cc-safety-net 2.4.2 → 2.4.4

package/dist/openclaw/cc-safety-net/index.js

@@ -1,48 +1,48 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.4.2
-var tl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var fi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",$e="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",En="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var di={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},vn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...di},processedCandidateBytes:{cap:4194304,...di},pathEnvironmentExpansion:{cap:64,...di},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...vn},trackedHeredocFiles:{cap:64,...vn},controlFlowStates:{cap:64,...vn},wrapperPeelIterations:{cap:20,...vn},derivedCommandShape:vn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function ye(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var op=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function st(e){return ip(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function ip(e){return op.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var sp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function ap(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,sp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+// version: 2.4.4
+var al={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Ci="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",$e="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",xn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var yi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Rn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...yi},processedCandidateBytes:{cap:4194304,...yi},pathEnvironmentExpansion:{cap:64,...yi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Rn},trackedHeredocFiles:{cap:64,...Rn},controlFlowStates:{cap:64,...Rn},wrapperPeelIterations:{cap:20,...Rn},derivedCommandShape:Rn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function ye(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var pp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function st(e){return gp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function gp(e){return pp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var hp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function yp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,hp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function nl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function Rn(e={}){return{reason:En,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function rl(e){return ap({...e,redact:st})}function ol(e){return st(e instanceof Error?e.message:String(e))}import{isAbsolute as wl,relative as Dp,resolve as Lp,sep as Wp}from"node:path";import{basename as al,dirname as lp,isAbsolute as cp,join as up,normalize as dp,resolve as il}from"node:path";var fp=256,Er=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function at(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function hi(e,t){return mi(e,0,t)}function mi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=pi(e,o+2),a=mp(e,o,t);if(a===null){if(Er.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=pp(l,t,n),o=a+1;continue}let i=pi(e,o+1);if(!i){r+="$",o++;continue}r+=gi(i,n)??`$${i}`,o+=i.length+1}return r}function mp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function pp(e,t,n){let r=e.slice(2,-1),o=pi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return gi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Er.has(o))throw new N("pathEnvironmentExpansion");return e}if(!Er.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=gi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":mi(i.slice(s.length),t+1,n);return l?mi(i.slice(s.length),t+1,n):""}function pi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function gi(e,t){if(!Er.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function G(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){ll(n,i);let s=t.realpath(i);if(s!==null)return sl(n,e,s,o);let a=lp(i);if(a===i||o.length>=fp)return sl(n,e,i,o);o.push(al(i)),i=a}}function sl(e,t,n,r){let o=r.length===0?n:up(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function gp(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;ll(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function ll(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ie(e,t,n,r){let o=ul(e,t,n);if(!o)return"";return G(o,n.paths,r).replace(/\\/g,"/")}function cl(e,t,n,r,o){let i=ul(e,t,n);if(!i)return null;if(o(al(i)))return G(i,n.paths,r).replace(/\\/g,"/");let s=gp(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function ul(e,t,n){let r=n.home,o=hi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?il(r,o.slice(2)):o,s=Ce(i);return dp(cp(s)?s:il(t,s))}import{types as hp}from"node:util";var yp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Cp=new Set(["command","diff","input","patch","patchtext"]),dl=new TextEncoder,bp=new TextDecoder,Sp=/\s/,vp=64;class Ve extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var xn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Ep(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function xr(e){return yp.has(Ep(e))}function wn(e){if(!e||typeof e!=="object")return;El(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ue();return}if(t.get||t.set)Ue();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function hl(e,t){return yl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function yl(e,t,n,r){let o=vl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=yl(a,t,n,r+1);return typeof a==="string"&&t.has(Cl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Cl(e){return e.replace(/-/g,"_").toLowerCase()}function bl(e){return Sl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(xp)}function Sl(e,t,n,r){let o=vl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Sl(a,o.array?t:Cp.has(Cl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Rp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>xn.maxDepth||t.nodes>xn.maxNodes)Ue();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>xn.maxStringBytes||t.stringBytes>xn.maxAggregateStringBytes)Ue()}function vl(e,t,n){if(Rp(e,t,n),!e||typeof e!=="object")return null;let r=El(e);if(t.ancestors.has(e))Ue();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>xn.maxKeys)Ue();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ue();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function El(e){if(hp.isProxy(e))Ue();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ue();return t}function Ue(){throw new Ve}function xp(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let f=_p(c);if(o=!0,i=f?.oldLines??null,s=f?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let f=c.startsWith(" ")||c.startsWith("-")?1:0,d=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-f),s=Math.max(0,s-d),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...yi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...yi(c));continue}if(c.startsWith("--- ")){let f=n[l+1]??"";if(!f.startsWith("+++ "))continue;t.push(...bi(Rr(c.slice(4),!0),Rr(f.slice(4),!0))),l++;continue}if(!r)t.push(...yi(c))}return t}function _p(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function yi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return gl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return gl(n[1]);if(e.startsWith("diff --git "))return wp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return pl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return pl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Mp(i[1]);return[]}function wp(e){let t=Pp(e);if(t.length===2&&t[0]&&t[1])return bi(t[0],t[1]);let n=Ap(e);return n?bi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Pp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Rt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Rt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Rl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Rt(e[n]))n++;return n===e.length?t:[]}function Ap(e){let t=0;while(t<e.length&&Rt(e[t]))t++;let n=e.length;while(n>t&&Rt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Rt(e[o])){o++;continue}let i=o;while(o<n&&Rt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>vp)Ue();if(Tp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Tp(e,t,n,r,o){if(Ci(e,t,n,r,o))return!0;let i=fl(e,"/",t,n),s=fl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ci(e,t,i,r,s))return!1;return Ci(e,i+1,n,s+1,o)}function Ci(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function fl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Rt(e){return e!==void 0&&Sp.test(e)}function Rl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:bp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...dl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...dl.encode(Ip(s[0]??""))),o+=2}return null}function Ip(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function kp(e){return _n(Np(e))}function bi(e,t){if(e==="/dev/null")return ml(t);if(t==="/dev/null")return ml(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(_n);let n=Op(e,t)??(e===t?xl(e):null);return[e,t,...n?[n]:[]].flatMap(_n)}function ml(e){let t=xl(e);return[e,...t?[t]:[]].flatMap(_n)}function xl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Op(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function pl(e){return kp(Rr(e,!0))}function Mp(e){return _n(Rr(e,!1))}function Rr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Rl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Np(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function _n(e){return e===""||e==="/dev/null"?[]:[e]}function gl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function Si(e,t,n){if(at(e))return;let r=t.flatMap((i)=>_l(i,n));if(!r[0])return;let o=_l(wl(e)?e:Lp(r[0],e),n)[0];if(!o)return;return r.some((i)=>Fp(o,i))?o:void 0}function _l(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Fp(e,t){let n=Dp(t,e);return n===""||n!==".."&&!n.startsWith(`..${Wp}`)&&!wl(n)}function Pn(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as fg,realpathSync as mg,statSync as pg}from"node:fs";import{homedir as gg,tmpdir as hg}from"node:os";import{statSync as cg}from"node:fs";import{join as ug}from"node:path";import{spawnSync as Gp}from"node:child_process";import{existsSync as Tn,lstatSync as zp,readFileSync as In,realpathSync as qt,statSync as An}from"node:fs";import{dirname as vi,isAbsolute as Ei,join as Yt,resolve as _r}from"node:path";var Bp=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],$p=5000;function Al(e,t=ig(),n=$p){let r=Up(e),o=r===null?null:Hp(r);if(r===null||o===null)return null;let i=rg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Up(e){try{let t=qt(_r(e));return An(t).isDirectory()?t:null}catch{return null}}function Hp(e){let t=ng(e);if(!t)return null;try{let n=zp(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Ri(t);if(!r?.commonDir)return null;if(!Kp(r.gitDir,t))return null;return qp(r.gitDir,vi(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Ri(e){try{let t=jp(e);if(!t)return null;let n=qt(Ei(t)?t:_r(vi(e),t));if(!An(n).isDirectory())return null;return{gitDir:n,commonDir:Vp(n)}}catch{return null}}function jp(e){let t=In(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Vp(e){try{let t=In(Yt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=qt(Ei(t)?t:_r(e,t));return An(n).isDirectory()?n:null}catch{return null}}function Kp(e,t){let n=Yp(e);return n===null?!1:Tl(e,n,t)}function qp(e,t){let n=Zp(e);return n===null?!0:Tl(e,n,t)}function Yp(e){let t=Yt(e,"gitdir");if(!Tn(t))return null;let n=In(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Zp(e){let t=Yt(e,"config.worktree");return Tn(t)?Jp(t):null}function Tl(e,t,n){try{return Xp(Ei(t)?t:_r(e,t),n)}catch{return!1}}function Xp(e,t){try{let n=An(e),r=An(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Pl(qt.native(e))===Pl(qt.native(t))}function Pl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Jp(e){let t=In(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Qp(s[1]??"")}return r}function Qp(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return tg(t.slice(1,-1))}var eg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function tg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:eg[n]??t)}function ng(e){try{return xi(qt(e))}catch{return null}}function xi(e){let t=e;while(!0){let n=Yt(t,".git");if(Tn(n))return n;let r=vi(t);if(r===t)return null;t=r}}function rg(e,t,n,r){if(og(t))return!0;if(n===null)return!0;let o=Gp(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:sg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Il(o.stdout.trim())}function og(e){return[Yt(e.commonDir,"config"),Yt(e.gitDir,"config.worktree")].filter((t)=>Tn(t)).some((t)=>ag(t))}function ig(){return Bp.find((e)=>Tn(e))??null}function kn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function sg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!kn(t)))}function ag(e){let t;try{t=In(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(lg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Il(c)}return r}function lg(e){return e==="include"||e.startsWith("includeif ")}function Il(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function kl(e,t){if(e==="")return null;let n=ye(),r=xi(ie(e,e,t,n)),o=r?dg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function dg(e,t,n,r){try{let o=ie(e,t,n,r),i=cg(e),s=i.isFile()?o:null,a=i.isFile()?Ri(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((f)=>f?[Zt(ie(f,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Zt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Zt(o),markerFile:s?Zt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((f)=>{let d=Zt(ug(f,"hooks").replace(/\\/g,"/"));return[d,Zt(ie(d,t,n,r))]}))]}}catch{return null}}function Zt(e){return process.platform==="win32"?e.toLowerCase():e}var yg={realpath:(e)=>{try{return mg(e)}catch{return null}},entryKind:(e)=>{let t=fg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return pg(e).isDirectory()}catch{return!1}}};function Ml(){return Cg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ce(process.env.HOME||gg()),tmpdir:hg(),paths:yg})}function Cg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Ol(n,i,()=>kl(i,o)),worktreeFacts:(i)=>Ol(r,i,()=>Al(i)),...t};return o}function Ol(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Xt=["fail_closed","paranoid_rm","paranoid_interpreters"],wr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Pr=["standard","strict","paranoid"];function bg(e,t){if(!t)return e;return Pr.indexOf(t)>Pr.indexOf(e)?t:e}function Sg(e){let t=Ai(Q.level,e);if(t===void 0||t==="")return;if(Pr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Pr.join(", ")}.`);return}function vg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Nl(e){return vg(Ai(Q.auditScope,e))==="all"}function wi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Pi(e={},t){let n=e.safety?.level??"standard",r=Sg(t),o=bg(n,r),i=wr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(xt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(xt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(xt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(xt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||xt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:wi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function xt(e,t){let n=typeof e==="string"?_i(e,t):Ai(e,t);return n==="1"||n?.toLowerCase()==="true"}function _i(e,t){return t.get(e)}function Ai(e,t){let n=_i(e.name,t);if(n!==void 0)return n;if(e.legacyName)return _i(e.legacyName,t);return}import{dirname as Lr}from"node:path";import{closeSync as Eg,constants as Dl,fstatSync as Rg,fsyncSync as NP,lstatSync as ki,mkdirSync as DP,openSync as xg,readdirSync as LP,readFileSync as _g,realpathSync as Oi,renameSync as WP,rmdirSync as FP,statSync as wg,unlinkSync as GP,writeFileSync as zP}from"node:fs";import{isAbsolute as Ll,join as Mi,normalize as Pg,parse as Ii,relative as Ni,resolve as Di,sep as Li}from"node:path";function Ti(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Ag=Symbol("PolicyFilesystemScope"),Tg=Symbol("PolicyFilesystemTarget"),Ig=Dl.O_NOFOLLOW??0;class se extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function _t(e,t){return{[Ag]:!0,root:Di(e),label:t}}function Wl(e,t){let n=Pg(t);if(t===""||Ll(t)||n===".."||n.startsWith(`..${Li}`))throw new se(e.label);return{[Tg]:!0,scope:e,relativePath:n,path:Mi(e.root,n)}}function On(e,t){return Wl(e,Ni(e.root,Di(t)))}function Fl(e,t="rules policy"){let n=Di(e),r=Ii(n).dir;return Wl(_t(r,t),Ni(r,n))}function Tr(e){return zl(e.scope.label,()=>{if(!Ar(e))return null;let t=xg(e.path,Dl.O_RDONLY|Ig);return kg(t,()=>{let n=Rg(t);if(!n.isFile())throw new se(e.scope.label);let r=_g(t,"utf-8"),o=ki(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new se(e.scope.label);return Ar(e),r})})}function Gl(e,t){if(e.path===t.path)return!0;return zl(e.scope.label,()=>{if(!Ar(e)||!Ar(t))return!1;let n=(r)=>Mi(Oi(Ii(r).dir),Ii(r).base);return n(e.path)===n(t.path)})}function zl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof se)throw r;throw new se(e)}}function kg(e,t){try{return t()}finally{Eg(e)}}function Ar(e,t="file"){let n=Og(e.scope);if(!n)return!1;let r=e.relativePath.split(Li);for(let o of r.keys()){let i=Mi(e.scope.root,...r.slice(0,o+1)),s=ki(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new se(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new se(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new se(e.scope.label);Mg(n,Oi(i),e.scope.label)}return!0}function Og(e){if(!ki(e.root,{throwIfNoEntry:!1}))return null;if(!wg(e.root).isDirectory())throw new se(e.label);return Oi(e.root)}function Mg(e,t,n){let r=Ni(e,t);if(r===".."||r.startsWith(`..${Li}`)||Ll(r))throw new se(n)}import{dirname as Pt,isAbsolute as Fg,join as Tt,relative as Gg,resolve as At,sep as zg}from"node:path";var wt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Bl="rulebook.json",$l=".cc-safety-net/rules";var Ul=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Ng=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Dg=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Lg="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),HP=new RegExp(`^${Dg}/(${wt.source.slice(1,-1)})/${Lg}$`);function Wg(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Hl(e){if(Ir(e))try{return Wi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return wt.test(e)?null:`Local rulebook sources must be bare names matching ${wt}: ${e}`}function Wi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Ul);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Ng.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!wt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Wg(o),name:o}}function Ir(e){return Ul.test(e)}var jl="rule.json",kr="policy.json",Vl=".cc-safety-net",Bg="rules",$g="CC_SAFETY_NET_HOME",Kl="`cc-safety-net rule update`";function Ug(e){return At(e,$l)}function Hg(e){return Tt(Ug(e),jl)}function Mn(e){return Tt(At(e),Vl,kr)}function Fi(e,t={}){return t.userConfigDir??(t.userConfigPath?Pt(t.userConfigPath):Tt(jg(e),Bg))}function jg(e){let t=e.env.get($g);return t?At(Ce(t)):Tt(e.home,Vl)}function Vg(e,t={}){return Tt(Fi(e,t),jl)}function Jt(e,t={}){return Tt(Pt(Fi(e,t)),kr)}function ql(e,t){let n=t.userConfigPath??Vg(e,t),r=t.projectConfigPath??Hg(t.cwd),o=Kg(e,t),i=qg(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:On(o,n),projectConfigTarget:On(i,r)}}function Kg(e,t){let n=t.userConfigPath?Pt(Pt(At(t.userConfigPath))):Pt(At(t.userConfigDir??Fi(e,t)));return _t(n,"user policy")}function qg(e,t){let n=At(t),r=At(e),o=Gg(n,r);if(o!==".."&&!o.startsWith(`..${zg}`)&&!Fg(o))return _t(n,"project policy");return _t(Pt(Pt(r)),"project policy")}function Yl(e,t){return Tt(e,t,Bl)}var be=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),lt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ct=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Zl=new Set(["python","python3","python2","node","ruby","perl"]),Or=/^python(?:[23](?:\.\d+)*)?$/,_e=new Set(["awk","gawk","nawk","mawk"]),Mr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Xl="Rulebook exceeds CC Safety Net's safe validation limits.",Jl="Additional rulebook validation errors were omitted.",Ie=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Ql(e){if(Gi(e.allowed_commands,Ie.maxAllowedCommands)||Gi(e.rules,Ie.maxRules)||Gi(e.tests,Ie.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Ie,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Ie.maxStringCodeUnits||i&&o.length>Ie.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Ie.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Gi(e,t){return Array.isArray(e)&&e.length>t}var zi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Bi=64,$i="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Yg={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Ui=new Set(["--init-file","--rcfile"]);function Hi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let f=t[c];if(f===void 0)break;if(e==="ksh"&&f==="o"&&c+1<t.length){if(r==="argv"){let d=t.slice(c+1);if(t[0]==="-"&&(d==="c"||d[0]==="-"&&d.endsWith("c")))s=!0}break}if(e==="ksh"&&f==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&f==="o"&&c+1<t.length)break;if(r==="startup"&&f==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&f==="c")s=!0;if(r==="argv"&&f==="n")l=t[0]==="-";if(r==="argv"&&f==="s")a=t[0]==="-";if(!Yg[e]?.includes(f))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Se(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Ui.has(l)&&!s.includes("="))i++;continue}let a=Hi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Nn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Nr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Zg(e))Nn(n,t);return t.inSingle||t.inDouble}function Zg(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Nn(s,n)}return t}var ji=new Set(["rm","find","xargs","parallel"]),Xg=new Set(["git","busybox",...ji,...J,...Zl,..._e]),Jg=new Set(["python","node","ruby","perl"]);function ec(e){let t=M(e);return Xg.has(t)||ke(t)}function ke(e){return Jg.has(Qg(e))}function Qg(e){let t=k(e).toLowerCase();return Or.test(t)?"python":t}function Vi(e){try{let t=Tr(eh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=rh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof se)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function eh(e){return typeof e==="string"?Fl(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function tc(e){let t=new Set;return e.flatMap((n,r)=>{let o=Qt(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Ki=`must be one of ${zi.join(", ")}`,th=/^[^/]+\/[^/]+$/,nh=["version","rules","overrides","transparent_wrappers"];function rh(e){let t=oh(e);return{errors:qi(mh(t,nh,(n)=>n.kind==="custom"),": "," "),sources:fh(e,t)}}function oh(e){if(!Qt(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Bi;return[...e.version===1?[]:[_(["version"],"must be 1")],...ih(e.rules,t),...lh(e.overrides),...uh(e.transparent_wrappers),...t?[]:ah(e.rules),...Qt(e.overrides)?Object.keys(e.overrides).filter((n)=>!th.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...dh(e.transparent_wrappers)]}function ih(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...nc(e,Bi)?[_(["rules"],$i)]:[]];if(t)return[{path:["rules"],message:$i,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...sh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function nc(e,t){let n=rc(e);return n!==void 0&&!(n<=t)}function sh(e,t){let n=rc(e);return n!==void 0&&!(n>=t)}function rc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function ah(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=Hl(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function lh(e){if(e===void 0)return[];if(!Qt(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!Qt(n))return[_(["overrides",t],'must be "off" or an object')];return[...ch(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Zi(n.intent)?[]:[_(["overrides",t,"intent"],Ki)]]})}function ch(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...nc(e,ct)?[_(t,`must be at most ${ct} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ct?[_(t,`must be at most ${ct} characters`)]:[]}function uh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return lt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function dh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(ec(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function fh(e,t){let n=Qt(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function mh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function qi(e,t,n){return[...new Set(e.map((r)=>{let o=Yi(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Yi(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Zi(e){return zi.includes(e)}function Qt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function ic(e){let t=hh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var ph=`required non-empty string up to ${ct} characters`,oc="must be a non-empty array of unique non-empty strings",gh="required non-empty array of non-empty strings";function hh(e){if(!ut(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Ql(e))return{errors:[Xl],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...qi(yh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Ie.maxValidationErrors?[...t.slice(0,Ie.maxValidationErrors),Jl]:t,ruleNames:new Set(sc(e).map((n)=>n.toLowerCase()))}}function sc(e){let t=ut(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ut(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function yh(e,t){return[...typeof e.name==="string"&&wt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Ch(e.allowed_commands),...bh(e.rules,t),...Rh(e.tests),...xh(e),..._h(e)]}function Ch(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&lt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function bh(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!ut(n))return[_(["rules",r],"must be an object")];return t?vh(n,["rules",r]):Sh(n,["rules",r])}),...tc(e)]}function Sh(e,t){return[...ac(e.name,t),...lc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&lt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Dr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...cc(e.reason,t),...uc(e.intent,t)]}function vh(e,t){return[...ac(e.name,t),...lc(e.command,t),...cc(e.reason,t),...uc(e.intent,t),...Eh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function ac(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return wt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function lc(e,t){return typeof e==="string"&&lt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function cc(e,t){return typeof e==="string"&&e!==""&&e.length<=ct?[]:[_([...t,"reason"],ph)]}function uc(e,t){return e===void 0||Zi(e)?[]:[_([...t,"intent"],Ki)]}function Eh(e,t){if(!ut(e))return[_(t,"required object")];return[...Dr(e.command_path,[...t,"command_path"],gh,!1),...e.any_args===void 0?[]:Dr(e.any_args,[...t,"any_args"],oc,!0),...e.exclude_args===void 0?[]:Dr(e.exclude_args,[...t,"exclude_args"],oc,!0)]}function Dr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Rh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!ut(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function xh(e){if(!Array.isArray(e.tests))return[];let t=new Set(sc(e));return[...new Set(e.tests.flatMap((n)=>ut(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function _h(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=ut(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function ut(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function hc(e,t){let n=ql(e,t),r=!1;try{r=Gl(n.userConfigTarget,n.projectConfigTarget)}catch(m){if(m instanceof se)return Nh(n,m.message);throw m}let o=Vi(n.userConfigTarget),i=r?{config:null,errors:[]}:Vi(n.projectConfigTarget),s=pc(n.userConfigPath,o.errors),a=pc(n.projectConfigPath,i.errors),l=new Set,c=o.config?dc(o.config,Lr(n.userConfigPath),"user",n.userScope,l):gc(),f=i.config?dc(i.config,Lr(n.projectConfigPath),"project",n.projectScope,l):gc(),d=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...fc(c.rules,d),...fc(f.rules,u)],transparent_wrappers:Oh(o.config,i.config),rulebooks:[...c.rulebooks,...f.rulebooks],errors:[...s,...a,...c.errors,...f.errors],warnings:[...c.warnings,...f.warnings,...c.canValidateOverrides?mc(d,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Mh(u,c.knownRuleIds,n.projectConfigPath):[],...f.canValidateOverrides?mc(u,f.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function dc(e,t,n,r=_t(Lr(Lr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let f=Ph(c,t,r);if(f.errors.length>0||!f.rulebook)return i.push(...f.errors),[];let d=f.rulebook;if(o.has(d.name))return s.push(`duplicate active rulebook name "${d.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(d.name),[{rules:wh(d),rulebook:{source:n,spec:c,name:d.name,version:d.version,rules:d.rules.map((u)=>`${d.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function wh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Ph(e,t,n){let r=Ah(e),o=Yl(t,r),i=Ih(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Th(e)}`]};let s=kh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Ah(e){return Ir(e)?Wi(e).name:e}function Th(e){return Ir(e)?`run ${Kl} to vendor ${e}`:"create that file or remove that source from the rules config"}function Ih(e,t){try{return{content:Tr(On(t,e))}}catch(n){if(n instanceof se)return{error:n.message};throw n}}function kh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:ic(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function Oh(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function fc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function mc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Mh(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function pc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Nh(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function gc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Kh,readFileSync as qh}from"node:fs";var yc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Xi=new Set(yc.map((e)=>e.id)),Wr=yc,Dh=new Map(Wr.map((e)=>[e.id,e.intent]));function b(e,t){return{id:e,reason:t,intent:Dh.get(e)??"manual_only"}}var Ji=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Fr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Lh=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Wh=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Qi=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Wh.flatMap((e)=>Lh.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Gr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Cc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Fh=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],es=Cc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ts=Cc.flatMap((e)=>Fh.