function YA(e){return ie(e,sg)}async function ag(){await Ie({agent:"gemini-cli",createDenyOutput:(e)=>({decision:"deny",reason:e,systemMessage:e}),isSupported:(e)=>e.hook_event_name===eg,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:YA(t)}),getContext:qi("dir_path",sg,{emptyMeansSessionCwd:!0,allowOutsideSessionCwd:!0}),getSessionId:(e)=>e.session_id})}var ZA=new Map([["run_terminal_command","auto"],["monitor","auto"]]);function XA(e){return ie(e,ZA)}async function lg(){await Ie({agent:"grok-build",createDenyOutput:(e)=>({decision:"deny",reason:e}),createAllowOutput:()=>({decision:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(e.toolInputTruncated===!0)return ve(n,e.toolInput,t),{ok:!1};return{ok:!0,input:e.toolInput,route:XA(t)}},getContext:JA,getSessionId:(e)=>e.sessionId})}function JA(e,t,n,r,o){let i=QA(e);if(!i)return ve(r,t,n),null;let s=vt([i],o.paths);if(!s)return $e(r,t,n,{directory:"session",problem:"unusable",cwd:i}),null;let a=eP(e.cwd),l=St(a,[s],o.paths);if(!l)return $e(r,t,n,{directory:"session",problem:Et(a,s,o.paths),cwd:a}),null;return{configCwd:l,executionCwd:l}}function QA(e){let t=e.workspaceRoot===void 0?e.cwd:e.workspaceRoot;return typeof t==="string"&&t.trim()!==""?t:void 0}function eP(e){return typeof e==="string"&&e.trim()!==""?e:"."}var cg=require("node:path");var tP=new Map([["terminal","posix"]]);async function ug(){await Ie({agent:"hermes-agent",createDenyOutput:(e)=>({action:"block",message:e}),isSupported:(e)=>e.hook_event_name===tg,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:ie(t,tP)}),getContext:nP,getSessionId:(e)=>e.session_id})}function nP(e,t,n,r,o){let i=En(e,t,n,r,o);if(!i)return null;if(!t||typeof t!=="object"||Array.isArray(t))return i;if(!Object.hasOwn(t,"workdir"))return i;let s=t.workdir;if(typeof s!=="string"||s.trim()==="")return ve(r,t,n),null;let a=vt([cg.resolve(i.configCwd,s)],o.paths);if(!a)return $e(r,t,n,{directory:"requested",problem:"unusable",cwd:s}),null;return{...i,executionCwd:a}}var dg=new Map([["Bash","posix"]]);function rP(e){return ie(e,dg)}async function mg(){await nr({agent:"kimi-code",getToolRoute:rP,getContext:qi("cwd",dg)})}var oP={"antigravity-cli":Zp,"claude-code":ng,codex:rg,"copilot-cli":og,cursor:ig,"gemini-cli":ag,"grok-build":lg,"hermes-agent":ug,"kimi-code":mg},Fl=Jp.map((e)=>({...e,run:oP[e.id]}));function fg(e){let t=io({label:"hook",booleans:Object.fromEntries(Fl.map((r)=>[r.id,[...r.flags,...r.legacyFlags]]))},e);if(t.errors.length>0)return;let n=Fl.filter((r)=>t.flags[r.id]);return n.length===1?n[0]:void 0}function pg(e){return Fl.find((t)=>t.legacyTopLevelFlags.some((n)=>n===e))}async function iP(){let e=process.argv.slice(2),t=e[0],n=io({label:"cc-safety-net",booleans:{version:["-V","--version"]},positionals:"list"},e);if(!n.help&&!n.flags.version){if(t?.toLowerCase()==="hook"){let i=fg(e.slice(1));if(i){await i.run();return}}let o=pg(t);if(o){await o.run();return}}let r=await import("../cli.js");await r.runCli(e)}iP().catch((e)=>{console.error("CC Safety Net error:",e),process.exit(1)});