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Dn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ns=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),rs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Gh=[...Ji,Fr,...Qi,...es,...ts,Dn,...ns,...rs,...Gr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),zr=new Set(Gr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),os=new Set(Gh.map((e)=>e.id));import{isAbsolute as is,join as zh,normalize as Bh,sep as Br}from"node:path";var bc=process.platform==="win32",$h=/[*?]/;function Ln(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ss(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Ln(e.trim(),t);if(!is(n))return"must be an absolute path or start with ~/";return Wn(n,t)}function as(e,t){let n=Sc(e,t);if(n===null)return"must be a non-empty path string";if(!is(n))return null;if(Wn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Uh="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Hh="cannot cover the guard's own configuration";function Sc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Ln(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ls(e,t){let n=Sc(e,t);if(n===null)return"must be a non-empty path string";if($h.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!is(n))return null;if(Wn(n,t)!==null)return Uh;return jh(n,t)?Hh:null}function jh(e,t){let n=$r(e),r=$r(zh(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Br}`)}function Wn(e,t){let n=$r(e),r=$r(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Br)?n:`${n}${Br}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function $r(e){let t=Bh(e);if(bc)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(bc?3:1)&&t.endsWith(Br))t=t.slice(0,-1);return t}var vc=30,Ur=1,Hr=365;function Ec(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Rc=new Set(Wr.filter((e)=>e.catastrophic).map((e)=>e.id));function A(e,t){if(!e)return null;if(Rc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Rc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function xc(e,t){return Object.freeze(Object.fromEntries(Wr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function _c(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:xc(e,t)})}var wc={standard:0,strict:1,paranoid:2};function Tc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:cs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:cs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:cs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:Vh(e,t)}}function cs(e,t){return[...new Set([...e,...t??[]])]}function Vh(e,t){let n=t.safety?.level,r=wr[e.safety.level];return[...n&&wc[n]<wc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Xt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Pc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Pc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!zr.has(o))),...e.destructive_command_protection.enabled?Ac(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Ac(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Pc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Ac(e,t){return(t??[]).filter((n)=>!e.includes(n))}var fs=new Set(["standard","strict","paranoid"]),Mc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:vc}};function Nc(e,t){let n=oy(Jt(e,t),e.home),r=Kr(Mn(t.cwd),e.home),o=Zh(r.parsed,e.home),i=Object.keys(o.policy).length>0?Tc(n.gui??Mc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ds(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Yh="project policy audit settings are ignored; audit is user scope only";function Zh(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...fs.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Ic({overrides:Dc(n.overrides,Xt,["safety","overrides"],It)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Vr(o.overrides,Xi,Wc,It)}:{},...o.allow_paths!==void 0?{allow_paths:tn(o.allow_paths,ss,t,["destructive_command_protection","allow_paths"],It)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Vr(i.overrides,os,Fc,It)}:{},...i.deny_paths!==void 0?{deny_paths:tn(i.deny_paths,as,t,["secret_protection","deny_paths"],It)}:{},...i.allow_paths!==void 0?{allow_paths:tn(i.allow_paths,ls,t,["secret_protection","allow_paths"],It)}:{}};return{policy:Ic({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Yh]}}function Dc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],ms));return[]}))}function Ic(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var It=()=>{return},ms="must be a boolean",ps="must be an object if provided",Lc=`must be an integer between ${Ur} and ${Hr}`,Wc={path:["destructive_command_protection","overrides"],label:"destructive command"},Fc={path:["secret_protection","overrides"],label:"secret protection"},Xh=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Jh(e,t){let n=[];return{policy:Gc(e,t,(o)=>{n.push(o)}),issues:n}}function Qh(e,t){return Gc(e,t,It)}function Gc(e,t,n){if(!ve(e))return n(_([],"Config must be an object")),jr();if(e.version!==1)n(_(["version"],"must be 1"));let r=en(e.safety,["safety"],["level","overrides"],n),o=en(r.overrides,["safety","overrides"],Xt,n),i=en(e.workflow,["workflow"],["worktree_mode"],n),s=en(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=en(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=en(e.audit,["audit"],["retention_days"],n);return zc(e,Xh,[],n),{version:1,safety:{level:ey(r.level,n),overrides:Dc(o,Xt,["safety","overrides"],n)},workflow:{worktree_mode:us(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:us(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Vr(s.overrides,Xi,Wc,n),allow_paths:tn(s.allow_paths,ss,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:us(a.enabled,["secret_protection","enabled"],!0,n),overrides:Vr(a.overrides,os,Fc,n),deny_paths:tn(a.deny_paths,as,t,["secret_protection","deny_paths"],n),allow_paths:tn(a.allow_paths,ls,t,["secret_protection","allow_paths"],n)},audit:{retention_days:ty(l.retention_days,n)}}}function en(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(t,ps)),{};return zc(e,n,t,r),e}function zc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function ey(e,t){if(e===void 0)return"standard";if(fs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function us(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,ms));return n}function ty(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Ur&&e<=Hr))t(_(["audit","retention_days"],Lc));return Ec(e)}function Vr(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(n.path,ps)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function tn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function jr(){return structuredClone(Mc)}function Kr(e,t){if(!Kh(e))return{exists:!1,policy:jr(),errors:[]};try{let n=qh(e,"utf-8");if(!n.trim())return{exists:!0,policy:jr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Jh(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${ry(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:jr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var ny=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[ps,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[ms,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Lc,`not an integer between ${Ur} and ${Hr}`]]);function ry(e){let t=Yi(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=ny.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function oy(e,t){let n=Kr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:Oc(),errors:[]};let o=Qh(r,t);return{policy:ds(o),gui:o,errors:[],levelPresent:kc(r)}}if(n.parsed===void 0)return{policy:Oc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ds(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:kc(n.parsed)}}function kc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return fs.has(t.level)}function Bc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...zr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Oc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Bc({}),denyPaths:[],allowPaths:[]}}}function ds(e){return{safety:iy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Bc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function iy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function $c(e,t){let n=hc(e,t),r=Nc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((f)=>f.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...cy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return uy(o,sy(n,r),s,r.policyScopes)}function sy(e,t){let n=ly(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:dy(e.errors.length>0?ay(e.errors):void 0,e.warnings.length>0?hs(e.warnings.join("; ")):void 0,n)}}function ay(e){return`${hs(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function ly(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function cy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function uy(e,t,n=Object.freeze({}),r){let o=gs(structuredClone(e)),i=r?{policyScopes:gs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function gs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))gs(t);return Object.freeze(e)}function dy(...e){return hs(e.filter((t)=>!!t).join("; "))}function hs(e){return/[.!?]$/.test(e)?e:`${e}.`}function Uc(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:ys(t.fail_closed,e.strict,"strict"),paranoid_rm:ys(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:ys(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:_c(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:wi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function ys(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Fn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var fy=/^[A-Za-z_][A-Za-z0-9_]*=/;function qr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Gn(e){let t=qr(e.words[0],"time")?1:0,n=t===1&&qr(e.words[t],"-p")?t+1:t,r=t===1&&qr(e.words[n],"--")?n+1:n,o=qr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!fy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var dt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Yr(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function my(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function Zr(e,t,n){e.push(n),t.reset()}function Xr(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Cs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function nn(e,t,n,r,o,i,s){return Cs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return my(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function bs(e,t,n){if(t>=n||jc(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!jc(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Hc(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Hc(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ss(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=py(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?gy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Hc(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function jc(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function py(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function gy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Yc=new Set(["&&","||","|","|&"]);function Zc(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=eo(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:ro(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function eo(e,t,n,r,o,i,s){let a=[],l=[],c=Yr(),f=[],d=()=>{if(c.words.length===0&&c.redirections.length===0)return;let m={start:c.start,end:c.end},p=c.words.map((h)=>h.text);Zr(a,c,{kind:"command",dialect:"posix",source:e.slice(m.start,m.end),span:m,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(s&&m===s)return d(),qc(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:f};if(no(m)){if(m===`
-`||m==="\r"){d();let S=m==="\r"&&e[u+1]===`
-`?u+2:u+1,T=a.at(-1);if(T?.kind!=="connector"||!Yc.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,S),span:Object.freeze({start:u,end:S})}));if(f.length>0){let R=Ss(e,S,n,f.splice(0));l.push(...R.issues),u=R.next;continue}u=S;continue}u++;continue}if(m==="#"){while(u<n&&e[u]!==`
-`&&e[u]!=="\r")u++;continue}let p=c.start===-1?Ly(e,u,n):void 0;if(p){if(Es(a,l),i>=r.maxDepth)return rn(a,l,u,"depth-limit",r.maxDepth);if(!vs(o))return rn(a,l,u,"word-limit",r.maxWords);let S=eo(e,p.braceIndex+1,n,r,o,i+1,"}"),T=S.next,R={start:p.braceIndex+1,end:S.closed?T-1:T},P=Vc(e,R,S);if(a.push({kind:"function",name:p.name,span:{start:u,end:T},body:P}),l.push(...S.issues),S.pendingHeredocs.length>0||Bn(S.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(f.push(...S.pendingHeredocs),S.limited)return Qr(a,l,S.next);if(!S.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=T;continue}let h=to(e,u);if(h){if(d(),!ou(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:u,end:u+h.length})})),u+=h.length;continue}if(m===")"){d(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:m,span:{start:u,end:u+1}}),u++;continue}if((m==="("||m==="{"&&Ry(e,u,n))&&c.start===-1){if(Es(a,l),i>=r.maxDepth)return rn(a,l,u,"depth-limit",r.maxDepth);let S=m==="("?")":"}",T=eo(e,u+1,n,r,o,i+1,S),R=T.next,P={start:u+1,end:T.closed?R-1:R},q=Vc(e,P,T);if(a.push({kind:"group",style:m==="("?"subshell":"brace",span:{start:u,end:R},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Bn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(f.push(...T.pendingHeredocs),T.limited)return Qr(a,l,T.next);if(!T.closed)l.push({code:m==="("?"unclosed-subshell":"unclosed-brace-group",message:`${m} group is not closed`});u=R;continue}let g=(m==="<"||m===">")&&e[u+1]!=="("?by(e,u):null;if(g){let S=c.words.at(-1),T=S&&S.span.end===u&&/^[0-9]+$/.test(S.raw)?Number(S.raw):void 0;if(T!==void 0)c.words.pop();let R=T===void 0?u:S?.span.start??u;c.start=c.start===-1?u:c.start;let P=u+g.length;while(P<n&&/[ \t]/.test(e[P]??""))P++;let q=e[P],Z=P>u+g.length&&q==="#",ee=!q||no(q)||!!to(e,P)||q===s||q===")"||Z||(q==="<"||q===">")&&e[P+1]!=="(",X=g==="<<"||g==="<<-",U=X?bs(e,P,n):void 0,D=U?{word:nn(e,P,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Rs(e,P,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return Qr(a,l,D.next);if(!vs(o))return rn(a,l,D.next,"word-limit",r.maxWords)}let le=D?.next??u+g.length,xe={kind:"redirection",operator:g,span:{start:R,end:le},...T===void 0?{}:{fd:T},...D?{target:D.word}:{}};if(c.redirections.push(xe),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let je=c.nested;f.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:g==="<<-",attach:(Te)=>{if(xe.heredoc=Te,Te.quotedDelimiter)return;je.push(...yy(e,Te.bodySpan.start,Te.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`});if(D)c.nested.push(...D.nested);c.end=le,u=le;continue}if(c.start===-1)Es(a,l);let y=Rs(e,u,n,r,o,i);if(l.push(...y.issues),y.limited)return Qr(a,l,y.next);let v=wy(c.words)?ky(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return rn(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let S of E){if(!vs(o))return rn(a,l,y.next,"word-limit",r.maxWords);c.words.push(S)}c.start=c.start===-1?u:c.start,c.end=y.next,c.nested.push(...y.nested),u=y.next>u?y.next:u+1}return d(),qc(a,l),l.push(...Wy(f)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Vc(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:ro(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Rs(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",f=[],d=[],u=!1;while(a<n){let m=e[a],p=(m==="<"||m===">")&&e[a+1]==="(";if(!m||no(m)||(m===";"||m==="|"||m==="&")&&to(e,a)||(m==="<"||m===">")&&!p)break;if(m===")")break;if(m==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),d.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(m==='"'){l=!0;let g=hy(e,a,n,r,o,i);if(s+=g.text,f.push(...g.nested),d.push(...g.issues),u||=g.limited,c=zn(c,g.provenance),a=g.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Sy(e,a+2,n);if(s+=g.text,d.push(...g.issues),!g.closed)d.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=g.next;continue}if(m==="\\"){let g=e[a+1];if(!g){d.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(g===`
-`){a+=2;continue}s+=g,a+=2;continue}let h=m==="$"||m==="<"||m===">"||m==="`"?oo(e,a,n,r,o,i):null;if(h){let g=Xc(h,f,d);if(u||=g.limited,c=zn(c,g.provenance),a=g.next,u)break;continue}if(m==="$"){let g=eu(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(m==="*"||m==="?"||m==="[")c=zn(c,"glob");s+=m,a++}return{word:nn(e,t,a,s,c,l,c==="literal"?void 0:Ey(e,t,a)),nested:f,issues:d,next:a,limited:u}}function hy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],f=!1,d=t+1;while(d<n){let u=e[d];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:d+1,limited:f};if(u==="\\"&&e[d+1]){let p=e[d+1]??"";if(p===`
-`){d+=2;continue}if(p==="\r"&&e[d+2]===`
-`){d+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,d+=2;continue}if(e.startsWith("$((",d)){let p=xs(e,d+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(d,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});d=h;continue}let m=oo(e,d,n,r,o,i);if(m){let p=Xc(m,l,c);if(d=p.next,f||=p.limited,a=zn(a,p.provenance),f)return{text:s,provenance:a,nested:l,issues:c,next:d,limited:f};continue}if(u==="$"){let p=eu(e,d,n,s,a);s=p.text,a=p.provenance,d=p.next;continue}s+=u??"",d++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:f}}function oo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let f=s?3:c?1:2,d=s?"))":c?"`":")",u=xs(e,t+f,n,d),m=u===-1?n:u,p=u===-1?n:u+d.length;if(i>=r.maxDepth)return{program:Dy(e,t+f,m,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],S=!1,T=t+f;while(T<m){let R=oo(e,T,m,r,o,i+1);if(!R){T++;continue}if(v.push(...R.program.nodes),E.push(...R.program.issues),S||=R.program.status==="limited",T=R.next,S)break}if(u===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+f,m),span:{start:t+f,end:m},status:ro(E,S),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=eo(e,t+f,m,r,o,i+1),g=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+f)} substitution is not closed`}]:[],y=(c||l)&&Bn(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+f,m),span:{start:t+f,end:m},status:ro([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function yy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?oo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function Xc(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function xs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
-`||l==="\r")&&s.length>0){let f=l==="\r"&&e[a+1]===`
-`?a+2:a+1,d=Ss(e,f,n,s.splice(0));if(!d.terminated)return-1;a=d.next-1;continue}let c=Jc(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let f=Cy(e,a+3,n);if(f===-1)return-1;a=f+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let f=e[a+2]==="-",d=a+(f?3:2);while(d<n&&/[ \t]/.test(e[d]??""))d++;let u=bs(e,d,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:f,attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Cy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=Jc(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function Jc(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!Fy(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function to(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function by(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function no(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function Qc(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Sy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=vy(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function vy(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return Jr(e,t+1,n,16,2,t+1);if(r==="u")return Jr(e,t+1,n,16,4,t+1);if(r==="U")return Jr(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return Jr(e,t,n,8,3,t+1);return{text:r,next:t+1}}function Jr(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function ro(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function eu(e,t,n,r,o){let i=Qc(e,t,n);return{text:r+e.slice(t,i),provenance:zn(o,"variable"),next:i}}function Ey(e,t,n){let r=Xr(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),f=e.startsWith("$(",a)&&!c,d=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||f||d||u){let m=c?3:u?1:2,p=c?"))":u?"`":")",h=xs(e,a+m,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let m=Qc(e,a,n);if(m>a+1){r.push(o,a,"literal"),r.push(a,m,"variable"),a=m,o=m;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function zn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function Ry(e,t,n){return t+1>=n||no(e[t+1]??"")||to(e,t+1)!==null}var xy=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),_y=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function wy(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Py(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Py(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Ay(e,t);if(n==="env")return Ty(e,t);if(n==="sudo")return Iy(e,t);return}function Ay(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Ty(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(xy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function Iy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(_y.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function tu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=nu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>ru(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function ky(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=nu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>ru(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>nn(e,t.span.start,t.span.end,a,"literal",!1))}}function nu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((m)=>Kc(m,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",f=Kc(c,o);if(!f||f.kind==="range")return{limited:"expansions"};let d=f.start+c.length-f.end,u=f.alternatives.reduce((m,p)=>m+d+p.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+f.alternatives.length>t)return{limited:"words"};i.splice(l,1,...Oy(c,f)),s+=u-c.length}return a===0?void 0:{values:i}}function Kc(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Ny(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:My(e,r)}}function Oy(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function My(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Ny(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function ru(e,t){let n=`x${e}`,r=Rs(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function Dy(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function rn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Qr(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function vs(e){return e.used++,e.used<=e.max}function Ly(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Bn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Bn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Bn(t.body.nodes)})}function Wy(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function ou(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function qc(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!Yc.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Es(e,t){if(!ou(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function Fy(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var su=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Gy=new Set(["gc","cat","type","cp","mv","rm"]),au=["-rec","-for","-path","-literalpath","-whatif"],zy=/^\$env:\w/i,By=/^(?:\$\{?\w+\}?|~)\\./;function lu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...su].some((o)=>n.includes(o))&&!(n.includes("rm")&&au.some((o)=>n.includes(o)))&&!n.includes("<#")&&!$y(n))return!1;let r=As(e,t);if(cu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ps(r).some(Uy)}function cu(e){return e.nodes.some((t)=>{if(t.kind==="group")return cu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function $y(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Uy(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&su.has(n))return!0;let r=e.slice(t+1);if(n&&Gy.has(n)&&r.some(Hy))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return au.some((s)=>i.startsWith(s))})}function Hy(e){return zy.test(e)||By.test(e)}function As(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ts(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:Yy(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ts(e,t,n,r,o,i=!1){let s=[],a=[],l=Yr(),c=0,f=!1,d=()=>{if(l.words.length===0&&l.redirections.length===0)return;let m={start:l.start,end:l.end};Zr(s,l,{kind:"command",dialect:"powershell",source:e.slice(m.start,m.end),span:m,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(i&&m==="}")return d(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:f};let p=qy(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return d(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(m)){if(m==="\r"||m===`
-`){d();let y=m==="\r"&&e[u+1]===`
-`?u+2:u+1;s.push(_s(e,u,y)),u=y;continue}u++;continue}let h=fu(e,u);if(h){d(),s.push(_s(e,u,u+h.length)),u+=h.length;continue}if(m==="{"){if(d(),o>=r.maxDepth)return a.push(du(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ts(e,u+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(u+1,v),span:{start:u+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,f||=y.limited,u=y.next;continue}if(m==="}"){d(),s.push(_s(e,u,u+1)),u++;continue}if(m===">"||m==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===m?u+2:u+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?iu(e,v,n,r,o):void 0,S=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:S}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,f||=E.limited;l.end=S,u=S;continue}if(m===","){l.start=l.start===-1?u:l.start,l.words.push(Cs({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let g=iu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,f||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),d(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};u=g.next>u?g.next:u+1}return d(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:f}}function iu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],f=0,d=!1,u=(p)=>{let h=jy(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),f+=ws(h.program),d||=h.program.status==="limited",s="command-substitution",h.next},m=t;while(m<n){let p=e[m];if(!p||/\s/.test(p)||fu(e,m)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[m+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),m++;break}i+=h,m+=2;continue}if(e.startsWith("$(",m)){m=u(m);continue}if(p==="'"){a=!0,m++;let h=!1;while(m<e.length){if(e[m]==="'"&&e[m+1]==="'"){i+="'",m+=2;continue}if(e[m]==="'"){h=!0,m++;break}i+=e[m]??"",m++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,m++;let h=!1;while(m<n){let g=e[m];if(g==="`"&&e[m+1]){i+=e[m+1],m+=2;continue}if(g==='"'){h=!0,m++;break}if(e.startsWith("$(",m)){m=u(m);continue}if(g==="$")s=e[m+1]==="("?"command-substitution":"variable";i+=g??"",m++}if(!h)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[m+1]==="("?"command-substitution":"variable";if(p==="@"&&m===t)s="variable";i+=p,m++}return{word:nn(e,t,m,i,s,a,s==="literal"?void 0:Vy(e,t,m)),next:m,issues:l,nested:c,words:f,limited:d}}function jy(e,t,n,r,o){let i=uu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[du(r.maxDepth)],nodes:[]}),next:a};let l=Ts(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function uu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function ws(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=ws(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=ws(r)}}return t}function Vy(e,t,n){let r=Xr(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=uu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=Ky(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function Ky(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function du(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ps(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ps(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ps)]})}function fu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function qy(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Yy(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function _s(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Oe(e,t="auto",n=dt){if(t==="powershell"||t==="auto"&&lu(e.slice(0,n.maxInputLength),n))return As(e,n);return Zc(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function on(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function io(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Is(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function $n(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){$n(e,t)}function kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function ks(e){return e===`
+`)}function ll(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function _n(e={}){return{reason:xn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function cl(e){return yp({...e,redact:st})}function ul(e){return st(e instanceof Error?e.message:String(e))}import{isAbsolute as Ol,relative as jp,resolve as Vp,sep as Kp}from"node:path";import{basename as ml,dirname as Cp,isAbsolute as bp,join as Sp,normalize as vp,resolve as dl}from"node:path";var Ep=256,xr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function at(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ei(e,t){return bi(e,0,t)}function bi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Si(e,o+2),a=Rp(e,o,t);if(a===null){if(xr.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=xp(l,t,n),o=a+1;continue}let i=Si(e,o+1);if(!i){r+="$",o++;continue}r+=vi(i,n)??`$${i}`,o+=i.length+1}return r}function Rp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function xp(e,t,n){let r=e.slice(2,-1),o=Si(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return vi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(xr.has(o))throw new N("pathEnvironmentExpansion");return e}if(!xr.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=vi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":bi(i.slice(s.length),t+1,n);return l?bi(i.slice(s.length),t+1,n):""}function Si(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function vi(e,t){if(!xr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function F(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){pl(n,i);let s=t.realpath(i);if(s!==null)return fl(n,e,s,o);let a=Cp(i);if(a===i||o.length>=Ep)return fl(n,e,i,o);o.push(ml(i)),i=a}}function fl(e,t,n,r){let o=r.length===0?n:Sp(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function _p(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;pl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function pl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=hl(e,t,n);if(!o)return"";return F(o,n.paths,r).replace(/\\/g,"/")}function gl(e,t,n,r,o){let i=hl(e,t,n);if(!i)return null;if(o(ml(i)))return F(i,n.paths,r).replace(/\\/g,"/");let s=_p(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function hl(e,t,n){let r=n.home,o=Ei(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?dl(r,o.slice(2)):o,s=Ce(i);return vp(bp(s)?s:dl(t,s))}import{types as wp}from"node:util";var Pp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Ap=new Set(["command","diff","input","patch","patchtext"]),yl=new TextEncoder,Tp=new TextDecoder,Ip=/\s/,kp=64;class Ve extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var wn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Op(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function wr(e){return Pp.has(Op(e))}function An(e){if(!e||typeof e!=="object")return;Al(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ue();return}if(t.get||t.set)Ue();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function El(e,t){return Rl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Rl(e,t,n,r){let o=Pl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Rl(a,t,n,r+1);return typeof a==="string"&&t.has(xl(s))?[a]:l});return n.ancestors.delete(o.object),i}function xl(e){return e.replace(/-/g,"_").toLowerCase()}function _l(e){return wl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Np)}function wl(e,t,n,r){let o=Pl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>wl(a,o.array?t:Ap.has(xl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Mp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>wn.maxDepth||t.nodes>wn.maxNodes)Ue();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>wn.maxStringBytes||t.stringBytes>wn.maxAggregateStringBytes)Ue()}function Pl(e,t,n){if(Mp(e,t,n),!e||typeof e!=="object")return null;let r=Al(e);if(t.ancestors.has(e))Ue();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>wn.maxKeys)Ue();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ue();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Al(e){if(wp.isProxy(e))Ue();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ue();return t}function Ue(){throw new Ve}function Np(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Dp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ri(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ri(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(..._i(_r(c.slice(4),!0),_r(u.slice(4),!0))),l++;continue}if(!r)t.push(...Ri(c))}return t}function Dp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ri(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return vl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return vl(n[1]);if(e.startsWith("diff --git "))return Lp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Sl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Sl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Up(i[1]);return[]}function Lp(e){let t=Wp(e);if(t.length===2&&t[0]&&t[1])return _i(t[0],t[1]);let n=Gp(e);return n?_i(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Wp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Rt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Rt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Tl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Rt(e[n]))n++;return n===e.length?t:[]}function Gp(e){let t=0;while(t<e.length&&Rt(e[t]))t++;let n=e.length;while(n>t&&Rt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Rt(e[o])){o++;continue}let i=o;while(o<n&&Rt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>kp)Ue();if(Fp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Fp(e,t,n,r,o){if(xi(e,t,n,r,o))return!0;let i=Cl(e,"/",t,n),s=Cl(e,"/",r,o);if(i<=t||s<=r)return!1;if(xi(e,t,i,r,s))return!1;return xi(e,i+1,n,s+1,o)}function xi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Cl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Rt(e){return e!==void 0&&Ip.test(e)}function Tl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Tp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...yl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...yl.encode(zp(s[0]??""))),o+=2}return null}function zp(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function Bp(e){return Pn(Hp(e))}function _i(e,t){if(e==="/dev/null")return bl(t);if(t==="/dev/null")return bl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Pn);let n=$p(e,t)??(e===t?Il(e):null);return[e,t,...n?[n]:[]].flatMap(Pn)}function bl(e){let t=Il(e);return[e,...t?[t]:[]].flatMap(Pn)}function Il(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function $p(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Sl(e){return Bp(_r(e,!0))}function Up(e){return Pn(_r(e,!1))}function _r(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Tl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Hp(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Pn(e){return e===""||e==="/dev/null"?[]:[e]}function vl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function wi(e,t,n){if(at(e))return;let r=t.flatMap((i)=>kl(i,n));if(!r[0])return;let o=kl(Ol(e)?e:Vp(r[0],e),n)[0];if(!o)return;return r.some((i)=>qp(o,i))?o:void 0}function kl(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function qp(e,t){let n=jp(t,e);return n===""||n!==".."&&!n.startsWith(`..${Kp}`)&&!Ol(n)}function Tn(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Eg,realpathSync as Rg,statSync as xg}from"node:fs";import{homedir as _g,tmpdir as wg}from"node:os";import{statSync as bg}from"node:fs";import{join as Sg}from"node:path";import{spawnSync as Yp}from"node:child_process";import{existsSync as kn,lstatSync as Zp,readFileSync as On,realpathSync as Yt,statSync as In}from"node:fs";import{dirname as Pi,isAbsolute as Ai,join as Zt,resolve as Pr}from"node:path";var Xp=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Jp=5000;function Nl(e,t=gg(),n=Jp){let r=Qp(e),o=r===null?null:eg(r);if(r===null||o===null)return null;let i=mg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Qp(e){try{let t=Yt(Pr(e));return In(t).isDirectory()?t:null}catch{return null}}function eg(e){let t=fg(e);if(!t)return null;try{let n=Zp(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Ti(t);if(!r?.commonDir)return null;if(!rg(r.gitDir,t))return null;return og(r.gitDir,Pi(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Ti(e){try{let t=tg(e);if(!t)return null;let n=Yt(Ai(t)?t:Pr(Pi(e),t));if(!In(n).isDirectory())return null;return{gitDir:n,commonDir:ng(n)}}catch{return null}}function tg(e){let t=On(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function ng(e){try{let t=On(Zt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Yt(Ai(t)?t:Pr(e,t));return In(n).isDirectory()?n:null}catch{return null}}function rg(e,t){let n=ig(e);return n===null?!1:Dl(e,n,t)}function og(e,t){let n=sg(e);return n===null?!0:Dl(e,n,t)}function ig(e){let t=Zt(e,"gitdir");if(!kn(t))return null;let n=On(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function sg(e){let t=Zt(e,"config.worktree");return kn(t)?lg(t):null}function Dl(e,t,n){try{return ag(Ai(t)?t:Pr(e,t),n)}catch{return!1}}function ag(e,t){try{let n=In(e),r=In(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Ml(Yt.native(e))===Ml(Yt.native(t))}function Ml(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function lg(e){let t=On(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=cg(s[1]??"")}return r}function cg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return dg(t.slice(1,-1))}var ug={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function dg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:ug[n]??t)}function fg(e){try{return Ii(Yt(e))}catch{return null}}function Ii(e){let t=e;while(!0){let n=Zt(t,".git");if(kn(n))return n;let r=Pi(t);if(r===t)return null;t=r}}function mg(e,t,n,r){if(pg(t))return!0;if(n===null)return!0;let o=Yp(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:hg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Ll(o.stdout.trim())}function pg(e){return[Zt(e.commonDir,"config"),Zt(e.gitDir,"config.worktree")].filter((t)=>kn(t)).some((t)=>yg(t))}function gg(){return Xp.find((e)=>kn(e))??null}function Mn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function hg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Mn(t)))}function yg(e){let t;try{t=On(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Cg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Ll(c)}return r}function Cg(e){return e==="include"||e.startsWith("includeif ")}function Ll(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Wl(e,t){if(e==="")return null;let n=ye(),r=Ii(se(e,e,t,n)),o=r?vg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function vg(e,t,n,r){try{let o=se(e,t,n,r),i=bg(e),s=i.isFile()?o:null,a=i.isFile()?Ti(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Xt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Xt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Xt(o),markerFile:s?Xt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let f=Xt(Sg(u,"hooks").replace(/\\/g,"/"));return[f,Xt(se(f,t,n,r))]}))]}}catch{return null}}function Xt(e){return process.platform==="win32"?e.toLowerCase():e}var Pg={realpath:(e)=>{try{return Rg(e)}catch{return null}},entryKind:(e)=>{let t=Eg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return xg(e).isDirectory()}catch{return!1}}};function Fl(){return Ag({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ce(process.env.HOME||_g()),tmpdir:wg(),paths:Pg})}function Ag(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Gl(n,i,()=>Wl(i,o)),worktreeFacts:(i)=>Gl(r,i,()=>Nl(i)),...t};return o}function Gl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Jt=["fail_closed","paranoid_rm","paranoid_interpreters"],Ar={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Tr=["standard","strict","paranoid"];function Tg(e,t){if(!t)return e;return Tr.indexOf(t)>Tr.indexOf(e)?t:e}function Ig(e){let t=Ni(Q.level,e);if(t===void 0||t==="")return;if(Tr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Tr.join(", ")}.`);return}function kg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function zl(e){return kg(Ni(Q.auditScope,e))==="all"}function Oi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Mi(e={},t){let n=e.safety?.level??"standard",r=Ig(t),o=Tg(n,r),i=Ar[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(xt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(xt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(xt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(xt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||xt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Oi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function xt(e,t){let n=typeof e==="string"?ki(e,t):Ni(e,t);return n==="1"||n?.toLowerCase()==="true"}function ki(e,t){return t.get(e)}function Ni(e,t){let n=ki(e.name,t);if(n!==void 0)return n;if(e.legacyName)return ki(e.legacyName,t);return}import{dirname as Gr}from"node:path";import{closeSync as Og,constants as Bl,fstatSync as Mg,fsyncSync as XP,lstatSync as Wi,mkdirSync as JP,openSync as Ng,readdirSync as QP,readFileSync as Dg,realpathSync as Gi,renameSync as eA,rmdirSync as tA,statSync as Lg,unlinkSync as nA,writeFileSync as rA}from"node:fs";import{isAbsolute as $l,join as Fi,normalize as Wg,parse as Li,relative as zi,resolve as Bi,sep as $i}from"node:path";function Di(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Gg=Symbol("PolicyFilesystemScope"),Fg=Symbol("PolicyFilesystemTarget"),zg=Bl.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function _t(e,t){return{[Gg]:!0,root:Bi(e),label:t}}function Ul(e,t){let n=Wg(t);if(t===""||$l(t)||n===".."||n.startsWith(`..${$i}`))throw new ae(e.label);return{[Fg]:!0,scope:e,relativePath:n,path:Fi(e.root,n)}}function Nn(e,t){return Ul(e,zi(e.root,Bi(t)))}function Hl(e,t="rules policy"){let n=Bi(e),r=Li(n).dir;return Ul(_t(r,t),zi(r,n))}function kr(e){return Vl(e.scope.label,()=>{if(!Ir(e))return null;let t=Ng(e.path,Bl.O_RDONLY|zg);return Bg(t,()=>{let n=Mg(t);if(!n.isFile())throw new ae(e.scope.label);let r=Dg(t,"utf-8"),o=Wi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return Ir(e),r})})}function jl(e,t){if(e.path===t.path)return!0;return Vl(e.scope.label,()=>{if(!Ir(e)||!Ir(t))return!1;let n=(r)=>Fi(Gi(Li(r).dir),Li(r).base);return n(e.path)===n(t.path)})}function Vl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function Bg(e,t){try{return t()}finally{Og(e)}}function Ir(e,t="file"){let n=$g(e.scope);if(!n)return!1;let r=e.relativePath.split($i);for(let o of r.keys()){let i=Fi(e.scope.root,...r.slice(0,o+1)),s=Wi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);Ug(n,Gi(i),e.scope.label)}return!0}function $g(e){if(!Wi(e.root,{throwIfNoEntry:!1}))return null;if(!Lg(e.root).isDirectory())throw new ae(e.label);return Gi(e.root)}function Ug(e,t,n){let r=zi(e,t);if(r===".."||r.startsWith(`..${$i}`)||$l(r))throw new ae(n)}import{dirname as Pt,isAbsolute as qg,join as Tt,relative as Yg,resolve as At,sep as Zg}from"node:path";var wt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Kl="rulebook.json",ql=".cc-safety-net/rules";var Yl=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Hg=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,jg=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Vg="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),aA=new RegExp(`^${jg}/(${wt.source.slice(1,-1)})/${Vg}$`);function Kg(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Zl(e){if(Or(e))try{return Ui(e),null}catch(t){return t instanceof Error?t.message:String(t)}return wt.test(e)?null:`Local rulebook sources must be bare names matching ${wt}: ${e}`}function Ui(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Yl);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Hg.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!wt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Kg(o),name:o}}function Or(e){return Yl.test(e)}var Xl="rule.json",Mr="policy.json",Jl=".cc-safety-net",Xg="rules",Jg="CC_SAFETY_NET_HOME",Ql="`cc-safety-net rule update`";function Qg(e){return At(e,ql)}function eh(e){return Tt(Qg(e),Xl)}function Dn(e){return Tt(At(e),Jl,Mr)}function Hi(e,t={}){return t.userConfigDir??(t.userConfigPath?Pt(t.userConfigPath):Tt(th(e),Xg))}function th(e){let t=e.env.get(Jg);return t?At(Ce(t)):Tt(e.home,Jl)}function nh(e,t={}){return Tt(Hi(e,t),Xl)}function Qt(e,t={}){return Tt(Pt(Hi(e,t)),Mr)}function ec(e,t){let n=t.userConfigPath??nh(e,t),r=t.projectConfigPath??eh(t.cwd),o=rh(e,t),i=oh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Nn(o,n),projectConfigTarget:Nn(i,r)}}function rh(e,t){let n=t.userConfigPath?Pt(Pt(At(t.userConfigPath))):Pt(At(t.userConfigDir??Hi(e,t)));return _t(n,"user policy")}function oh(e,t){let n=At(t),r=At(e),o=Yg(n,r);if(o!==".."&&!o.startsWith(`..${Zg}`)&&!qg(o))return _t(n,"project policy");return _t(Pt(Pt(r)),"project policy")}function tc(e,t){return Tt(e,t,Kl)}var be=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),lt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ct=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),nc=new Set(["python","python3","python2","node","ruby","perl"]),Nr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Dr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var rc="Rulebook exceeds CC Safety Net's safe validation limits.",oc="Additional rulebook validation errors were omitted.",ke=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function ic(e){if(ji(e.allowed_commands,ke.maxAllowedCommands)||ji(e.rules,ke.maxRules)||ji(e.tests,ke.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=ke,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>ke.maxStringCodeUnits||i&&o.length>ke.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>ke.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function ji(e,t){return Array.isArray(e)&&e.length>t}var Vi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ki=64,qi="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var ih={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Yi=new Set(["--init-file","--rcfile"]);function Zi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let f=t.slice(c+1);if(t[0]==="-"&&(f==="c"||f[0]==="-"&&f.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!ih[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Se(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Yi.has(l)&&!s.includes("="))i++;continue}let a=Zi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Ln(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Lr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of sh(e))Ln(n,t);return t.inSingle||t.inDouble}function sh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Ln(s,n)}return t}var Xi=new Set(["rm","find","xargs","parallel"]),ah=new Set(["git","busybox",...Xi,...J,...nc,...we]),lh=new Set(["python","node","ruby","perl"]);function sc(e){let t=M(e);return ah.has(t)||Oe(t)}function Oe(e){return lh.has(ch(e))}function ch(e){let t=k(e).toLowerCase();return Nr.test(t)?"python":t}function Ji(e){try{let t=kr(uh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=mh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function uh(e){return typeof e==="string"?Hl(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function ac(e){let t=new Set;return e.flatMap((n,r)=>{let o=en(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Qi=`must be one of ${Vi.join(", ")}`,dh=/^[^/]+\/[^/]+$/,fh=["version","rules","overrides","transparent_wrappers"];function mh(e){let t=ph(e);return{errors:es(Rh(t,fh,(n)=>n.kind==="custom"),": "," "),sources:Eh(e,t)}}function ph(e){if(!en(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Ki;return[...e.version===1?[]:[_(["version"],"must be 1")],...gh(e.rules,t),...Ch(e.overrides),...Sh(e.transparent_wrappers),...t?[]:yh(e.rules),...en(e.overrides)?Object.keys(e.overrides).filter((n)=>!dh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...vh(e.transparent_wrappers)]}function gh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...lc(e,Ki)?[_(["rules"],qi)]:[]];if(t)return[{path:["rules"],message:qi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...hh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function lc(e,t){let n=cc(e);return n!==void 0&&!(n<=t)}function hh(e,t){let n=cc(e);return n!==void 0&&!(n>=t)}function cc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function yh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=Zl(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Ch(e){if(e===void 0)return[];if(!en(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!en(n))return[_(["overrides",t],'must be "off" or an object')];return[...bh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||ns(n.intent)?[]:[_(["overrides",t,"intent"],Qi)]]})}function bh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...lc(e,ct)?[_(t,`must be at most ${ct} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ct?[_(t,`must be at most ${ct} characters`)]:[]}function Sh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return lt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function vh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(sc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Eh(e,t){let n=en(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Rh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function es(e,t,n){return[...new Set(e.map((r)=>{let o=ts(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ts(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function ns(e){return Vi.includes(e)}function en(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function dc(e){let t=wh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var xh=`required non-empty string up to ${ct} characters`,uc="must be a non-empty array of unique non-empty strings",_h="required non-empty array of non-empty strings";function wh(e){if(!ut(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!ic(e))return{errors:[rc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...es(Ph(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>ke.maxValidationErrors?[...t.slice(0,ke.maxValidationErrors),oc]:t,ruleNames:new Set(fc(e).map((n)=>n.toLowerCase()))}}function fc(e){let t=ut(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ut(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Ph(e,t){return[...typeof e.name==="string"&&wt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Ah(e.allowed_commands),...Th(e.rules,t),...Mh(e.tests),...Nh(e),...Dh(e)]}function Ah(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&lt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Th(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!ut(n))return[_(["rules",r],"must be an object")];return t?kh(n,["rules",r]):Ih(n,["rules",r])}),...ac(e)]}function Ih(e,t){return[...mc(e.name,t),...pc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&lt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Wr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...gc(e.reason,t),...hc(e.intent,t)]}function kh(e,t){return[...mc(e.name,t),...pc(e.command,t),...gc(e.reason,t),...hc(e.intent,t),...Oh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function mc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return wt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function pc(e,t){return typeof e==="string"&&lt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function gc(e,t){return typeof e==="string"&&e!==""&&e.length<=ct?[]:[_([...t,"reason"],xh)]}function hc(e,t){return e===void 0||ns(e)?[]:[_([...t,"intent"],Qi)]}function Oh(e,t){if(!ut(e))return[_(t,"required object")];return[...Wr(e.command_path,[...t,"command_path"],_h,!1),...e.any_args===void 0?[]:Wr(e.any_args,[...t,"any_args"],uc,!0),...e.exclude_args===void 0?[]:Wr(e.exclude_args,[...t,"exclude_args"],uc,!0)]}function Wr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Mh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!ut(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Nh(e){if(!Array.isArray(e.tests))return[];let t=new Set(fc(e));return[...new Set(e.tests.flatMap((n)=>ut(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function Dh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=ut(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function ut(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ec(e,t){let n=ec(e,t),r=!1;try{r=jl(n.userConfigTarget,n.projectConfigTarget)}catch(m){if(m instanceof ae)return Hh(n,m.message);throw m}let o=Ji(n.userConfigTarget),i=r?{config:null,errors:[]}:Ji(n.projectConfigTarget),s=Sc(n.userConfigPath,o.errors),a=Sc(n.projectConfigPath,i.errors),l=new Set,c=o.config?yc(o.config,Gr(n.userConfigPath),"user",n.userScope,l):vc(),u=i.config?yc(i.config,Gr(n.projectConfigPath),"project",n.projectScope,l):vc(),f=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Cc(c.rules,f),...Cc(u.rules,d)],transparent_wrappers:$h(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?bc(f,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Uh(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?bc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function yc(e,t,n,r=_t(Gr(Gr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Wh(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let f=u.rulebook;if(o.has(f.name))return s.push(`duplicate active rulebook name "${f.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(f.name),[{rules:Lh(f),rulebook:{source:n,spec:c,name:f.name,version:f.version,rules:f.rules.map((d)=>`${f.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Lh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Wh(e,t,n){let r=Gh(e),o=tc(t,r),i=zh(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Fh(e)}`]};let s=Bh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Gh(e){return Or(e)?Ui(e).name:e}function Fh(e){return Or(e)?`run ${Ql} to vendor ${e}`:"create that file or remove that source from the rules config"}function zh(e,t){try{return{content:kr(Nn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function Bh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:dc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function $h(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Cc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function bc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Uh(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Sc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Hh(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function vc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as ry,readFileSync as oy}from"node:fs";var Rc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],rs=new Set(Rc.map((e)=>e.id)),Fr=Rc,jh=new Map(Fr.map((e)=>[e.id,e.intent]));function b(e,t){return{id:e,reason:t,intent:jh.get(e)??"manual_only"}}var os=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],zr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Vh=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Kh=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],is=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Kh.flatMap((e)=>Vh.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Br=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],xc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],qh=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ss=xc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),as=xc.flatMap((e)=>qh.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Wn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ls=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),cs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Yh=[...os,zr,...is,...ss,...as,Wn,...ls,...cs,...Br].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),$r=new Set(Br.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),us=new Set(Yh.map((e)=>e.id));import{isAbsolute as ds,join as Zh,normalize as Xh,sep as Ur}from"node:path";var _c=process.platform==="win32",Jh=/[*?]/;function Gn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function fs(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Gn(e.trim(),t);if(!ds(n))return"must be an absolute path or start with ~/";return Fn(n,t)}function ms(e,t){let n=wc(e,t);if(n===null)return"must be a non-empty path string";if(!ds(n))return null;if(Fn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Qh="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",ey="cannot cover the guard's own configuration";function wc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Gn(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ps(e,t){let n=wc(e,t);if(n===null)return"must be a non-empty path string";if(Jh.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!ds(n))return null;if(Fn(n,t)!==null)return Qh;return ty(n,t)?ey:null}function ty(e,t){let n=Hr(e),r=Hr(Zh(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Ur}`)}function Fn(e,t){let n=Hr(e),r=Hr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Ur)?n:`${n}${Ur}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Hr(e){let t=Xh(e);if(_c)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(_c?3:1)&&t.endsWith(Ur))t=t.slice(0,-1);return t}var Pc=30,jr=1,Vr=365;function Ac(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Tc=new Set(Fr.filter((e)=>e.catastrophic).map((e)=>e.id));function A(e,t){if(!e)return null;if(Tc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Tc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Ic(e,t){return Object.freeze(Object.fromEntries(Fr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function kc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Ic(e,t)})}var Oc={standard:0,strict:1,paranoid:2};function Dc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:gs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:gs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:gs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:ny(e,t)}}function gs(e,t){return[...new Set([...e,...t??[]])]}function ny(e,t){let n=t.safety?.level,r=Ar[e.safety.level];return[...n&&Oc[n]<Oc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Jt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Mc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Mc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!$r.has(o))),...e.destructive_command_protection.enabled?Nc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Nc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Mc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Nc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Cs=new Set(["standard","strict","paranoid"]),Fc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Pc}};function zc(e,t){let n=py(Qt(e,t),e.home),r=Yr(Dn(t.cwd),e.home),o=sy(r.parsed,e.home),i=Object.keys(o.policy).length>0?Dc(n.gui??Fc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ys(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var iy="project policy audit settings are ignored; audit is user scope only";function sy(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...Cs.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Lc({overrides:Bc(n.overrides,Jt,["safety","overrides"],It)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:qr(o.overrides,rs,Uc,It)}:{},...o.allow_paths!==void 0?{allow_paths:nn(o.allow_paths,fs,t,["destructive_command_protection","allow_paths"],It)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:qr(i.overrides,us,Hc,It)}:{},...i.deny_paths!==void 0?{deny_paths:nn(i.deny_paths,ms,t,["secret_protection","deny_paths"],It)}:{},...i.allow_paths!==void 0?{allow_paths:nn(i.allow_paths,ps,t,["secret_protection","allow_paths"],It)}:{}};return{policy:Lc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[iy]}}function Bc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],bs));return[]}))}function Lc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var It=()=>{return},bs="must be a boolean",Ss="must be an object if provided",$c=`must be an integer between ${jr} and ${Vr}`,Uc={path:["destructive_command_protection","overrides"],label:"destructive command"},Hc={path:["secret_protection","overrides"],label:"secret protection"},ay=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function ly(e,t){let n=[];return{policy:jc(e,t,(o)=>{n.push(o)}),issues:n}}function cy(e,t){return jc(e,t,It)}function jc(e,t,n){if(!ve(e))return n(_([],"Config must be an object")),Kr();if(e.version!==1)n(_(["version"],"must be 1"));let r=tn(e.safety,["safety"],["level","overrides"],n),o=tn(r.overrides,["safety","overrides"],Jt,n),i=tn(e.workflow,["workflow"],["worktree_mode"],n),s=tn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=tn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=tn(e.audit,["audit"],["retention_days"],n);return Vc(e,ay,[],n),{version:1,safety:{level:uy(r.level,n),overrides:Bc(o,Jt,["safety","overrides"],n)},workflow:{worktree_mode:hs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:hs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:qr(s.overrides,rs,Uc,n),allow_paths:nn(s.allow_paths,fs,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:hs(a.enabled,["secret_protection","enabled"],!0,n),overrides:qr(a.overrides,us,Hc,n),deny_paths:nn(a.deny_paths,ms,t,["secret_protection","deny_paths"],n),allow_paths:nn(a.allow_paths,ps,t,["secret_protection","allow_paths"],n)},audit:{retention_days:dy(l.retention_days,n)}}}function tn(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(t,Ss)),{};return Vc(e,n,t,r),e}function Vc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function uy(e,t){if(e===void 0)return"standard";if(Cs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function hs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,bs));return n}function dy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=jr&&e<=Vr))t(_(["audit","retention_days"],$c));return Ac(e)}function qr(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(n.path,Ss)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function nn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Kr(){return structuredClone(Fc)}function Yr(e,t){if(!ry(e))return{exists:!1,policy:Kr(),errors:[]};try{let n=oy(e,"utf-8");if(!n.trim())return{exists:!0,policy:Kr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=ly(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${my(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Kr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var fy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ss,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[bs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[$c,`not an integer between ${jr} and ${Vr}`]]);function my(e){let t=ts(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=fy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function py(e,t){let n=Yr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:Gc(),errors:[]};let o=cy(r,t);return{policy:ys(o),gui:o,errors:[],levelPresent:Wc(r)}}if(n.parsed===void 0)return{policy:Gc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ys(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Wc(n.parsed)}}function Wc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return Cs.has(t.level)}function Kc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...$r].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Gc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Kc({}),denyPaths:[],allowPaths:[]}}}function ys(e){return{safety:gy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Kc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function gy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function qc(e,t){let n=Ec(e,t),r=zc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...by(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Sy(o,hy(n,r),s,r.policyScopes)}function hy(e,t){let n=Cy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:vy(e.errors.length>0?yy(e.errors):void 0,e.warnings.length>0?Es(e.warnings.join("; ")):void 0,n)}}function yy(e){return`${Es(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Cy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function by(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Sy(e,t,n=Object.freeze({}),r){let o=vs(structuredClone(e)),i=r?{policyScopes:vs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function vs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))vs(t);return Object.freeze(e)}function vy(...e){return Es(e.filter((t)=>!!t).join("; "))}function Es(e){return/[.!?]$/.test(e)?e:`${e}.`}function Yc(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Rs(t.fail_closed,e.strict,"strict"),paranoid_rm:Rs(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Rs(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:kc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Oi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Rs(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function zn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Ey=/^[A-Za-z_][A-Za-z0-9_]*=/;function Zr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Bn(e){let t=Zr(e.words[0],"time")?1:0,n=t===1&&Zr(e.words[t],"-p")?t+1:t,r=t===1&&Zr(e.words[n],"--")?n+1:n,o=Zr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Ey.test(s.text));return i?.provenance==="literal"?i.text:void 0}var dt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Xr(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Ry(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function Jr(e,t,n){e.push(n),t.reset()}function Qr(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function xs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function rn(e,t,n,r,o,i,s){return xs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Ry(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function _s(e,t,n){if(t>=n||Xc(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Xc(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Zc(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Zc(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function ws(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=xy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?_y(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Zc(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Xc(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function xy(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function _y(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var tu=new Set(["&&","||","|","|&"]);function nu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=no(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:io(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function no(e,t,n,r,o,i,s){let a=[],l=[],c=Xr(),u=[],f=()=>{if(c.words.length===0&&c.redirections.length===0)return;let m={start:c.start,end:c.end},p=c.words.map((h)=>h.text);Jr(a,c,{kind:"command",dialect:"posix",source:e.slice(m.start,m.end),span:m,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let m=e[d];if(!m)break;if(s&&m===s)return f(),eu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(oo(m)){if(m===`
+`||m==="\r"){f();let S=m==="\r"&&e[d+1]===`
+`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!tu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,S),span:Object.freeze({start:d,end:S})}));if(u.length>0){let R=ws(e,S,n,u.splice(0));l.push(...R.issues),d=R.next;continue}d=S;continue}d++;continue}if(m==="#"){while(d<n&&e[d]!==`
+`&&e[d]!=="\r")d++;continue}let p=c.start===-1?Vy(e,d,n):void 0;if(p){if(As(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);if(!Ps(o))return on(a,l,d,"word-limit",r.maxWords);let S=no(e,p.braceIndex+1,n,r,o,i+1,"}"),T=S.next,R={start:p.braceIndex+1,end:S.closed?T-1:T},P=Jc(e,R,S);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:P}),l.push(...S.issues),S.pendingHeredocs.length>0||Un(S.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...S.pendingHeredocs),S.limited)return to(a,l,S.next);if(!S.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let h=ro(e,d);if(h){if(f(),!uu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:d,end:d+h.length})})),d+=h.length;continue}if(m===")"){f(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:m,span:{start:d,end:d+1}}),d++;continue}if((m==="("||m==="{"&&My(e,d,n))&&c.start===-1){if(As(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);let S=m==="("?")":"}",T=no(e,d+1,n,r,o,i+1,S),R=T.next,P={start:d+1,end:T.closed?R-1:R},q=Jc(e,P,T);if(a.push({kind:"group",style:m==="("?"subshell":"brace",span:{start:d,end:R},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Un(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return to(a,l,T.next);if(!T.closed)l.push({code:m==="("?"unclosed-subshell":"unclosed-brace-group",message:`${m} group is not closed`});d=R;continue}let g=(m==="<"||m===">")&&e[d+1]!=="("?Ty(e,d):null;if(g){let S=c.words.at(-1),T=S&&S.span.end===d&&/^[0-9]+$/.test(S.raw)?Number(S.raw):void 0;if(T!==void 0)c.words.pop();let R=T===void 0?d:S?.span.start??d;c.start=c.start===-1?d:c.start;let P=d+g.length;while(P<n&&/[ \t]/.test(e[P]??""))P++;let q=e[P],Z=P>d+g.length&&q==="#",ee=!q||oo(q)||!!ro(e,P)||q===s||q===")"||Z||(q==="<"||q===">")&&e[P+1]!=="(",X=g==="<<"||g==="<<-",U=X?_s(e,P,n):void 0,D=U?{word:rn(e,P,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Ts(e,P,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return to(a,l,D.next);if(!Ps(o))return on(a,l,D.next,"word-limit",r.maxWords)}let ce=D?.next??d+g.length,_e={kind:"redirection",operator:g,span:{start:R,end:ce},...T===void 0?{}:{fd:T},...D?{target:D.word}:{}};if(c.redirections.push(_e),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let je=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:g==="<<-",attach:(Ie)=>{if(_e.heredoc=Ie,Ie.quotedDelimiter)return;je.push(...Py(e,Ie.bodySpan.start,Ie.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`});if(D)c.nested.push(...D.nested);c.end=ce,d=ce;continue}if(c.start===-1)As(a,l);let y=Ts(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return to(a,l,y.next);let v=Ly(c.words)?By(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return on(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let S of E){if(!Ps(o))return on(a,l,y.next,"word-limit",r.maxWords);c.words.push(S)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return f(),eu(a,l),l.push(...Ky(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Jc(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:io(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ts(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],f=[],d=!1;while(a<n){let m=e[a],p=(m==="<"||m===">")&&e[a+1]==="(";if(!m||oo(m)||(m===";"||m==="|"||m==="&")&&ro(e,a)||(m==="<"||m===">")&&!p)break;if(m===")")break;if(m==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),f.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(m==='"'){l=!0;let g=wy(e,a,n,r,o,i);if(s+=g.text,u.push(...g.nested),f.push(...g.issues),d||=g.limited,c=$n(c,g.provenance),a=g.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Iy(e,a+2,n);if(s+=g.text,f.push(...g.issues),!g.closed)f.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=g.next;continue}if(m==="\\"){let g=e[a+1];if(!g){f.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(g===`
+`){a+=2;continue}s+=g,a+=2;continue}let h=m==="$"||m==="<"||m===">"||m==="`"?so(e,a,n,r,o,i):null;if(h){let g=ru(h,u,f);if(d||=g.limited,c=$n(c,g.provenance),a=g.next,d)break;continue}if(m==="$"){let g=su(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(m==="*"||m==="?"||m==="[")c=$n(c,"glob");s+=m,a++}return{word:rn(e,t,a,s,c,l,c==="literal"?void 0:Oy(e,t,a)),nested:u,issues:f,next:a,limited:d}}function wy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,f=t+1;while(f<n){let d=e[f];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:f+1,limited:u};if(d==="\\"&&e[f+1]){let p=e[f+1]??"";if(p===`
+`){f+=2;continue}if(p==="\r"&&e[f+2]===`
+`){f+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,f+=2;continue}if(e.startsWith("$((",f)){let p=Is(e,f+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(f,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});f=h;continue}let m=so(e,f,n,r,o,i);if(m){let p=ru(m,l,c);if(f=p.next,u||=p.limited,a=$n(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:f,limited:u};continue}if(d==="$"){let p=su(e,f,n,s,a);s=p.text,a=p.provenance,f=p.next;continue}s+=d??"",f++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function so(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,f=s?"))":c?"`":")",d=Is(e,t+u,n,f),m=d===-1?n:d,p=d===-1?n:d+f.length;if(i>=r.maxDepth)return{program:jy(e,t+u,m,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],S=!1,T=t+u;while(T<m){let R=so(e,T,m,r,o,i+1);if(!R){T++;continue}if(v.push(...R.program.nodes),E.push(...R.program.issues),S||=R.program.status==="limited",T=R.next,S)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,m),span:{start:t+u,end:m},status:io(E,S),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=no(e,t+u,m,r,o,i+1),g=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Un(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,m),span:{start:t+u,end:m},status:io([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function Py(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?so(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function ru(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Is(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
+`?a+2:a+1,f=ws(e,u,n,s.splice(0));if(!f.terminated)return-1;a=f.next-1;continue}let c=ou(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=Ay(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",f=a+(u?3:2);while(f<n&&/[ \t]/.test(e[f]??""))f++;let d=_s(e,f,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Ay(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=ou(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function ou(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!qy(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function ro(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Ty(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function oo(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function iu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Iy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=ky(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function ky(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return eo(e,t+1,n,16,2,t+1);if(r==="u")return eo(e,t+1,n,16,4,t+1);if(r==="U")return eo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return eo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function eo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function io(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function su(e,t,n,r,o){let i=iu(e,t,n);return{text:r+e.slice(t,i),provenance:$n(o,"variable"),next:i}}function Oy(e,t,n){let r=Qr(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,f=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||f||d){let m=c?3:d?1:2,p=c?"))":d?"`":")",h=Is(e,a+m,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let m=iu(e,a,n);if(m>a+1){r.push(o,a,"literal"),r.push(a,m,"variable"),a=m,o=m;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function $n(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function My(e,t,n){return t+1>=n||oo(e[t+1]??"")||ro(e,t+1)!==null}var Ny=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Dy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Ly(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Wy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Wy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Gy(e,t);if(n==="env")return Fy(e,t);if(n==="sudo")return zy(e,t);return}function Gy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Fy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Ny.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function zy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Dy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function au(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=lu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>cu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function By(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=lu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>cu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>rn(e,t.span.start,t.span.end,a,"literal",!1))}}function lu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((m)=>Qc(m,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=Qc(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let f=u.start+c.length-u.end,d=u.alternatives.reduce((m,p)=>m+f+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...$y(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function Qc(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Hy(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:Uy(e,r)}}function $y(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function Uy(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Hy(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function cu(e,t){let n=`x${e}`,r=Ts(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function jy(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function on(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function to(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ps(e){return e.used++,e.used<=e.max}function Vy(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Un(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Un(n.nodes));return(t.kind==="group"||t.kind==="function")&&Un(t.body.nodes)})}function Ky(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function uu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function eu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!tu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function As(e,t){if(!uu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function qy(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var fu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Yy=new Set(["gc","cat","type","cp","mv","rm"]),mu=["-rec","-for","-path","-literalpath","-whatif"],Zy=/^\$env:\w/i,Xy=/^(?:\$\{?\w+\}?|~)\\./;function pu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...fu].some((o)=>n.includes(o))&&!(n.includes("rm")&&mu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!Jy(n))return!1;let r=Ns(e,t);if(gu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ms(r).some(Qy)}function gu(e){return e.nodes.some((t)=>{if(t.kind==="group")return gu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function Jy(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Qy(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&fu.has(n))return!0;let r=e.slice(t+1);if(n&&Yy.has(n)&&r.some(eC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return mu.some((s)=>i.startsWith(s))})}function eC(e){return Zy.test(e)||Xy.test(e)}function Ns(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ds(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:iC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ds(e,t,n,r,o,i=!1){let s=[],a=[],l=Xr(),c=0,u=!1,f=()=>{if(l.words.length===0&&l.redirections.length===0)return;let m={start:l.start,end:l.end};Jr(s,l,{kind:"command",dialect:"powershell",source:e.slice(m.start,m.end),span:m,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let m=e[d];if(!m)break;if(i&&m==="}")return f(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=oC(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return f(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(m)){if(m==="\r"||m===`
+`){f();let y=m==="\r"&&e[d+1]===`
+`?d+2:d+1;s.push(ks(e,d,y)),d=y;continue}d++;continue}let h=Cu(e,d);if(h){f(),s.push(ks(e,d,d+h.length)),d+=h.length;continue}if(m==="{"){if(f(),o>=r.maxDepth)return a.push(yu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ds(e,d+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(d+1,v),span:{start:d+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(m==="}"){f(),s.push(ks(e,d,d+1)),d++;continue}if(m===">"||m==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===m?d+2:d+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?du(e,v,n,r,o):void 0,S=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:S}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=S,d=S;continue}if(m===","){l.start=l.start===-1?d:l.start,l.words.push(xs({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let g=du(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,u||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),f(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next>d?g.next:d+1}return f(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function du(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,f=!1,d=(p)=>{let h=tC(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),u+=Os(h.program),f||=h.program.status==="limited",s="command-substitution",h.next},m=t;while(m<n){let p=e[m];if(!p||/\s/.test(p)||Cu(e,m)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[m+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),m++;break}i+=h,m+=2;continue}if(e.startsWith("$(",m)){m=d(m);continue}if(p==="'"){a=!0,m++;let h=!1;while(m<e.length){if(e[m]==="'"&&e[m+1]==="'"){i+="'",m+=2;continue}if(e[m]==="'"){h=!0,m++;break}i+=e[m]??"",m++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,m++;let h=!1;while(m<n){let g=e[m];if(g==="`"&&e[m+1]){i+=e[m+1],m+=2;continue}if(g==='"'){h=!0,m++;break}if(e.startsWith("$(",m)){m=d(m);continue}if(g==="$")s=e[m+1]==="("?"command-substitution":"variable";i+=g??"",m++}if(!h)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[m+1]==="("?"command-substitution":"variable";if(p==="@"&&m===t)s="variable";i+=p,m++}return{word:rn(e,t,m,i,s,a,s==="literal"?void 0:nC(e,t,m)),next:m,issues:l,nested:c,words:u,limited:f}}function tC(e,t,n,r,o){let i=hu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[yu(r.maxDepth)],nodes:[]}),next:a};let l=Ds(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function hu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Os(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Os(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Os(r)}}return t}function nC(e,t,n){let r=Qr(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=hu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=rC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function rC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function yu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ms(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ms(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ms)]})}function Cu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function oC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function iC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ks(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Me(e,t="auto",n=dt){if(t==="powershell"||t==="auto"&&pu(e.slice(0,n.maxInputLength),n))return Ns(e,n);return nu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function sn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function ao(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Ls(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function Hn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){Hn(e,t)}function kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Ws(e){return e===`
 `||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Y(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function Ke(e,t,n){return!kt(C(e,t-1))&&j(e,t,n)&&!kt(C(e,t+n.length))}function qe(e,t){return kt(C(e,t-1))!==kt(C(e,t))}function oe(e){return e===`
-`||e===";"||e==="&"||e==="|"}function sn(e){return e==="|"||e===";"}function so(e,t,n){let r=Is(e,n);if(t==="rm")return Zy(r);if(t==="dd")return Jy(r);return Cu(r,!0)}function ao(e,t,n){let r=Is(e,n);if(t==="rm")return Qy(r);if(t==="reset-hard")return hu(r,"--ha","rd");if(t==="reset-merge")return hu(r,"--me","rge");if(t==="clean")return rC(r);if(t==="checkout")return iC(r);if(t==="push-force")return sC(r);if(t==="push-refspec")return aC(r);if(t==="push-delete")return lC(r);if(t==="branch")return cC(r);if(t==="tag")return fC(r);if(t==="restore")return mC(r);return Cu(r,!1)}function Zy(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Ke(e,i,"rm")&&H(l)&&l!==`
-`)t=!0,i++;continue}let a=Xy(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=mu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=mu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function Xy(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function mu(e,t,n){if(pu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(pu(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function pu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function Jy(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(C(e,n))){t=!1;continue}if(Ke(e,n,"dd")){t=!0,n++;continue}if(!t||!Ke(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function Qy(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=C(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=tC(e,o);if(s>=0){if(eC(e,s))return!0;let a=s,l=!1;while(H(C(e,a)))l||=C(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(C(e,o-1)))&&(!C(e,o+2)||H(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&qe(e,o+11)||Os(e,o,"recursive"),r||=j(e,o,"--force")&&qe(e,o+7)||Os(e,o,"force"),n&&r)return!0;o++}return!1}function Os(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&qe(e,t+r+2)}function eC(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(C(e,n)))n++;let i=n;while(n<Y(e)&&!H(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=gu(e,i,"recursive"),a=gu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=nC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function gu(e,t,n){return j(e,t,`--${n}`)&&qe(e,t+n.length+2)||Os(e,t,n)}function tC(e,t){if(t>0&&kt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!H(C(e,n+1)))return-1;return n+1}function nC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let f=C(e,c)??"",d=(f==="r"||f==="f")&&qe(e,c+1);r||=f==="r",o||=f==="f",i||=f==="r"&&d,s||=f==="f"&&d,a||=(l==="r"&&f==="f"||l==="f"&&f==="r")&&d,l=f}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function hu(e,t,n){return Hn(e,"reset",sn,!0,(r)=>C(e,r)==="-"&&an(e,r,t,n)?!0:r)}function rC(e){return Hn(e,"clean",sn,!0,(t)=>{if(C(e,t)!=="-")return t;if(an(e,t,"--fo","rce"))return!0;let n=Un(e,t,sn);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function lo(e,t,n){if(!Ke(e,t,"git"))return null;let r=t+3;if(!H(C(e,r)))return{commandEnd:-1,next:r};while(H(C(e,r)))r++;while(r<Y(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=Un(e,r,oe);if(Ke(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=oC(e,r,o);r=o;while(H(C(e,r)))r++;if(i)return{commandEnd:Ke(e,r,n)?r+n.length:-1,next:Un(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=Un(e,r,oe);while(H(C(e,r)))r++}return{commandEnd:-1,next:r}}function oC(e,t,n){for(let r of be)if(n-t===r.length&&j(e,t,r))return!0;return!1}function iC(e){return yu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function sC(e){return Hn(e,"push",sn,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!kt(C(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=bu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function aC(e){return Hn(e,"push",oe,!1,(t)=>{if(H(C(e,t))&&C(e,t+1)==="+"&&t+2<Y(e)&&!oe(C(e,t+2))&&!H(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function lC(e){return Hn(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&an(e,t,"--de","lete"))return!0;if(H(C(e,t))&&C(e,t+1)===":"&&t+2<Y(e)&&!H(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function cC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=lo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=Un(e,o,oe),s=uC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function uC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(an(e,i,"--de","lete"))r=!0;if(an(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&dC(C(e,s))){let f=C(e,s);a||=f==="d"||f==="D",l||=f==="f",c||=f==="D",s++}if(!qe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function dC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function fC(e){return yu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function yu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=lo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(an(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&qe(e,r+1))return!0;if(sn(o))i.outerActive=!1}return!1}function Hn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=lo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let f=s;f<=c;f++)if(n(C(e,f)))i=!1;s=c}if(l)i=!1}return!1}function mC(e){let t=!1;for(let n=0;n<Y(e);n++){if(ks(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=lo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Cu(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=C(e,r),i=t?ks(o):oe(o);if(n&&H(o)&&C(e,r+1)==="-"&&Ke(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Ke(e,r,"find"))n=!0,r+=3}return!1}function Un(e,t,n){let r=t;while(r<Y(e)&&!H(C(e,r))&&!n(C(e,r)))r++;return r}function bu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return qe(e,o)?o:-1}function an(e,t,n,r){return bu(e,t,n,r)>=0}function Ye(e,t){$n(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&ao(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var pC=/^[A-Za-z_][A-Za-z0-9_]*=/;function vu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;$n(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Eu(t.nodes,r,i)}function Eu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Eu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return gC(r,t,n)})}function gC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!pC.test(o.text));return e.words.every((o,i)=>o===t||Su(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Su(o.target.raw,n.anchored,!0)))}function Su(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as hC,resolve as Ru}from"node:path";function jn(e,t,n,r){let o=hC(e)?Ru(e):t?Ru(t,e):void 0;if(!o)return;try{return G(o,n,r)}catch{return o}}function xu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var ln="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Vn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Ms=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),yC=new Set(["-p","--print"]),CC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),bC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),SC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),vC=new Map([["python",new Set(["m"])]]),EC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),RC=new Set(["always","default","never"]),xC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),_C=/\\\r?\n/g,wC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function wu(e){return uo(e).code}function co(e){return uo(e).sources}function Pu(e){return wC.get(Ds(e))??[]}function uo(e){let t=Ds(e[0]??"");if(!Ms.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Me(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Me(t,n,r,o,i,s);if(t==="node"&&yC.has(s)){let d=e[i+1];if(d===void 0)return Me(t,n,r,o);if(d.startsWith("-"))continue;n.push({tokenIndex:i+1,value:d}),r.push({tokenIndex:i+1,kind:"inline-code",value:d}),i++;continue}if(AC(t,s)){let d=e[i+1];if(d===void 0)return Me(t,n,r,o);if(n.push({tokenIndex:i+1,value:d}),r.push({tokenIndex:i+1,kind:"inline-code",value:d}),t==="python")return Me(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(TC(t)&&a){let d=a[1]??"";n.push({tokenIndex:i,value:d}),r.push({tokenIndex:i,kind:"inline-code",value:d});continue}if(t==="node"){let d=PC(s);if(d){if(d.attached){if(o&&=d.value!=="",d.value!=="")r.push({tokenIndex:i,kind:"module-file",value:d.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Me(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Me(t,n,r,o);if(EC.get(t)?.has(s)){let d=e[i+1];if(d===void 0||d.startsWith("-")&&!(t==="ruby"&&xC.has(s))||t==="python"&&!RC.has(d))return Me(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let d=1;d<s.length;d++){let u=s[d];if(u===void 0)break;if(vC.get(t)?.has(u)){let m=s.slice(d+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return Me(t,n,r,o)}if(CC.get(t)?.has(u)){l=s.slice(d+1)||e[i+1],c=d+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&u==="r"){let m=s.slice(d+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let m=s.slice(d+1);if(!m){if(o=!1,d+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(bC.get(t)?.has(u)){if(d+1===s.length)i++;break}if(SC.get(t)?.has(u)&&d+1<s.length)break}if(l===void 0)continue;let f=c?i+1:i;if(n.push({tokenIndex:f,value:l}),r.push({tokenIndex:f,kind:"inline-code",value:l}),t==="python")return Me(t,n,r,o);if(c)i++}return Me(t,n,r,o,void 0,void 0,!0)}function Me(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((f)=>f.tokenIndex)),c=n.filter((f)=>f.kind!=="inline-code"||l.has(f.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((f)=>f.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function PC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ns(e,t){return Ds(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Ds(e){let t=k(e).toLowerCase();return Or.test(t)?"python":t}function AC(e,t){return Ms.get(e)?.has(t)??!1}function TC(e){return Ms.get(e)?.has("--eval")??!1}function Kn(e,t){let n=OC(e,t);if(!_u(n,t))return!1;Ee(t,n);let r=kC(n);if(_u(r,t))return!0;return Ee(t,r),IC.test(r)}var IC=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function kC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function _u(e,t){if(so(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(so(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(so(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>ao(o,r))))}function OC(e,t){return Ee(t,e),e.replace(_C,"")}import{isAbsolute as Qu,relative as ed}from"node:path";import{isAbsolute as Nu,parse as $C}from"node:path";import{dirname as MC,isAbsolute as NC,parse as DC,sep as LC}from"node:path";function ft(e,t,n){if(at(t))throw Error("Unsupported Windows namespace path");let r=NC(t)?DC(t).root:"",o=r||e;for(let i of FC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=MC(o);continue}let s=WC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function WC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${LC}${t}`}function FC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Ls=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],GC=new Set(Ls),zC=1024,Au=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Tu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),BC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function fo(e){return GC.has(e)}function Ws(e){return fo(e)||Au.has(e)||Tu.has(e)||kn(e)}function Ze(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Iu(e,t){let n=Ze("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=zC?{state:"valid",count:r}:{state:"invalid"}}function mo(e,t,n){let o=e.match(BC)?.[1];if(!o||!Ws(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ze(o,t,n)??""}${e.slice(i+1)}`}}function ku(e){return Mu(e,Tu)}function Ou(e){return Mu(e,Au)}function Mu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Lu=/^[A-Za-z_][A-Za-z0-9_]*=/;function we(e){if(!Lu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function po(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=we(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Wu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Ot(e,t,n,r){if(!Wu(cn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let d=0;d<V.wrapperPeelIterations.cap;d++){let u=Du(i),m=po(i);for(let[h,g]of m.envAssignments)s.set(h,g),a.set(h,g);if(i=m.words,i.length===0)break;while(i.length>0&&cn(i).includes("=")&&!HC(i)){let h=jC(cn(i),a,t.env)??mo(cn(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=cn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=KC(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=ZC(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=XC(i);if(p==="builtin")i=i.slice(Ne(i,1)==="--"?2:1);if(Du(i)===u)break}let f=po(i);for(let[d,u]of f.envAssignments)s.set(d,u),a.set(d,u);return{words:f.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:UC(f.words,o)}}function UC(e,t){return e.some((n)=>!t.has(n))}function Du(e){return e.map(w).join(" ")}function cn(e){let t=e[0];return t?w(t):""}function Ne(e,t){let n=e[t];return n?w(n):void 0}function HC(e){return Lu.test(cn(e))}function jC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var VC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function KC(e,t,n){let r=1,o=n;while(r<e.length){let i=Ne(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Ne(e,r+1);o=s?qn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=qn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=qn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(VC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var qC=new Set(["-i","-0","--null"]),YC=new Set(["-u","--unset","-C","--chdir","-P"]);function ZC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Ne(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let d of n.keys())o.set(d,"");o.set("TMPDIR",""),a++;continue}if(qC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let d=Ne(e,a+1);if(d!==void 0)o.set(d,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let f=c==="-S"||c==="--split-string"?{value:Ne(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(f){if(f.value!==void 0)i.push(f.value);return s=null,l(a+f.consumed)}if(YC.has(c)){if(c==="-C"||c==="--chdir"){let d=Ne(e,a+1);s=d?qn(s,d,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let d=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=qn(s,d,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!we(c))break;while(a<e.length){let d=we(Ne(e,a)??"");if(!d)break;o.set(d.name,d.value),a++}if(Ne(e,a)==="--")a++;return l(a)}return l(a)}function qn(e,t,n){if(t==="")return null;if(!e&&!Nu(t))return null;let r=Nu(t)?$C(t).root:n.realpath(e??"/");if(r===null)return null;try{return ft(r,t,n)}catch{return null}}function XC(e){if(Ne(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Ne(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var JC=/['"\\$`{}#]/;function go(e,t){if(e.some((r)=>JC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function mt(e,t,n){return ho(e,t,n).tokens}function QC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Mt(e,t,n,r=0){let o=ho(e,t,n),i=(o.envSplitValues??[]).flatMap(QC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Mt(s,t,n,r+1)}function ho(e,t,n,r){if(!Wu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Ot(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Bs=Symbol("adopt-as-operand"),eb=new Set(["env","sudo","command","builtin"]),tb=new Set(["&&","||","|&","|","&",";"]),nb=new Set(["<<","<<<",">|"]),rb=new Set(["|","|&"]),ob=/[*@#?$!_-]/,ib=/^\w+(?::\w+)*/,sb=Object.freeze([]),Yn=Object.freeze({kind:"scope",edge:"enter"}),Zn=Object.freeze({kind:"scope",edge:"exit"}),ab=Object.freeze([]),lb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Xn=new Set(["bash","sh","zsh","dash","ksh"]),cb=256,$u=new WeakMap;function Uu(e,t){let n=t.status==="complete"?new Set(zs(t)):new Set,r=fb(e,n);if(Nr(r))return yo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Nt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return yo("structural-limit",r,t);if(o.invalid)return yo("invalid",r,t);let s=yo("complete",r,t,o.assignmentFallbacks);return $u.set(s,Object.freeze(i)),s}function bo(e,t,n,r,o){let i=o.word??((d)=>d),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,f=[];for(let d of Hu(e)){if(d.kind==="scope"){if(d.edge==="enter"){f.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let u=o.segment(a,s,c,null,l);if(u)return u;let m=f.pop();if(m===void 0)throw Error("scope exit without a matching enter");s=m.state,a=m.segment,l=m.shellWords,c=m.pipeProducer;continue}if(d.kind==="operator"){if(!d.boundary)continue;let u=o.segment(a,s,c,d.operator,l);if(u)return u;s=ub(a,s,n,r),c=a.length>0&&rb.has(d.operator)?a:null,a=[],l=new Set;continue}if(d.kind==="redirection"){if(d.fd!==void 0)l.add(a.length-1);if(d.target===void 0)continue;let u=o.redirection({operator:d.operator,role:d.role,targetOrder:d.targetOrder,target:d.target,...d.body===void 0?{}:{body:d.body,consumer:d.consumer}},s);if(u===Bs){l.add(a.length),a.push(i(d.target));continue}if(u)return u;continue}a.push(i(d.text))}return o.segment(a,s,c,null,l)}function So(e){return Hu(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function me(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:me(i,t);return a?me(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function Jn(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function ub(e,t,n,r){let o=Jn(e)?new Map([...t.variables,...db(e,t.variables)]):t.variables,i=mt([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ie(me(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function db(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],me(o,t)]]:[]})}function Hu(e){return $u.get(e)??sb}function fb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function yo(e,t,n,r=ab){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Nt(e,t){return e.nodes.flatMap((n,r)=>mb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function mb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[De(Cb(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[De(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[Co("{"),...Nt(e.body,a),...s?[Co("}")]:[]]:[Yn,De("("),...Nt(e.body,a),...s?[De(")")]:[],Zn]}]}let o=Eb(e,r.functions);if(o){if(r.depth>=dt.maxDepth||++r.flags.expansions>cb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Fu(e,r),Co(";"),...Nt(o,{...r,depth:r.depth+1}),Co(";")]},...Gu(e,t,n,r)]}return[{start:e.span.start,events:Fu(e,r)},...Gu(e,t,n,r)]}function Fu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Vu(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:pb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function pb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Vu(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[$s(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:bb(r),targetOrder:nb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:qu(t)}:{}}),...s===void 0?o:o.slice(1)]}function Gu(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[$s(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[De(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...ju(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?gb(t,n,r):[]]}function gb(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:ju(n.source.slice(r.span.end,e.span.end),n)}]}function ju(e,t){if(t.depth>=dt.maxDepth)return t.flags.limited=!0,[];let n=Oe(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Nt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Vu(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?De("glob"):s!==""||e.quoted&&o.length===0?$s(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of Fs(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(De(m));continue}s+=m.text,a||=m.glob}continue}let f=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=Fs(m,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=f?Nt(f,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(Yn,...p,Zn);continue}let d=f?Nt(f,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Yn,...d,Zn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?De("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Yn,...d,...c.raw.endsWith(")")?[De(")")]:[],Zn);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>De("(")),...u===1?[Yn]:[],...d,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>De(")")):[],...u===1?[Zn]:[])}return l(),o}function Fs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=zu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=zu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function zu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=yb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return hb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&ob.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?ib:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function hb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Fs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function yb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Cb(e){return/^[\r\n]+$/.test(e)?";":e}function De(e){return Object.freeze({kind:"operator",operator:e,boundary:tb.has(e)})}function Co(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function $s(e){return Object.freeze({kind:"word",text:e})}function bb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function Qn(e){return lb.has(e)||/^python\d/.test(e)}var Sb=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Ku(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=Sb.get(e)?.has(n)??!1;return Ku(e,t.slice(r?2:1))}function Gs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Gs(e.slice(1));if(!eb.has(t))return[...e];return Gs(Ku(t,e.slice(1)))}function qu(e){let t=Gn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Gs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function vb(e){let t=qu(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return Qn(n)&&!Xn.has(n)}function zs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return zs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>zs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(vb(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!xb(t))return r;return[...r,...o]})}function Eb(e,t){let n=Gn(e);return n===void 0?void 0:t.get(n)}function pt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function Rb(e){if(pt(e.words[0],"git"))return pt(e.words[1],"commit");if(!pt(e.words[0],"gh")||!pt(e.words[2],"create"))return!1;return pt(e.words[1],"pr")||pt(e.words[1],"issue")}function xb(e){return(pt(e.words[0],"cat")||pt(e.words[0],"tee")||Rb(e))&&!e.words.some(Bu)&&!e.redirections.some((n)=>Bu(n.target))}function Bu(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Yu=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Zu=new Set([...Yu,"glob"]),_b=new Set([...Zu,"pattern"]);class Le extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function er(e){let t=wb(),n=wn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((f)=>f.source===s.source);if(a!==-1){let f=i[a];if(!f)return i;return i[a]={...f,usages:[...f.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:Pb(e),store:t}}function pe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Xe(e,t){if(!e.includes("$"))return e;return hi(e,t)}function wb(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Oe(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let f=n.get(a);if(f)return f;let d={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,d),d}let l=e.get(i);if(l)return l;let c=Uu(i,a);return e.set(i,c),c},getCommandProgram:r}}function Pb(e){let t=e.route.kind==="grep"?Zu:e.route.kind==="glob"?_b:Yu;return[...hl(e.input,t),...e.route.kind==="patch"?bl(e.input):[]]}var Ab=new Set(["-S","--suffix"]);function un(e,t,n,r,o){if(e.status==="structural-limit")throw new Le;if(e.status!=="complete")return o.findMalformedTarget(e.source);return bo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(me(i.target,s.variables),s)?i.target:null})}function vo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Ab.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Pe="Git metadata and hooks are protected. Ask the user before modifying them.";function td(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(xr(e.invocation.toolName))return null;let a=e.paths.find((l)=>Xu(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=pe(e,"input-candidate");if(!i)return null;let s=un(i.shell,o,n,r,{findSegmentTarget:(a,l)=>Ob(a,l,t,n,r),isRedirectionTarget:(a,l)=>Xu(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Ro(ie(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Us(l,n))return!0;let c=s||a.slice(l.length).includes("/."),f=(d)=>c?Eo(d,l):Tb(d,l);if(n.markerFiles.some(f))return!0;return r&&Ju(n).some(f)}if(Us(a,n))return!0;return r&&Ju(n).some((c)=>Eo(c,a))}function Tb(e,t){let n=ed(t,e);if(n===""||n.startsWith("..")||Qu(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function Ib(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function kb(e,t,n,r,o){if(!n)return!1;return Us(Ro(ie(e,t,r,o)),n)}function Xu(e,t,n,r,o,i){let s=Ro(ie(e,t,r,o));return i.includes(s)||rd(s,n)}function nd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Eo(i,Ro(ie(s,t,r,o)))))}function Us(e,t){return t.entries.includes(e)||t.directories.includes(e)||rd(e,t)}function rd(e,t){return t.hooksDirectories.some((n)=>Eo(e,n))}function Ju(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Eo(e,t){let n=ed(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!Qu(n)}function Ro(e){return process.platform==="win32"?e.toLowerCase():e}function Ob(e,t,n,r,o){if(Jn(e))return null;let i=Mt([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=vo(i.slice(1)),a=s.sources.find((l)=>Ib(me(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&kb(me(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Ys,normalize as Bb,parse as $b,posix as fd,resolve as dn,sep as qs}from"node:path";import{isAbsolute as Mb,join as od,normalize as ad,parse as Nb,sep as id}from"node:path";var Db=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Lb=` 	
-`;function tr(e,t){if(gt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Hs(e.get("TMPDIR")??"",t)}function Lt(e,t){if(e.has("TMPDIR"))return Hs(e.get("TMPDIR")??"",t);let n=js(e,t);if(n===void 0)return!0;return Hs(n,t)}function js(e,t){return ud(e,t,"TMPDIR")}function Hs(e,t){if(!e)return!1;if(Fb(e))return!1;return Vs(e,t)}function gt(e,t){let n=ud(e,t,"IFS");return n!==void 0&&n!==""&&n!==Lb}function Vs(e,t){let n=xo(e,t.paths);if(n===null)return!1;return cd(t).some((r)=>zb(n,r))}function ld(e,t){let n=xo(e,t.paths);if(n===null)return!1;return cd(t).some((r)=>_o(r)===_o(n))}var sd=new WeakMap;function cd(e){let t=sd.get(e);if(t)return t;let n=Wb(e);return sd.set(e,n),n}function Wb(e){let t=Db.map((r)=>xo(r,e.paths)??ad(r)),n=xo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&Gb(n))return[...t,n];return t}function Fb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function ud(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function Gb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function xo(e,t){try{let n=ad(e);if(!Mb(n))return n;let r=Nb(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=od(i,o[s]??"");if(t.entryKind(a)==="missing")return od(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function zb(e,t){let n=_o(e),r=_o(t);if(n===r)return!0;let o=r.endsWith(id)?r:`${r}${id}`;return n.startsWith(o)}function _o(e){return process.platform==="win32"?e.toLowerCase():e}var Ub=process.platform==="win32",dd=64,Hb=16384;function nr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return b(o.id,o.reason)}function rr(e){let t=tu(e,dd,dd,Hb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:jb(e)}}function jb(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>Vb(e.raw,n.span.start-e.span.start))}function Vb(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Wt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??ye();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:Xb(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function We(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&Qb(e))return{kind:"outside_anchored_cwd"};let o=!r&&gd(e,t.posixShell);if(at(e))return{kind:"outside_anchored_cwd"};if(Zs(e,r))return{kind:"root_or_home_target"};if(Kb(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(qb(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(Jb(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&rS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&oS(e,t.resolvedCwd??i,t.environment.paths,t.budget))return{kind:"cwd_self_target"};if(iS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function md(e,t,n={}){let{containmentTarget:r,...o}=n;if(We(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(Zb(i))return!1;if(ld(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>sS(r??i,s,t.environment.paths,t.budget))}function Zs(e,t=!1){let n=e.trim(),r=fd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function Kb(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Ys(o)?o:t.resolvedCwd?dn(t.resolvedCwd,o):null;if(!i)return!1;let s=ge(G(i,t.environment.paths,t.budget));if(s===$b(s).root)return!0;return s===ge(G(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function ge(e){let t=Bb(e);if(Ub){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function qb(e,t,n,r,o,i,s,a){let l=e.trim();if(pd(l))return!1;if(!r&&Vs(l,a))return!0;return(t||i&&s)&&n&&!o&&Yb(l,n)}function Yb(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!gd(e.slice(n.length+1),t)})}function Zb(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return fd.normalize(`/${t[1]??""}`)==="/"}function pd(e){return e.split(/[\\/]+/).includes("..")}function Xb(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Ln(o.trim(),t);if(!Ys(i))return[];try{let s=G(i,n,r);if(Wn(s,G(t,n,r)))return[];return[ge(s)]}catch{return[]}})}function Jb(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(pd(r))return!1;let o=n?r:Ln(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Ys(o)?o:i?dn(i,o):null;if(!s)return!1;try{let a=ge(G(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(qs)?l:`${l}${qs}`))}catch{return!1}}function Qb(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function gd(e,t=!1){return e.includes("$")||e.includes("`")||eS(e)||t&&tS(e)}function eS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function tS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&nS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function nS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function rS(e,t,n,r){try{return ge(G(e,n,r))===ge(G(t,n,r))}catch{try{return ge(e)===ge(t)}catch{return!1}}}function oS(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return ge(G(dn(t,e),n,r))===ge(G(t,n,r))}catch{try{return ge(dn(t,e))===ge(t)}catch{return!1}}}function iS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Ks(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Ks(dn(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Ks(dn(a,e),t,i,s)}catch{return!1}}function Ks(e,t,n,r){try{return hd(G(e,n,r),G(t,n,r))}catch{return!1}}function sS(e,t,n,r){if(!t)return!1;try{return hd(G(t,n,r),G(e,n,r))}catch{return!0}}function hd(e,t){let n=ge(e),r=ge(t);return n.startsWith(`${r}${qs}`)||n===r}var aS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),yd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",lS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Cd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",bd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",cS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",uS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",dS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:bd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Pe},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Cd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:cS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:yd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:lS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:yd}};function Sd(e,t,n,r=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return fS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function fS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=pS(o),s=o[i];if(!s||!aS.has(RS(s.text)))return null;let a=mS(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",uS);for(let l of a.targets)if(!at(l.text)&&Zs(Js(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",bd);for(let l of a.targets)if(n.resolvedCwd&&Dt(Js(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return b("powershell.remove-item-git-metadata",Pe);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",Cd);for(let l of a.targets){let c=nr(We(Js(l.text),n),n,r,dS);if(c)return c}return null}function mS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(gS(l))continue;if(s){t.push(Xs(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=yS(l.text);if(!c){t.push(Xs(l)),i=i||l.dynamic;continue}if(CS(c.name)){let f=c.value?hS(c.value,l):e[++a];if(f?.kind==="word"){t.push(Xs(f)),i=i||f.dynamic;continue}i=!0;continue}if(bS(c.name)){n=!0;continue}if(SS(c.name)){r=!0;continue}if(vS(c.name))o=ES(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function pS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Xs(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function gS(e){return e.kind==="word"&&e.text===","}function Js(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function hS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function yS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function CS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function bS(e){return"recurse".startsWith(e)}function SS(e){return e.length>=2&&"force".startsWith(e)}function vS(e){return e==="wi"||"whatif".startsWith(e)}function ES(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function RS(e){return e.toLowerCase()}var fn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",wo="Unsupported heredoc syntax",vd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";import{normalize as Vo}from"node:path";var xS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),_S=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),wS=new Set(["-o","--output","--query","--subscription"]),PS=new Set;function Ed(e){if(e==="aws")return xS;if(e==="gcloud")return _S;if(e==="az")return wS;return PS}var AS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),TS=new Set;function Rd(e){if(e==="git")return be;if(e==="docker")return AS;return TS}function Je(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=de(e);for(let o of t){if(!OS(n,o.command))continue;if(o.match){if(IS(n,e,o.match))return xd(o);continue}if(!MS(n,e,o.subcommand))continue;if(DS(e,new Set(o.block_args),r))return xd(o)}return null}function xd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function IS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return kS(r,n.command_path,Ed(e))}function kS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function OS(e,t){return e===M(t)}function MS(e,t,n){if(!n)return!0;return _d(t,1,n,Rd(e))}function _d(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&NS(e,i,n,r))return!0;continue}return s===n}return!1}function NS(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return _d(e,t+2,n,r)}function DS(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var LS=new Set(["-e","--source"]),WS=new Set(["-F","-v","--assign","--field-separator"]),wd=new Set(["-f","--file"]),FS=new Set(["print","printf","return"]),Pd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],GS="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Ad(e,t,n){let r=!1;for(let o of zS(e)){let i=BS(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",GS):null}function ea(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&LS.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(WS.has(a)||wd.has(a))){let l=e[s+1];if(i&&=l!==void 0,wd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function ir(e){return ea(e).sources}function zS(e){return ir(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function BS(e,t){Ee(t,e);let n=e.includes("system")?ta(e,t):null,r=$S(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ta(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Ao(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Td(e,i+1);continue}if(s==="/"&&Id(e,i)){i=kd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,or(e[a-1])||or(e[i]))continue;let l=Po(e,i);if(e[l]!=="(")continue;l=Po(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let f=Ao(e,l,c);if(!f){r=!0,o=!0;continue}if(l=Po(e,f.endIndex),r=!0,e[l]!==")"){o=!0,i=f.endIndex;continue}n.push(f.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function $S(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let f=e[i];if(!f)break;if(f==='"'||f==="'"){let m=Ao(e,i,f);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(f==="#"){i=Td(e,i+1),s=i,a=null,l=null,c=i;continue}if(f==="/"&&Id(e,i)){let m=kd(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
-{}`.includes(f)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Qs(e,i,"print")||Qs(e,i,"printf")))a=i;if(f!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(f))c=i+1;i++;continue}let d=e[i+1]==="&"?i+2:i+1,u=Po(e,d);if(Qs(e,u,"getline")){o=!0;let m=jS(s,l,c);if(r||=m===null,m!==null)n.push(m);c=d,i=d;continue}if(KS(s,a)){o=!0;let m=HS(e,u);if(!m){r=!0,c=d,i=d;continue}if(!US(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=d,i++}if(!o)return null;return{dynamic:r,commands:n}}function or(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Po(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function US(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Ao(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=VS(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function HS(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Ao(e,t,n)}function jS(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function VS(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Qs(e,t,n){return e.startsWith(n,t)&&!or(e[t-1])&&!or(e[t+n.length])}function KS(e,t){return t!==null&&t>=e}function Td(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Id(e,t){let n=qS(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(or(e[r-1]))r--;return FS.has(e.slice(r,n+1))}function qS(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function kd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var YS=new Set(["sudo","env","command","builtin"]);function To(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=ZS(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function ZS(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&XS(a,r);if(l)i.push(s);if(!l&&Mr.has(M(a)))break;if(o)break}return i}function XS(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||ji.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||ke(r)||_e.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return YS.has(e.toLowerCase())}function Gt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Fe(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Io([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Io(e,t,n,r,o,i,s,a,l){let c=ho(e,t,n,i);for(let[m,p]of c.envAssignments)i.set(m,p),o.set(m,p);let{tokens:f,cwd:d}=c;if(c.envSplitValues){let m=go(c.envSplitValues,f);if(!m)throw new N("derivedCommandShape");na(a),yield*Io(m,t,d,r,o,i,s,a,l);return}if(Ft(f[0]??""))throw new N("wrapperPeelIterations");let u=To(f,s);if(u){for(let m of[u.childIndex,...u.alternativeChildIndices])na(a),yield*Io(m===u.childIndex?u.tokens:[...f.slice(m)],t,d,r,new Map(o),new Map(i),s,a,!0);return}if(QS(f)){na(a),yield*Io([...f.slice(1)],t,d,r,o,i,s,a,l);return}yield JS(f,d,r,o,i,l)}function JS(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function na(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function QS(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ra(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Ge(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||oa(r,"recursive")){t=!0;continue}if(r==="-f"||oa(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Od(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>oa(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function oa(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var ev="find -delete permanently removes files. Use -print first to preview.",tv="find -exec rm -rf is dangerous. Use explicit file list instead.",nv=new Set(["-exec","-execdir","-ok","-okdir"]),rv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Md(e,t){let n=e.map(w),r=ov(e,n,t);if(r)return r;if(Oo(n,1)&&!sv(e,n,t)){let s=A(b("find.delete",ev),t.policy);if(s)return s}let o=t.budget??ye(),i=0;while(i<n.length){let s=n[i],a=ht(s??"");if(a>0){i+=a+1;continue}if(!Qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=sr(n,i);i=l.nextIndex;let c=lv(l.tokens,t.environment);if(c){let m=A(c,t.policy);if(m)return m}let f=s==="-execdir"||s==="-okdir",d=t.analyzeTokens?t.analyzeTokens(l.tokens,f?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:f?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=d?.id.startsWith("custom.")?d:A(d,t.policy);if(u)return u}return null}function ov(e,t,n){if(!Oo(t,1)&&!ia(t,n.environment))return null;let o=ko(e)??K(["."]),i=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=rr(s);for(let l of a.expandedTargets??[w(s)]){let c=We(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Pe)}}if(iv(t)&&i.resolvedCwd&&nd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return b("find.delete-git-metadata",Pe);return null}function ia(e,t){let n=0;while(n<e.length){if(!Qe(e[n])){n++;continue}let r=sr(e,n),o=Mt([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function iv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function sv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=ko(e);if(!r)return!1;let o=n.envAssignments??new Map,i=js(o,n.environment),s=n.trustedTmpdirValue??Lt(o,n.environment),a=n.allowTmpdirVar??!tr(o,n.environment),l=Wt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??gt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let f=rr(c);if(f.unsafeBraceExpansion)return!1;return(f.expandedTargets??[w(c)]).every((d)=>md(d,l,{containmentTarget:av(d,i),targetIsLiteral:f.expandedTargets!==void 0||f.targetIsLiteral,tmpdirWordSplittingProtected:f.tmpdirWordSplittingProtected}))})}function av(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function ko(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function lv(e,t){let n=mt([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&Ge(n))return b("find.exec-rm-recursive-force",tv);return null}function sr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Oo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Qe(r)){n=sr(e,n).nextIndex;continue}let o=ht(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ht(e){return rv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Qe(e){return e!==void 0&&nv.has(e)}function ar(e){let t=Oe(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var cv=5,sa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ce(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Dd(e,t,n){let r=Mo(e,t,n),o=uv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<cv;a++){let{subcommand:l,rest:c}=ze(i),f=l?.toLowerCase();if(!f||!o.has(f))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let d=o.get(f),u=gv(d);if(u===null||u.length===0)return{blockedReason:sa,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:sa,expanded:!0,tokens:i}}function Ld(e,t,n){return Mo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function ze(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=be.has(o)?2:1}return{subcommand:null,rest:[]}}function uv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Mo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=fv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...dv(e,t,n)]}}function dv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=aa(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=aa(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Nd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Nd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(be.has(i)){o+=2;continue}o++}return r}function fv(e,t){let n=mv(e,t),r=pv(e,t);return{blockedReason:n===null||r===null?sa:null,entries:[...n??[],...r??[]]}}function mv(e,t){let n=Ze("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=ar(n);if(!o)return null;for(let i of o){let s=aa(i);if(!s)return null;r.push(s)}return r}function pv(e,t){let n=Iu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ze(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ze(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function aa(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Nd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ze(e.slice(r+1),t,n)}}function gv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return ar(t)}var hv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",yv="git checkout --force discards uncommitted changes. Use 'git stash' first.",Cv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",bv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Sv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",vv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Ev="git switch --force discards uncommitted changes. Use 'git stash' first.",Rv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",xv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",_v="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",wv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Pv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Av="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Tv="git push --force destroys remote history. Use --force-with-lease for safer force push.",Iv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",kv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Ov="git branch -D force-deletes without merge check. Use -d for safe delete.",Mv="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",Nv="git merge --abort discards merge conflict resolutions. Use 'git status' first.",Dv="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Lv="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Wv="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",Fv="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Gv="git worktree remove --force can delete uncommitted changes. Remove --force flag.",zv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Bv=new Set(["--recurse-submodules","--track","-t"]),la=new Set(["-b","-B","-U"]),ca=new Set(["-c","-C"]),$v=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var mn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Fd(e){let{subcommand:t,rest:n}=ze(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return yt(Uv(n));case"switch":return yt(Hv(n));case"restore":return yt(Vv(n));case"reset":return qv(n);case"clean":return yt(Zv(n));case"rm":return yt(Xv(n));case"push":return zt(Jv(n));case"branch":return zt(tE(n));case"stash":return zt(sE(n));case"worktree":return zt(aE(n));case"rebase":return yt(nE(n));case"merge":return yt(rE(n));case"tag":return zt(oE(n));case"reflog":return zt(iE(n));default:return null}}function yt(e){return e?{...e,localDiscard:!0}:null}function zt(e){return e?{...e,localDiscard:!1}:null}function Uv(e){let{index:t,before:n}=ce(e),r=de(n,{shortOptsWithValue:la});if(n.some((i)=>O(i,"--force"))||r.has("-f"))return b("git.checkout-force",yv);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(O(i,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",bv)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return b("git.checkout-ref-path",Cv);return b("git.checkout-double-dash",hv)}if(jv(e).length>=2)return b("git.checkout-ambiguous",Sv);return null}function Hv(e){let{before:t}=ce(e);if(t.some((r)=>O(r,"--discard-changes")))return b("git.switch-discard-changes",vv);let n=de(t,{shortOptsWithValue:ca});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return b("git.switch-force",Ev);return null}function jv(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(zv.has(r)){n+=2;continue}if(Bv.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function Vv(e){let t=Kv(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",xv):b("git.restore-unstaged",Rv)}function Kv(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if($v.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function qv(e){let t=null;for(let n of e){if(O(n,"--hard")){t=b("git.reset-hard",_v);break}if(O(n,"--merge")){t=b("git.reset-merge",wv);break}}if(!t)return null;return Yv(e)?zt(t):yt(t)}function Yv(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function Zv(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return b("git.clean-force",Pv);return null}function Xv(e){let t=!1,n=!1,r=!1;for(let o of ce(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",Av):null}function Jv(e){let{before:t,after:n}=ce(e),r=de(t);if(t.some((s)=>O(s,"--mirror")))return b("git.push-mirror",kv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||Wd(t,n).some(Qv))return b("git.push-force",Tv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||Wd(t,n).some(eE))return b("git.push-delete",Iv);return null}function Wd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function Qv(e){return e.startsWith("+")||e.includes(":+")}function eE(e){return e.length>1&&e.startsWith(":")}function tE(e){let{before:t}=ce(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return b("git.branch-force-delete",Ov);return null}function nE(e){let{before:t}=ce(e);return t.some((n)=>O(n,"--abort"))?b("git.rebase-abort",Mv):null}function rE(e){let{before:t}=ce(e);return t.some((n)=>O(n,"--abort"))?b("git.merge-abort",Nv):null}function oE(e){let{before:t}=ce(e);return de(t).has("-d")||t.some((r)=>O(r,"--delete"))?b("git.tag-delete",Dv):null}function iE(e){return e[0]==="delete"?b("git.reflog-delete",Lv):null}function sE(e){for(let t of e){if(t==="drop")return b("git.stash-drop",Wv);if(t==="clear")return b("git.stash-clear",Fv)}return null}function aE(e){let{before:t}=ce(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",Gv);return null}import{resolve as lE}from"node:path";function zd(e,t){return Ls.some((n)=>t?.has(n)||e.has(n))}function Bd(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(lE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=Gd(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=Gd(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=be.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function Gd(e,t,n){try{let r=ft(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function $d(e,t,n){if(!t.localDiscard||!n.worktreeMode||zd(n.environment.env,n.envAssignments))return null;let r=Bd(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(cE(e,n,o))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function cE(e,t,n){let{subcommand:r,rest:o}=ze(e),i=r?.toLowerCase();if(t.dynamicArguments||uE(o)||gE(e,t.environment.env,t.envAssignments,n)||mE(o)||dE(i,o))return!0;return i==="clean"&&pE(o)>1}function uE(e){return e.some((t)=>/[$*?[]/.test(t))}function dE(e,t){if(e==="checkout"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:la}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:ca}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||fE(s))||r.has("-C");return o&&i}return!1}function fE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function mE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function pE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function gE(e,t,n,r){if(Ze("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Mo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>yE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||hE(s.value);if(Ou(n))return!0;return r.recursiveSubmodules}function hE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function yE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}var CE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",bE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function No(e,t){return Ud(e.map(w),t)}function Ud(e,t,n){let r=Dd(e,t.environment.env,t.envAssignments),o=r.blockedReason?A(b("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((ku(t.envAssignments)||Ld(e,t.environment.env,t.envAssignments))&&SE(i))return b("git.ssh-env",CE);let s=Fd(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=$d(e,s,t);if(!a)return s;return n?.(a),null}function Hd(e,t){let n=null;return{match:Ud(e.map(w),t,(o)=>{n=o}),relaxation:n}}function SE(e){let{subcommand:t,rest:n}=ze(e),r=t?.toLowerCase();if(!r)return!1;if(bE.has(r))return!0;if(r==="archive")return ce(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&vE(n)}function vE(e){return e.find((t)=>!EE(t))?.toLowerCase()==="update"}function EE(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as rR}from"node:path";function jd(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Do(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Vd="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",RE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",xE="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",qd="rm -rf targeting root or home directory is extremely dangerous and always blocked.",_E="rm -rf in home directory is dangerous. Change to a project directory first.",Kd={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:qd},git_metadata_target:{id:"rm.git-metadata",reason:Pe},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:xE},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:_E},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Vd},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:RE},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Vd}};function Lo(e,t){let n=Wt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Ge(r),i=Od(r),s=PE(e);for(let a of s){let l=rr(a.word);if(o&&l.unsafeBraceExpansion){let c=A(nr({kind:"outside_anchored_cwd"},n,t.policy,Kd),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let f=Ce(c),d={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(f,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return b("rm.git-metadata",Pe);if(i&&!o){let u=We(f,n,d);if(u.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",qd);if(u.kind==="git_metadata_target")return b("rm.git-metadata",Pe);continue}if(!o)continue;for(let u of wE(f,n,d)){let m=nr(u,n,t.policy,Kd),p=A(m,t.policy);if(p)return p}}}return null}function wE(e,t,n){let r=We(e,t,n);if(r.kind==="cwd_self_target")return[r,We(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=We(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,We(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function PE(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},Bt={kind:"dynamic"},AE=new Set(["<","<<","<<-","<<<","<&","<>"]),Zd=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,TE=/^(?:[0-9]+|[@*])$/,IE=dt.maxWords,kE=dt.maxInputLength;function Xd(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`||e===";"||e==="&"||e==="|"}function an(e){return e==="|"||e===";"}function lo(e,t,n){let r=Ls(e,n);if(t==="rm")return sC(r);if(t==="dd")return lC(r);return xu(r,!0)}function co(e,t,n){let r=Ls(e,n);if(t==="rm")return cC(r);if(t==="reset-hard")return Eu(r,"--ha","rd");if(t==="reset-merge")return Eu(r,"--me","rge");if(t==="clean")return mC(r);if(t==="checkout")return gC(r);if(t==="push-force")return hC(r);if(t==="push-refspec")return yC(r);if(t==="push-delete")return CC(r);if(t==="branch")return bC(r);if(t==="tag")return EC(r);if(t==="restore")return RC(r);return xu(r,!1)}function sC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Ke(e,i,"rm")&&H(l)&&l!==`
+`)t=!0,i++;continue}let a=aC(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=bu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=bu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function aC(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function bu(e,t,n){if(Su(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Su(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Su(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function lC(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(C(e,n))){t=!1;continue}if(Ke(e,n,"dd")){t=!0,n++;continue}if(!t||!Ke(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function cC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=C(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=dC(e,o);if(s>=0){if(uC(e,s))return!0;let a=s,l=!1;while(H(C(e,a)))l||=C(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(C(e,o-1)))&&(!C(e,o+2)||H(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&qe(e,o+11)||Gs(e,o,"recursive"),r||=j(e,o,"--force")&&qe(e,o+7)||Gs(e,o,"force"),n&&r)return!0;o++}return!1}function Gs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&qe(e,t+r+2)}function uC(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(C(e,n)))n++;let i=n;while(n<Y(e)&&!H(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=vu(e,i,"recursive"),a=vu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=fC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function vu(e,t,n){return j(e,t,`--${n}`)&&qe(e,t+n.length+2)||Gs(e,t,n)}function dC(e,t){if(t>0&&kt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!H(C(e,n+1)))return-1;return n+1}function fC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=C(e,c)??"",f=(u==="r"||u==="f")&&qe(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&f,s||=u==="f"&&f,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&f,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Eu(e,t,n){return Vn(e,"reset",an,!0,(r)=>C(e,r)==="-"&&ln(e,r,t,n)?!0:r)}function mC(e){return Vn(e,"clean",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(ln(e,t,"--fo","rce"))return!0;let n=jn(e,t,an);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function uo(e,t,n){if(!Ke(e,t,"git"))return null;let r=t+3;if(!H(C(e,r)))return{commandEnd:-1,next:r};while(H(C(e,r)))r++;while(r<Y(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=jn(e,r,oe);if(Ke(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=pC(e,r,o);r=o;while(H(C(e,r)))r++;if(i)return{commandEnd:Ke(e,r,n)?r+n.length:-1,next:jn(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=jn(e,r,oe);while(H(C(e,r)))r++}return{commandEnd:-1,next:r}}function pC(e,t,n){for(let r of be)if(n-t===r.length&&j(e,t,r))return!0;return!1}function gC(e){return Ru(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function hC(e){return Vn(e,"push",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!kt(C(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=_u(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function yC(e){return Vn(e,"push",oe,!1,(t)=>{if(H(C(e,t))&&C(e,t+1)==="+"&&t+2<Y(e)&&!oe(C(e,t+2))&&!H(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function CC(e){return Vn(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&ln(e,t,"--de","lete"))return!0;if(H(C(e,t))&&C(e,t+1)===":"&&t+2<Y(e)&&!H(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function bC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=uo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=jn(e,o,oe),s=SC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function SC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(ln(e,i,"--de","lete"))r=!0;if(ln(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&vC(C(e,s))){let u=C(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!qe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function vC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function EC(e){return Ru(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Ru(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=uo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(ln(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&qe(e,r+1))return!0;if(an(o))i.outerActive=!1}return!1}function Vn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=uo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(C(e,u)))i=!1;s=c}if(l)i=!1}return!1}function RC(e){let t=!1;for(let n=0;n<Y(e);n++){if(Ws(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=uo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function xu(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=C(e,r),i=t?Ws(o):oe(o);if(n&&H(o)&&C(e,r+1)==="-"&&Ke(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Ke(e,r,"find"))n=!0,r+=3}return!1}function jn(e,t,n){let r=t;while(r<Y(e)&&!H(C(e,r))&&!n(C(e,r)))r++;return r}function _u(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return qe(e,o)?o:-1}function ln(e,t,n,r){return _u(e,t,n,r)>=0}function Ye(e,t){Hn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&co(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var xC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Hn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Au(t.nodes,r,i)}function Au(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Au(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return _C(r,t,n)})}function _C(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!xC.test(o.text));return e.words.every((o,i)=>o===t||wu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||wu(o.target.raw,n.anchored,!0)))}function wu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as wC,resolve as Tu}from"node:path";function Kn(e,t,n,r){let o=wC(e)?Tu(e):t?Tu(t,e):void 0;if(!o)return;try{return F(o,n,r)}catch{return o}}function Iu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var cn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",qn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Fs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),PC=new Set(["-p","--print"]),AC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),TC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),IC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),kC=new Map([["python",new Set(["m"])]]),OC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),MC=new Set(["always","default","never"]),NC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),DC=/\\\r?\n/g,LC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Ou(e){return mo(e).code}function fo(e){return mo(e).sources}function Mu(e){return LC.get(Bs(e))??[]}function mo(e){let t=Bs(e[0]??"");if(!Fs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&PC.has(s)){let f=e[i+1];if(f===void 0)return Ne(t,n,r,o);if(f.startsWith("-"))continue;n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),i++;continue}if(GC(t,s)){let f=e[i+1];if(f===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(FC(t)&&a){let f=a[1]??"";n.push({tokenIndex:i,value:f}),r.push({tokenIndex:i,kind:"inline-code",value:f});continue}if(t==="node"){let f=WC(s);if(f){if(f.attached){if(o&&=f.value!=="",f.value!=="")r.push({tokenIndex:i,kind:"module-file",value:f.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(OC.get(t)?.has(s)){let f=e[i+1];if(f===void 0||f.startsWith("-")&&!(t==="ruby"&&NC.has(s))||t==="python"&&!MC.has(f))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let f=1;f<s.length;f++){let d=s[f];if(d===void 0)break;if(kC.get(t)?.has(d)){let m=s.slice(f+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(AC.get(t)?.has(d)){l=s.slice(f+1)||e[i+1],c=f+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&d==="r"){let m=s.slice(f+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let m=s.slice(f+1);if(!m){if(o=!1,f+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(TC.get(t)?.has(d)){if(f+1===s.length)i++;break}if(IC.get(t)?.has(d)&&f+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function WC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function zs(e,t){return Bs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Bs(e){let t=k(e).toLowerCase();return Nr.test(t)?"python":t}function GC(e,t){return Fs.get(e)?.has(t)??!1}function FC(e){return Fs.get(e)?.has("--eval")??!1}function Yn(e,t){let n=$C(e,t);if(!ku(n,t))return!1;Ee(t,n);let r=BC(n);if(ku(r,t))return!0;return Ee(t,r),zC.test(r)}var zC=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function BC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function ku(e,t){if(lo(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(lo(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(lo(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>co(o,r))))}function $C(e,t){return Ee(t,e),e.replace(DC,"")}import{isAbsolute as id,relative as sd}from"node:path";import{isAbsolute as zu,parse as JC}from"node:path";import{dirname as UC,isAbsolute as HC,parse as jC,sep as VC}from"node:path";function ft(e,t,n){if(at(t))throw Error("Unsupported Windows namespace path");let r=HC(t)?jC(t).root:"",o=r||e;for(let i of qC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=UC(o);continue}let s=KC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function KC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${VC}${t}`}function qC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var $s=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],YC=new Set($s),ZC=1024,Nu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Du=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),XC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function po(e){return YC.has(e)}function Us(e){return po(e)||Nu.has(e)||Du.has(e)||Mn(e)}function Ze(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Lu(e,t){let n=Ze("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=ZC?{state:"valid",count:r}:{state:"invalid"}}function go(e,t,n){let o=e.match(XC)?.[1];if(!o||!Us(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ze(o,t,n)??""}${e.slice(i+1)}`}}function Wu(e){return Fu(e,Du)}function Gu(e){return Fu(e,Nu)}function Fu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var $u=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!$u.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function ho(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Uu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Ot(e,t,n,r){if(!Uu(un(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let f=0;f<V.wrapperPeelIterations.cap;f++){let d=Bu(i),m=ho(i);for(let[h,g]of m.envAssignments)s.set(h,g),a.set(h,g);if(i=m.words,i.length===0)break;while(i.length>0&&un(i).includes("=")&&!eb(i)){let h=tb(un(i),a,t.env)??go(un(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=un(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=rb(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=sb(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=ab(i);if(p==="builtin")i=i.slice(De(i,1)==="--"?2:1);if(Bu(i)===d)break}let u=ho(i);for(let[f,d]of u.envAssignments)s.set(f,d),a.set(f,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:QC(u.words,o)}}function QC(e,t){return e.some((n)=>!t.has(n))}function Bu(e){return e.map(w).join(" ")}function un(e){let t=e[0];return t?w(t):""}function De(e,t){let n=e[t];return n?w(n):void 0}function eb(e){return $u.test(un(e))}function tb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var nb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function rb(e,t,n){let r=1,o=n;while(r<e.length){let i=De(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=De(e,r+1);o=s?Zn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Zn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Zn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(nb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var ob=new Set(["-i","-0","--null"]),ib=new Set(["-u","--unset","-C","--chdir","-P"]);function sb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=De(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let f of n.keys())o.set(f,"");o.set("TMPDIR",""),a++;continue}if(ob.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let f=De(e,a+1);if(f!==void 0)o.set(f,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:De(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(ib.has(c)){if(c==="-C"||c==="--chdir"){let f=De(e,a+1);s=f?Zn(s,f,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let f=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Zn(s,f,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let f=Pe(De(e,a)??"");if(!f)break;o.set(f.name,f.value),a++}if(De(e,a)==="--")a++;return l(a)}return l(a)}function Zn(e,t,n){if(t==="")return null;if(!e&&!zu(t))return null;let r=zu(t)?JC(t).root:n.realpath(e??"/");if(r===null)return null;try{return ft(r,t,n)}catch{return null}}function ab(e){if(De(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=De(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var lb=/['"\\$`{}#]/;function yo(e,t){if(e.some((r)=>lb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function mt(e,t,n){return Co(e,t,n).tokens}function cb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Mt(e,t,n,r=0){let o=Co(e,t,n),i=(o.envSplitValues??[]).flatMap(cb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Mt(s,t,n,r+1)}function Co(e,t,n,r){if(!Uu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Ot(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Ks=Symbol("adopt-as-operand"),ub=new Set(["env","sudo","command","builtin"]),db=new Set(["&&","||","|&","|","&",";"]),fb=new Set(["<<","<<<",">|"]),mb=new Set(["|","|&"]),pb=/[*@#?$!_-]/,gb=/^\w+(?::\w+)*/,hb=Object.freeze([]),Xn=Object.freeze({kind:"scope",edge:"enter"}),Jn=Object.freeze({kind:"scope",edge:"exit"}),yb=Object.freeze([]),Cb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Qn=new Set(["bash","sh","zsh","dash","ksh"]),bb=256,qu=new WeakMap;function Yu(e,t){let n=t.status==="complete"?new Set(Vs(t)):new Set,r=Eb(e,n);if(Lr(r))return bo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Nt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return bo("structural-limit",r,t);if(o.invalid)return bo("invalid",r,t);let s=bo("complete",r,t,o.assignmentFallbacks);return qu.set(s,Object.freeze(i)),s}function vo(e,t,n,r,o){let i=o.word??((f)=>f),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let f of Zu(e)){if(f.kind==="scope"){if(f.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let m=u.pop();if(m===void 0)throw Error("scope exit without a matching enter");s=m.state,a=m.segment,l=m.shellWords,c=m.pipeProducer;continue}if(f.kind==="operator"){if(!f.boundary)continue;let d=o.segment(a,s,c,f.operator,l);if(d)return d;s=Sb(a,s,n,r),c=a.length>0&&mb.has(f.operator)?a:null,a=[],l=new Set;continue}if(f.kind==="redirection"){if(f.fd!==void 0)l.add(a.length-1);if(f.target===void 0)continue;let d=o.redirection({operator:f.operator,role:f.role,targetOrder:f.targetOrder,target:f.target,...f.body===void 0?{}:{body:f.body,consumer:f.consumer}},s);if(d===Ks){l.add(a.length),a.push(i(f.target));continue}if(d)return d;continue}a.push(i(f.text))}return o.segment(a,s,c,null,l)}function Eo(e){return Zu(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function me(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:me(i,t);return a?me(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function er(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function Sb(e,t,n,r){let o=er(e)?new Map([...t.variables,...vb(e,t.variables)]):t.variables,i=mt([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(me(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function vb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],me(o,t)]]:[]})}function Zu(e){return qu.get(e)??hb}function Eb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function bo(e,t,n,r=yb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Nt(e,t){return e.nodes.flatMap((n,r)=>Rb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function Rb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Le(Ab(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Le(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[So("{"),...Nt(e.body,a),...s?[So("}")]:[]]:[Xn,Le("("),...Nt(e.body,a),...s?[Le(")")]:[],Jn]}]}let o=Ob(e,r.functions);if(o){if(r.depth>=dt.maxDepth||++r.flags.expansions>bb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Hu(e,r),So(";"),...Nt(o,{...r,depth:r.depth+1}),So(";")]},...ju(e,t,n,r)]}return[{start:e.span.start,events:Hu(e,r)},...ju(e,t,n,r)]}function Hu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Ju(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:xb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function xb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Ju(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[qs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:Tb(r),targetOrder:fb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:ed(t)}:{}}),...s===void 0?o:o.slice(1)]}function ju(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[qs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Le(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...Xu(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?_b(t,n,r):[]]}function _b(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:Xu(n.source.slice(r.span.end,e.span.end),n)}]}function Xu(e,t){if(t.depth>=dt.maxDepth)return t.flags.limited=!0,[];let n=Me(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Nt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Ju(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Le("glob"):s!==""||e.quoted&&o.length===0?qs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of Hs(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(Le(m));continue}s+=m.text,a||=m.glob}continue}let u=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=Hs(m,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=u?Nt(u,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(Xn,...p,Jn);continue}let f=u?Nt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Xn,...f,Jn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Le("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Xn,...f,...c.raw.endsWith(")")?[Le(")")]:[],Jn);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>Le("(")),...d===1?[Xn]:[],...f,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>Le(")")):[],...d===1?[Jn]:[])}return l(),o}function Hs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Vu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Vu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Vu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=Pb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return wb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&pb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?gb:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function wb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Hs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function Pb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Ab(e){return/^[\r\n]+$/.test(e)?";":e}function Le(e){return Object.freeze({kind:"operator",operator:e,boundary:db.has(e)})}function So(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function qs(e){return Object.freeze({kind:"word",text:e})}function Tb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function tr(e){return Cb.has(e)||/^python\d/.test(e)}var Ib=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Qu(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=Ib.get(e)?.has(n)??!1;return Qu(e,t.slice(r?2:1))}function js(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return js(e.slice(1));if(!ub.has(t))return[...e];return js(Qu(t,e.slice(1)))}function ed(e){let t=Bn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return js(n<0?[]:e.words.slice(n).map((r)=>r.text))}function kb(e){let t=ed(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return tr(n)&&!Qn.has(n)}function Vs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Vs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Vs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(kb(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!Nb(t))return r;return[...r,...o]})}function Ob(e,t){let n=Bn(e);return n===void 0?void 0:t.get(n)}function pt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function Mb(e){if(pt(e.words[0],"git"))return pt(e.words[1],"commit");if(!pt(e.words[0],"gh")||!pt(e.words[2],"create"))return!1;return pt(e.words[1],"pr")||pt(e.words[1],"issue")}function Nb(e){return(pt(e.words[0],"cat")||pt(e.words[0],"tee")||Mb(e))&&!e.words.some(Ku)&&!e.redirections.some((n)=>Ku(n.target))}function Ku(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var td=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),nd=new Set([...td,"glob"]),Db=new Set([...nd,"pattern"]);class We extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function nr(e){let t=Lb(),n=An(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:Wb(e),store:t}}function pe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Xe(e,t){if(!e.includes("$"))return e;return Ei(e,t)}function Lb(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Me(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let f={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,f),f}let l=e.get(i);if(l)return l;let c=Yu(i,a);return e.set(i,c),c},getCommandProgram:r}}function Wb(e){let t=e.route.kind==="grep"?nd:e.route.kind==="glob"?Db:td;return[...El(e.input,t),...e.route.kind==="patch"?_l(e.input):[]]}var Gb=new Set(["-S","--suffix"]);function dn(e,t,n,r,o){if(e.status==="structural-limit")throw new We;if(e.status!=="complete")return o.findMalformedTarget(e.source);return vo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(me(i.target,s.variables),s)?i.target:null})}function Ro(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Gb.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Ae="Git metadata and hooks are protected. Ask the user before modifying them.";function ad(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(wr(e.invocation.toolName))return null;let a=e.paths.find((l)=>rd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=pe(e,"input-candidate");if(!i)return null;let s=dn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>$b(a,l,t,n,r),isRedirectionTarget:(a,l)=>rd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=_o(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Ys(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(f)=>c?xo(f,l):Fb(f,l);if(n.markerFiles.some(u))return!0;return r&&od(n).some(u)}if(Ys(a,n))return!0;return r&&od(n).some((c)=>xo(c,a))}function Fb(e,t){let n=sd(t,e);if(n===""||n.startsWith("..")||id(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function zb(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function Bb(e,t,n,r,o){if(!n)return!1;return Ys(_o(se(e,t,r,o)),n)}function rd(e,t,n,r,o,i){let s=_o(se(e,t,r,o));return i.includes(s)||cd(s,n)}function ld(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>xo(i,_o(se(s,t,r,o)))))}function Ys(e,t){return t.entries.includes(e)||t.directories.includes(e)||cd(e,t)}function cd(e,t){return t.hooksDirectories.some((n)=>xo(e,n))}function od(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function xo(e,t){let n=sd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!id(n)}function _o(e){return process.platform==="win32"?e.toLowerCase():e}function $b(e,t,n,r,o){if(er(e))return null;let i=Mt([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=Ro(i.slice(1)),a=s.sources.find((l)=>zb(me(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&Bb(me(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Io,normalize as Zb,parse as Xb,posix as yd,resolve as Wt,sep as Qs}from"node:path";import{isAbsolute as Ub,join as ud,normalize as md,parse as Hb,sep as dd}from"node:path";var jb=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Vb=` 	
+`;function rr(e,t){if(gt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Zs(e.get("TMPDIR")??"",t)}function Lt(e,t){if(e.has("TMPDIR"))return Zs(e.get("TMPDIR")??"",t);let n=Xs(e,t);if(n===void 0)return!0;return Zs(n,t)}function Xs(e,t){return gd(e,t,"TMPDIR")}function Zs(e,t){if(!e)return!1;if(qb(e))return!1;return fn(e,t)}function gt(e,t){let n=gd(e,t,"IFS");return n!==void 0&&n!==""&&n!==Vb}function fn(e,t){let n=wo(e,t.paths);if(n===null)return!1;return pd(t).some((r)=>To(n,r))}function Ao(e,t){let n=wo(e,t.paths);if(n===null)return!1;return pd(t).some((r)=>Po(r)===Po(n))}var fd=new WeakMap;function pd(e){let t=fd.get(e);if(t)return t;let n=Kb(e);return fd.set(e,n),n}function Kb(e){let t=jb.map((r)=>wo(r,e.paths)??md(r)),n=wo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&Yb(n))return[...t,n];return t}function qb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function gd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function Yb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function wo(e,t){try{let n=md(e);if(!Ub(n))return n;let r=Hb(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=ud(i,o[s]??"");if(t.entryKind(a)==="missing")return ud(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function To(e,t){let n=Po(e),r=Po(t);if(n===r)return!0;let o=r.endsWith(dd)?r:`${r}${dd}`;return n.startsWith(o)}function Po(e){return process.platform==="win32"?e.toLowerCase():e}var Jb=process.platform==="win32",hd=64,Qb=16384;function or(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return b(o.id,o.reason)}function ir(e){let t=au(e,hd,hd,Qb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:eS(e)}}function eS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>tS(e.raw,n.span.start-e.span.start))}function tS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Gt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??ye();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:aS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&cS(e))return{kind:"outside_anchored_cwd"};let o=!r&&bd(e,t.posixShell);if(at(e))return{kind:"outside_anchored_cwd"};if(ea(e,r))return{kind:"root_or_home_target"};if(rS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(oS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(lS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&mS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>pS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(gS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(nS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function nS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Io(r)||r.startsWith("~"))return!1;if(ta(r))return!1;if(Sd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return fn(Wt(t.resolvedCwd,r),t.environment)}function Cd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(sS(i))return!1;if(Ao(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Sd(r??i,s,t.environment.paths,t.budget))}function ea(e,t=!1){let n=e.trim(),r=yd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function rS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Io(o)?o:t.resolvedCwd?Wt(t.resolvedCwd,o):null;if(!i)return!1;let s=ge(F(i,t.environment.paths,t.budget));if(s===Xb(s).root)return!0;return s===ge(F(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function ge(e){let t=Zb(e);if(Jb){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function oS(e,t,n,r,o,i,s,a){let l=e.trim();if(ta(l))return!1;if(!r&&fn(l,a))return!0;return(t||i&&s)&&n&&!o&&iS(l,n)}function iS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!bd(e.slice(n.length+1),t)})}function sS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return yd.normalize(`/${t[1]??""}`)==="/"}function ta(e){return e.split(/[\\/]+/).includes("..")}function aS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Gn(o.trim(),t);if(!Io(i))return[];try{let s=F(i,n,r);if(Fn(s,F(t,n,r)))return[];return[ge(s)]}catch{return[]}})}function lS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(ta(r))return!1;let o=n?r:Gn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Io(o)?o:i?Wt(i,o):null;if(!s)return!1;try{let a=ge(F(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Qs)?l:`${l}${Qs}`))}catch{return!1}}function cS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function bd(e,t=!1){return e.includes("$")||e.includes("`")||uS(e)||t&&dS(e)}function uS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function dS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&fS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function fS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function mS(e,t,n,r){try{return ge(F(e,n,r))===ge(F(t,n,r))}catch{try{return ge(e)===ge(t)}catch{return!1}}}function pS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return ge(F(Wt(t,e),n,r))===ge(F(o,n,r))}catch{try{return ge(Wt(t,e))===ge(o)}catch{return!1}}}function gS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Js(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Js(Wt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Js(Wt(a,e),t,i,s)}catch{return!1}}function Js(e,t,n,r){try{return vd(F(e,n,r),F(t,n,r))}catch{return!1}}function Sd(e,t,n,r){if(!t)return!1;try{return vd(F(t,n,r),F(e,n,r))}catch{return!0}}function vd(e,t){let n=ge(e),r=ge(t);return n.startsWith(`${r}${Qs}`)||n===r}var hS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Ed="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",yS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Rd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",xd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",CS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",bS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",SS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:xd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Ae},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Rd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:CS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Ed},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:yS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Ed}};function _d(e,t,n,r=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return vS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function vS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=RS(o),s=o[i];if(!s||!hS.has(OS(s.text)))return null;let a=ES(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",bS);for(let l of a.targets)if(!at(l.text)&&ea(ra(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",xd);for(let l of a.targets)if(n.resolvedCwd&&Dt(ra(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return b("powershell.remove-item-git-metadata",Ae);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",Rd);for(let l of a.targets){let c=or(Ge(ra(l.text),n),n,r,SS);if(c)return c}return null}function ES(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(xS(l))continue;if(s){t.push(na(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=wS(l.text);if(!c){t.push(na(l)),i=i||l.dynamic;continue}if(PS(c.name)){let u=c.value?_S(c.value,l):e[++a];if(u?.kind==="word"){t.push(na(u)),i=i||u.dynamic;continue}i=!0;continue}if(AS(c.name)){n=!0;continue}if(TS(c.name)){r=!0;continue}if(IS(c.name))o=kS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function RS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function na(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function xS(e){return e.kind==="word"&&e.text===","}function ra(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function _S(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function wS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function PS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function AS(e){return"recurse".startsWith(e)}function TS(e){return e.length>=2&&"force".startsWith(e)}function IS(e){return e==="wi"||"whatif".startsWith(e)}function kS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function OS(e){return e.toLowerCase()}var mn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",ko="Unsupported heredoc syntax",wd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var MS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),NS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),DS=new Set(["-o","--output","--query","--subscription"]),LS=new Set;function Pd(e){if(e==="aws")return MS;if(e==="gcloud")return NS;if(e==="az")return DS;return LS}var WS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),GS=new Set;function Ad(e){if(e==="git")return be;if(e==="docker")return WS;return GS}function Je(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=de(e);for(let o of t){if(!BS(n,o.command))continue;if(o.match){if(FS(n,e,o.match))return Td(o);continue}if(!$S(n,e,o.subcommand))continue;if(HS(e,new Set(o.block_args),r))return Td(o)}return null}function Td(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function FS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return zS(r,n.command_path,Pd(e))}function zS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function BS(e,t){return e===M(t)}function $S(e,t,n){if(!n)return!0;return Id(t,1,n,Ad(e))}function Id(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&US(e,i,n,r))return!0;continue}return s===n}return!1}function US(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Id(e,t+2,n,r)}function HS(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var jS=new Set(["-e","--source"]),VS=new Set(["-F","-v","--assign","--field-separator"]),kd=new Set(["-f","--file"]),KS=new Set(["print","printf","return"]),Od=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],qS="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Md(e,t,n){let r=!1;for(let o of YS(e)){let i=ZS(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",qS):null}function ia(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&jS.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(VS.has(a)||kd.has(a))){let l=e[s+1];if(i&&=l!==void 0,kd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function ar(e){return ia(e).sources}function YS(e){return ar(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function ZS(e,t){Ee(t,e);let n=e.includes("system")?sa(e,t):null,r=XS(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function sa(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Mo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Nd(e,i+1);continue}if(s==="/"&&Dd(e,i)){i=Ld(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,sr(e[a-1])||sr(e[i]))continue;let l=Oo(e,i);if(e[l]!=="(")continue;l=Oo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Mo(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Oo(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function XS(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let m=Mo(e,i,u);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(u==="#"){i=Nd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Dd(e,i)){let m=Ld(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
+{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(oa(e,i,"print")||oa(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let f=e[i+1]==="&"?i+2:i+1,d=Oo(e,f);if(oa(e,d,"getline")){o=!0;let m=ev(s,l,c);if(r||=m===null,m!==null)n.push(m);c=f,i=f;continue}if(nv(s,a)){o=!0;let m=QS(e,d);if(!m){r=!0,c=f,i=f;continue}if(!JS(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=f,i++}if(!o)return null;return{dynamic:r,commands:n}}function sr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Oo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function JS(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Mo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=tv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function QS(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Mo(e,t,n)}function ev(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function tv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function oa(e,t,n){return e.startsWith(n,t)&&!sr(e[t-1])&&!sr(e[t+n.length])}function nv(e,t){return t!==null&&t>=e}function Nd(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Dd(e,t){let n=rv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(sr(e[r-1]))r--;return KS.has(e.slice(r,n+1))}function rv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Ld(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var ov=new Set(["sudo","env","command","builtin"]);function No(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=iv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function iv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&sv(a,r);if(l)i.push(s);if(!l&&Dr.has(M(a)))break;if(o)break}return i}function sv(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||Xi.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Oe(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return ov.has(e.toLowerCase())}function zt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Fe(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Do([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Do(e,t,n,r,o,i,s,a,l){let c=Co(e,t,n,i);for(let[m,p]of c.envAssignments)i.set(m,p),o.set(m,p);let{tokens:u,cwd:f}=c;if(c.envSplitValues){let m=yo(c.envSplitValues,u);if(!m)throw new N("derivedCommandShape");aa(a),yield*Do(m,t,f,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new N("wrapperPeelIterations");let d=No(u,s);if(d){for(let m of[d.childIndex,...d.alternativeChildIndices])aa(a),yield*Do(m===d.childIndex?d.tokens:[...u.slice(m)],t,f,r,new Map(o),new Map(i),s,a,!0);return}if(lv(u)){aa(a),yield*Do([...u.slice(1)],t,f,r,o,i,s,a,l);return}yield av(u,f,r,o,i,l)}function av(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function aa(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function lv(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function la(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function ze(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||ca(r,"recursive")){t=!0;continue}if(r==="-f"||ca(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Wd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>ca(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function ca(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var cv="find -delete permanently removes files. Use -print first to preview.",uv="find -exec rm -rf is dangerous. Use explicit file list instead.",dv=new Set(["-exec","-execdir","-ok","-okdir"]),fv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Gd(e,t){let n=e.map(w),r=mv(e,n,t);if(r)return r;if(Wo(n,1)&&!gv(e,n,t)){let s=A(b("find.delete",cv),t.policy);if(s)return s}let o=t.budget??ye(),i=0;while(i<n.length){let s=n[i],a=ht(s??"");if(a>0){i+=a+1;continue}if(!Qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=lr(n,i);i=l.nextIndex;let c=yv(l.tokens,t.environment);if(c){let m=A(c,t.policy);if(m)return m}let u=s==="-execdir"||s==="-okdir",f=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=f?.id.startsWith("custom.")?f:A(f,t.policy);if(d)return d}return null}function mv(e,t,n){if(!Wo(t,1)&&!ua(t,n.environment))return null;let o=Lo(e)??K(["."]),i=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=ir(s);for(let l of a.expandedTargets??[w(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Ae)}}if(pv(t)&&i.resolvedCwd&&ld(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return b("find.delete-git-metadata",Ae);return null}function ua(e,t){let n=0;while(n<e.length){if(!Qe(e[n])){n++;continue}let r=lr(e,n),o=Mt([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function pv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function gv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Lo(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Xs(o,n.environment),s=n.trustedTmpdirValue??Lt(o,n.environment),a=n.allowTmpdirVar??!rr(o,n.environment),l=Gt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??gt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=ir(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((f)=>Cd(f,l,{containmentTarget:hv(f,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function hv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Lo(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function yv(e,t){let n=mt([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&ze(n))return b("find.exec-rm-recursive-force",uv);return null}function lr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Wo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Qe(r)){n=lr(e,n).nextIndex;continue}let o=ht(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ht(e){return fv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Qe(e){return e!==void 0&&dv.has(e)}function cr(e){let t=Me(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Cv=5,da="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function zd(e,t,n){let r=Go(e,t,n),o=bv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Cv;a++){let{subcommand:l,rest:c}=Re(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let f=o.get(u),d=xv(f);if(d===null||d.length===0)return{blockedReason:da,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:da,expanded:!0,tokens:i}}function Bd(e,t,n){return Go(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Re(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=be.has(o)?2:1}return{subcommand:null,rest:[]}}function bv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Go(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=vv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Sv(e,t,n)]}}function Sv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=fa(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=fa(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Fd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Fd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(be.has(i)){o+=2;continue}o++}return r}function vv(e,t){let n=Ev(e,t),r=Rv(e,t);return{blockedReason:n===null||r===null?da:null,entries:[...n??[],...r??[]]}}function Ev(e,t){let n=Ze("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=cr(n);if(!o)return null;for(let i of o){let s=fa(i);if(!s)return null;r.push(s)}return r}function Rv(e,t){let n=Lu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ze(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ze(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function fa(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Fd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ze(e.slice(r+1),t,n)}}function xv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return cr(t)}var _v="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",wv="git checkout --force discards uncommitted changes. Use 'git stash' first.",Pv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Av="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Tv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",Iv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",kv="git switch --force discards uncommitted changes. Use 'git stash' first.",Ov="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Mv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Nv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Dv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Lv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Wv="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Gv="git push --force destroys remote history. Use --force-with-lease for safer force push.",Fv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",zv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Bv="git branch -D force-deletes without merge check. Use -d for safe delete.",$v="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",Uv="git merge --abort discards merge conflict resolutions. Use 'git status' first.",Hv="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",jv="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Vv="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",Kv="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",qv="git worktree remove --force can delete uncommitted changes. Remove --force flag.",Yv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Zv=new Set(["--recurse-submodules","--track","-t"]),ma=new Set(["-b","-B","-U"]),pa=new Set(["-c","-C"]),Xv=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var pn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Ud(e){let{subcommand:t,rest:n}=Re(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return yt(Jv(n));case"switch":return yt(Qv(n));case"restore":return yt(tE(n));case"reset":return rE(n);case"clean":return yt(iE(n));case"rm":return yt(sE(n));case"push":return Bt(aE(n));case"branch":return Bt(uE(n));case"stash":return Bt(gE(n));case"worktree":return Bt(hE(n));case"rebase":return yt(dE(n));case"merge":return yt(fE(n));case"tag":return Bt(mE(n));case"reflog":return Bt(pE(n));default:return null}}function yt(e){return e?{...e,localDiscard:!0}:null}function Bt(e){return e?{...e,localDiscard:!1}:null}function Jv(e){let{index:t,before:n}=ie(e),r=de(n,{shortOptsWithValue:ma});if(n.some((i)=>O(i,"--force"))||r.has("-f"))return b("git.checkout-force",wv);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(O(i,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",Av)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return b("git.checkout-ref-path",Pv);return b("git.checkout-double-dash",_v)}if(eE(e).length>=2)return b("git.checkout-ambiguous",Tv);return null}function Qv(e){let{before:t}=ie(e);if(t.some((r)=>O(r,"--discard-changes")))return b("git.switch-discard-changes",Iv);let n=de(t,{shortOptsWithValue:pa});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return b("git.switch-force",kv);return null}function eE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(Yv.has(r)){n+=2;continue}if(Zv.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function tE(e){let t=nE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",Mv):b("git.restore-unstaged",Ov)}function nE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(Xv.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function rE(e){let t=null;for(let n of e){if(O(n,"--hard")){t=b("git.reset-hard",Nv);break}if(O(n,"--merge")){t=b("git.reset-merge",Dv);break}}if(!t)return null;return oE(e)?Bt(t):yt(t)}function oE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function iE(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return b("git.clean-force",Lv);return null}function sE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",Wv):null}function aE(e){let{before:t,after:n}=ie(e),r=de(t);if(t.some((s)=>O(s,"--mirror")))return b("git.push-mirror",zv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||$d(t,n).some(lE))return b("git.push-force",Gv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||$d(t,n).some(cE))return b("git.push-delete",Fv);return null}function $d(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function lE(e){return e.startsWith("+")||e.includes(":+")}function cE(e){return e.length>1&&e.startsWith(":")}function uE(e){let{before:t}=ie(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return b("git.branch-force-delete",Bv);return null}function dE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.rebase-abort",$v):null}function fE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.merge-abort",Uv):null}function mE(e){let{before:t}=ie(e);return de(t).has("-d")||t.some((r)=>O(r,"--delete"))?b("git.tag-delete",Hv):null}function pE(e){return e[0]==="delete"?b("git.reflog-delete",jv):null}function gE(e){for(let t of e){if(t==="drop")return b("git.stash-drop",Vv);if(t==="clear")return b("git.stash-clear",Kv)}return null}function hE(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",qv);return null}import{dirname as LE,isAbsolute as WE,join as of,resolve as GE}from"node:path";var ha="TMPDIR",ya="IFS",jd=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Vd=/^[A-Za-z_][A-Za-z0-9_]*$/,Kd=new Set(["export","typeset","declare","readonly"]),yE=new Set(["builtin","command","time"]),qd=new Set(["do","then","else"]),CE=new Set(["do","then","case"]),Hd=new Set(["done","fi","esac"]),bE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Yd(e,t){return e.map((n)=>n.provenance==="variable"&&tf(n.text)?ur(n.text,t.shellAssignments):w(n))}function ur(e,t){return e.replace(bE,(n,r,o)=>t.get(r??o??"")??n)}function Zd(e,t){return{env:e,effectiveEnvAssignments:RE(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Xd(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ca(e,t){let n=Qd(e,t),r=e[0]??"";if(CE.has(r))t.bodyDepth+=1;if(r==="elif"||Hd.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(Hd.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);ba(t,a)});let o=n.commandIndex;if(o!==-1&&Kd.has(e[o]??""))e.filter((a)=>Vd.test(a)&&ga(a)).forEach((a)=>{xE(t,a)});let i=o===-1?-1:ef(e,o);if(i===-1||e[i]!=="unset")return;let s=wE(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(qd.has(r)){t.shellAssignments.set(a,"");return}_E(t,a)})}function Jd(e,t){let n=Qd(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Qd(e,t){let n=qd.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!tf(a)),o=r!==-1&&Kd.has(e[ef(e,r)]??""),i=EE(t);return{assignments:e.flatMap((a,l)=>{let c=SE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!po(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function ef(e,t){let n=t;while(yE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function tf(e){return Pe(e)!==null||jd.test(e)}function SE(e,t,n){return Pe(e)??vE(e,t,n)}function vE(e,t,n){let r=go(e,n,t);if(r)return r;let o=e.match(jd)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function ga(e){return e===ha||e===ya||Us(e)}function EE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function RE(e,t){let n=[ha,ya].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ba(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function xE(e,t){ba(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function _E(e,t){if(!ga(t)&&!Vd.test(t))return;if(e.shellAssignments.set(t,""),po(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!ga(t)||t===ha||t===ya||Mn(t)){ba(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function wE(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as PE}from"node:path";function Fo(e,t){return $s.some((n)=>t?.has(n)||e.has(n))}function zo(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(PE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=nf(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=nf(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=be.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function nf(e,t,n){try{let r=ft(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function rf(e,t,n){if(!t.localDiscard||!n.worktreeMode||Fo(n.environment.env,n.envAssignments))return null;let r=zo(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Sa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Sa(e,t,n){let{subcommand:r,rest:o}=Re(e),i=r?.toLowerCase();if(t.dynamicArguments||AE(o)||ME(e,t.environment.env,t.envAssignments,n)||kE(o)||TE(i,o))return!0;return i==="clean"&&OE(o)>1}function AE(e){return e.some((t)=>/[$*?[]/.test(t))}function TE(e,t){if(e==="checkout"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:ma}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:pa}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||IE(s))||r.has("-C");return o&&i}return!1}function IE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function kE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function OE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function ME(e,t,n,r){if(Ze("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Go(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>DE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||NE(s.value);if(Gu(n))return!0;return r.recursiveSubmodules}function NE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function DE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function sf(e,t,n){let r=e.map(w),o=n.environment.paths,i=zo(r,n.cwd,o),s=n.originalCwd?o.realpath(GE(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Fo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?zE(e,n.shellAssignments,o):af(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!FE(a,r,t,n)||!fn(a,n.environment)||Ao(a,n.environment)||To(s,a)||To(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function FE(e,t,n,r){let o=r.environment.paths,i=of(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!Sa(t,r,s)}function zE(e,t,n){let r=Re(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?ur(a,t??new Map):a;if(!WE(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function af(e,t){if(t.entryKind(of(e,".git"))!=="missing")return e;let n=LE(e);return n===e?null:af(n,t)}var BE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",$E=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Bo(e,t){return lf(e,t)}function lf(e,t,n){let r=e.map(w),o=zd(r,t.environment.env,t.envAssignments),i=o.blockedReason?A(b("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Wu(t.envAssignments)||Bd(r,t.environment.env,t.envAssignments))&&UE(s))return b("git.ssh-env",BE);let a=Ud(s);if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=rf(r,a,t)??sf(e,a,t);if(!l)return a;return n?.(l),null}function cf(e,t){let n=null;return{match:lf(e,t,(o)=>{n=o}),relaxation:n}}function UE(e){let{subcommand:t,rest:n}=Re(e),r=t?.toLowerCase();if(!r)return!1;if($E.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&HE(n)}function HE(e){return e.find((t)=>!jE(t))?.toLowerCase()==="update"}function jE(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as wR}from"node:path";function uf(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function $o(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var df="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",VE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",KE="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",mf="rm -rf targeting root or home directory is extremely dangerous and always blocked.",qE="rm -rf in home directory is dangerous. Change to a project directory first.",ff={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:mf},git_metadata_target:{id:"rm.git-metadata",reason:Ae},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:KE},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:qE},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:df},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:VE},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:df}};function Uo(e,t){let n=Gt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=ze(r),i=Wd(r),s=ZE(e);for(let a of s){let l=ir(a.word);if(o&&l.unsafeBraceExpansion){let c=A(or({kind:"outside_anchored_cwd"},n,t.policy,ff),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=Ce(c),f={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return b("rm.git-metadata",Ae);if(i&&!o){let d=Ge(u,n,f);if(d.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",mf);if(d.kind==="git_metadata_target")return b("rm.git-metadata",Ae);continue}if(!o)continue;for(let d of YE(u,n,f)){let m=or(d,n,t.policy,ff),p=A(m,t.policy);if(p)return p}}}return null}function YE(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function ZE(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},$t={kind:"dynamic"},XE=new Set(["<","<<","<<-","<<<","<&","<>"]),gf=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,JE=/^(?:[0-9]+|[@*])$/,QE=dt.maxWords,eR=dt.maxInputLength;function hf(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Wo(e){let t=lr(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(Go))return Bt;return{kind:"literal",source:n.map(w).join(" ")}}function Jd(e){let t=lr(e[1])==="--"?2:1,n=e[t],r=lr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!Go(n))return Bt;return{kind:"literal",source:r}}function Fo(e,t){let n=ME(e);if(n===-1)return Ct;let r=NE(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=LE(s,e,n,r.ifs);if(!a)return Bt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>IE||i>kE)return Bt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(FE)].filter((s)=>s!==null).join(" ")}}function Qd(e,t,n,r){if(!Se(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&AE.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Bt;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?Bt:{kind:"literal",source:r}}function et(e){let t=Se(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=lr(n);return io(n,r)?{kind:"literal",source:r}:Bt}var OE=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ma(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||we(s)!==null)return!1;let a=k(M(s));return!OE.has(a)&&!J.has(a)&&!Ft(a)}function ME(e){return Se(e.map(w)).commandIndex??-1}function NE(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(DE);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function DE(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function LE(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?ua(o):WE(o,r);if(e.parameter==="*"){let a=ua(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:da(l,r)}let i=t[n+1+e.parameter];if(i&&!Go(i))return;let s=lr(i);return e.quoted?[s]:da(s,r)}function ua(e){return e.every(Go)?e.map(w):void 0}function WE(e,t){let n=ua(e);if(!n)return;let r=n.map((o)=>da(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function da(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Ho(e){let t=dr(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(Vo))return $t;return{kind:"literal",source:n.map(w).join(" ")}}function yf(e){let t=dr(e[1])==="--"?2:1,n=e[t],r=dr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!Vo(n))return $t;return{kind:"literal",source:r}}function jo(e,t){let n=nR(e);if(n===-1)return Ct;let r=rR(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=iR(s,e,n,r.ifs);if(!a)return $t;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>QE||i>eR)return $t;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(aR)].filter((s)=>s!==null).join(" ")}}function Cf(e,t,n,r){if(!Se(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&XE.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return $t;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?$t:{kind:"literal",source:r}}function et(e){let t=Se(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=dr(n);return ao(n,r)?{kind:"literal",source:r}:$t}var tR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function xa(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=k(M(s));return!tR.has(a)&&!J.has(a)&&!Ft(a)}function nR(e){return Se(e.map(w)).commandIndex??-1}function rR(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(oR);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function oR(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function iR(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?va(o):sR(o,r);if(e.parameter==="*"){let a=va(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Ea(l,r)}let i=t[n+1+e.parameter];if(i&&!Vo(i))return;let s=dr(i);return e.quoted?[s]:Ea(s,r)}function va(e){return e.every(Vo)?e.map(w):void 0}function sR(e,t){let n=va(e);if(!n)return;let r=n.map((o)=>Ea(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ea(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Go(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function lr(e){return e?w(e):""}function FE(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function pa(e,t){return fa(Oe(e,"posix"),t)}function ur(e){return pa(e,new Set(Array.from(e.matchAll(Zd)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function fa(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(fa(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>fa(o,n))||ef(r.words,n))return!0;UE(r,n)}return!1}function ef(e,t){let n=e.findIndex((s)=>we(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(cr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Yd(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Se(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Yd(s[l],t)}let i=GE(e,n,t);if(i===null)return!1;if(i===-1)return!0;return ef(e.slice(i),t)}function GE(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return zE(e,t+1);if(r==="exec")return BE(e,t+1);if(r==="env")return $E(e,t+1,n);return null}function zE(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function BE(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function $E(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return cr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return cr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(we(i))continue;return r}return null}function UE(e,t){if(!e.words.every((n)=>we(n.text)!==null))return;for(let n of e.words){let r=we(n.text);if(!r)continue;if(cr(n,t))t.add(r.name)}}function cr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Zd)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(TE.test(o)||t.has(o))}))}function Yd(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||cr(e,t))}var HE=["--init-file","--rcfile"],jE=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function tt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return tf(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=tf(e,t,!1);if(r!==null)return r}}return null}function nt(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Se(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function tf(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function nf(e){let t=k(e[0]??"").toLowerCase(),n=VE(e,t),r=jE.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function VE(e,t){let n=Se(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?HE.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let d=l.split("=",1)[0]??l;if(t==="bash"&&Ui.has(d)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Hi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var ga="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ha="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",KE="__CC_SAFETY_NET_XARGS_INPUT__",zo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Bo="rm",qE=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,YE=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,ZE=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,XE=/^(?:[0-9]+|[@*])$/;function sf(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=$t(n),i=n.slice(r),s=b("xargs.shell-dynamic",ha);if(QE(i,o,t)&&A(s,t.policy))return A(s,t.policy);for(let a of Fe(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?A(s,t.policy):null;if(c)return c;let f=df(l,o,a.wrapperEnvAssignments),d=a.head==="rm"&&o!==null&&cf(l,o),u=t.analyzeChild(l,{...Gt(a,t),dynamicInput:f,dynamicSourceInput:d||lf(l,a.head,o,a.wrapperEnvAssignments,f,t.environment),dynamicRmInput:d,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",ga)});if(u)return u;let m=JE(l,o,t.policy?.rules??[],A(s,t.policy));if(m)return m;if(a.head==="git"){let h=o===null?[...l,KE]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...Gt(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=Je(l,t.policy?.rules??[]);if(p)return p}return null}function JE(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function af(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=jd(e,r,t.length,n);return o===null?[]:[o]}function lf(e,t,n,r,o,i){if(J.has(t)){if(nt(e))return!1;if(n!==null&&eR(e,n))return!0;let s=tt(e);if(!s){let a=et(K(e));if(a.kind==="literal")return n!==null&&a.source.includes(n);return a.kind==="none"&&o}if(n!==null&&s.includes(n))return!0;if(Ye(s))return!0;return tR(s,n,r)}if(ke(t))return rf(e,n,uo,Pu(t));if(_e.has(t))return rf(e,n,ea,Pd);if(t==="eval"){let s=Wo(K(e));if(s.kind==="dynamic")return!0;if(n!==null)return s.kind==="literal"&&s.source.includes(n);return o}if(t==="find")return nR(e,n,i);if(t==="git"){let s=ze(e);return n===null?s.subcommand===null:(s.subcommand?.includes(n)??!1)||s.subcommand!==null&&mn.has(s.subcommand.toLowerCase())&&uf(s.rest,n).some((a)=>a.includes(n))}return!1}function rf(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,zo]).sources.some((a)=>a.value===zo);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${zo}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${zo}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>af(l,t,a))));return Do(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function QE(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Fe(e,n),(i)=>i.head)),o=t===null?[...e,Bo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Bo));return Array.from(Fe(o,n)).some((i)=>i.head===Bo&&!r.has(Bo))}function cf(e,t){return uf(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function uf(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function df(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function eR(e,t){let n=Se(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return af(i,t,o).some((l)=>{let c=e.map((d,u)=>u===s?d.replaceAll(t,l):d),f=Se(c);if(f.commandIndex===null&&f.scriptIndex===null)return!1;if(n.commandIndex===null&&f.commandIndex!==null)return!0;if(n.scriptIndex===null&&f.scriptIndex!==null)return!0;if(f.commandIndex!==null&&(c[f.commandIndex]??"").includes(l))return!0;return f.scriptIndex!==null&&(c[f.scriptIndex]??"").includes(l)})}))}function tR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(qE))if(of(o,r))return!0;for(let o of e.matchAll(YE))for(let i of(o[1]??"").matchAll(ZE))if(of(i,r))return!0;return pa(e,r)}function of(e,t){let n=e[1]??e[2];return n!==void 0&&(XE.test(n)||t.has(n))}function nR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Qe(s)){let l=sr(e,i);i=l.nextIndex-1;for(let c of Fe(l.tokens,{environment:n,cwd:void 0})){let f=df(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&cf(c.tokens,t)||lf(c.tokens,c.head,t,c.wrapperEnvAssignments,f,n))return!0}continue}let a=ht(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function $t(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var dr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",fr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",oR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",iR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Uo=/\{[^{}\s]*\}/g,ff=/\{\}|\{-?\d+\}/g,sR=["e","f","source","file","-e","-f","--source","--file"],aR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],lR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),cR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),mf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),uR=new Set(["--workdir","--wd"]),pf="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ae(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function bf(e){return Ae([...e],(t)=>Ye(t))}function Sf(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=pn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Tf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:f,dryRun:d}=o;if(c){let p=pn(t);if(p)return p;let h=bf(t.envAssignments?.values()??[]);if(h)return h}if(l){let p=hR(t);if(p)return p}if(f!==void 0&&a){let p=pn(t);if(p)return p}let u=yR(f,t.cwd,t.environment.paths);if(u===null){let p=pn(t);if(p)return p}let m=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(d){if([...Fe(i,m)].flatMap((h)=>[...h.envAssignments.values()]).some(ba)){let h=pn(t);if(h)return h}return null}if(i.length===0){let p=s.map((g)=>g[0]??"");t.budget.charge("derivedTokens",p.length);let h=xf(m.envAssignments,m.cwd,a);return Ae(p,(g)=>t.analyzeNested(g,h))}return Ae(Fe(i,m),(p)=>dR(p,o,t,m))}function dR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(Pf)){let g=pn(n);if(g)return g}let f=bf(c);if(f)return f;let d=c.some(F),u=i||d,m=a&&u,p=xf(e.envAssignments,e.wrapperCwd,s||m);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Ae(o,(E)=>n.analyzeChild($o(l,E,n.budget),Gt(e,r)))};if(nt(l))return g();let y=tt(l);if(y){if(Af(y)){let R=bt(n);if(R)return R;if(o.length===0)return null;return Ae(o,(P)=>n.analyzeNested(yf(y,P,n.budget),p))}if(F(y)){if(o.length>0)return Ae(o,(q)=>n.analyzeNested(yf(y,q,n.budget),p));let R=ar(y);if(R?.[0]&&M(R[0])==="rm"&&Ge(R)){let q=hf(n);if(q)return q}let P=R?n.analyzeChild(R,{...Gt(e,r),dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",fr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",dr)}):null;if(P)return P;return n.analyzeNested(y,p)}let E=!d&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((R)=>Fo(K(R===void 0?l:i?l.map((P)=>_f(P,R)):[...l,...R]),y)):[];if(E.some((R)=>R.kind==="dynamic")){let R=bt(n);if(R)return R}let S=E.flatMap((R)=>R.kind==="literal"?[R.source]:[]);if(S.length>0)return n.budget.charge("derivedTokens",S.length),Ae(S,(R)=>n.analyzeNested(R,p));if(ur(y)){let R=bt(n);if(R)return R}let T=n.analyzeNested(y,p);if(T)return T;if(u)return bt(n);return null}let v=et(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&F(v.source))return bt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=bt(n);if(E)return E;let S=g();if(S)return S;if(i)return null;let T=o.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return n.budget.charge("derivedTokens",T.length),Ae(T,(R)=>n.analyzeNested(R,p))}if(u||a)return bt(n)??g();return null}if(e.head==="rm"&&Ge(l)){if(i&&o.length>0)return Ae(o,(y)=>ya($o(l,y,n.budget,ff),e.cwd,r));if(o.length>0)return Ae(o,(y)=>ya(Cf(l,y,n.budget),e.cwd,r));let g=ya(l.flatMap((y,v)=>{if(v===0||!F(y))return[y];return y.startsWith("-")?[y.replace(ff,"")]:[]}),e.cwd,r);if(g)return g;return hf(n)}let h=o.length>0?o:[void 0];return Ae(h,(g)=>{let y=g===void 0?l:i?$o(l,g,n.budget):Cf(l,g,n.budget),v=b("parallel.shell-dynamic",fr),E=a&&e.head==="find"?gR(y,r):null,S=Ef(y,a,n)??E?.customResult??null,T=M(e.head),R=a&&(T==="rm"&&Ca(y)||T==="xargs"&&Rf(y)||E?.rmOptions===!0),P=a&&(R||E?.executedSource===!0||E===null&&vf(y,T)),q=n.analyzeChild(y,{...Gt(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:R,dynamicSourceInput:S!==null||P,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",dr)});if(P){let Z=A(v,n.policy);if(Z)return Z}return q??S??Je(y,n.policy?.rules??[])})}function vf(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return pR(e);if(t==="git")return fR(e);if(t==="find")return!0;if(_e.has(t))return gf(e,sR,ir);if(ke(t))return gf(e,aR,co);return!1}function Ca(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||Af(o)))}function fR(e){if(mR(e))return!0;let t=ze(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!mn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function mR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function pR(e){if(nt(e))return!1;let t=tt(e);if(t!==null)return F(t);let n=et(K(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function gf(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,pf]).some((o)=>o.value===pf);return Do(r,t,(o)=>n(e.map((i)=>_f(i,[o]))))}function Ef(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return bt(n);return Ae(o,(i)=>Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function gR(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of Fe(i,t))n.executedSource||=vf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ca(a.tokens)||a.head==="xargs"&&Rf(a.tokens),n.customResult??=Ef(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Qe(a)){i=[],n.executedSource||=F(a);continue}let l=ht(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function Rf(e){let t=e.slice($t(e).childStart);return M(t[0]??"")==="rm"&&Ca(t)}function Ho(e,t){return(n)=>A(b(e,t),n.policy)}var bt=Ho("parallel.shell-dynamic",fr),hR=Ho("parallel.command-stream-dynamic",oR),pn=Ho("parallel.command-stream-dynamic",iR),hf=Ho("parallel.rm-recursive-force-dynamic",dr);function ya(e,t,n){return A(Lo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Lt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function xf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function _f(e,t){return e.replace(Uo,(n)=>wf(n,t))}function $o(e,t,n,r=Uo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=wf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function yf(e,t,n){return $o([e],t,n)[0]??""}function Cf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function wf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(Uo)!==-1}function Pf(e){if(ba(e))return!0;for(let t of e.matchAll(Uo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function ba(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Af(e){return/^\{[^{}\s]*\}$/.test(e)}function yR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!rR(e))return null;try{return ft(t??e,e,n)}catch{return null}}function Tf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ra(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ra(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||cR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(mf.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=mf.has(p)?2:1;continue}if(uR.has(y)){c=!0;let E=v??h;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(lR.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?ba:Pf);let f=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){f.push(p),p=[];continue}if(g!==void 0)p.push(g)}f.push(p)}c||=f.length>1;let d=CR(f),u=n.some(F),m=n.length===0&&o===-1;return{template:n,jobs:d,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:m,unsupported:c,workdir:a,dryRun:l}}function CR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function If(e){return Tf(e).childStart}var bR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",jo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function va(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Sa(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Of(e,t,n,r,o=!1,i){let a=(Fn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",bR):null;return A(a,i)??Mf(e,t,n,o,i)}function Mf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>va(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=on(e,t),l=vR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((d)=>d<=l))return A(b("shell.dynamic-structure",jo),o);if(A(No(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),f=a.findIndex((d,u)=>u>l&&w(d)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&mn.has(c)&&i.some((d)=>d>l&&(f===-1||d<f)))return A(b("shell.dynamic-structure",jo),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&ER(t)?A(b("shell.dynamic-structure",jo),o):null;if(s==="rm"){let a=t.findIndex((c,f)=>f>0&&w(c)==="--"),l=Ge(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?A(b("shell.dynamic-structure",jo),o):null}if(s==="xargs")return kf(e,t.slice($t(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return kf(e,t.slice(If(t.map(w))),"parallel",n,r,o);return null}function kf(e,t,n,r,o,i){if(t.length===0)return null;let s=SR(t,r);if(Fn(e,s)){let l=A(b(`${n}.shell-dynamic`,n==="xargs"?ha:fr),i);if(l)return l}let a=Mf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>va(l)&&Sa(l)))return A(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?ga:dr),i);return null}function SR(e,t){let n=Ot(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function vR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(be.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function ER(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=va(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Sa(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Sa(s)))return!0;continue}if(t=!0,a)return!0;let l=ht(s.text);if(l>0){n=l;continue}if(Qe(s.text))o=!0,r=!0}return!1}function Ea(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!io(t[n.tokenIndex],n.value)})}var RR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",xR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",_R="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Nf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",RR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",xR);if(e==="shred"&&n.length>0)return b("shred.target",_R);return null}var Lf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Lo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>No(e.words,Ra(e))},{heads:new Set(["find"]),analyze:(e)=>Md(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>sf(e.words,{...Df(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Sf(e.words,{...Df(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})}];function Df(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ut(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Ra(e){return{environment:e.options.environment,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var zf="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function Bf(e){return Lf.find((t)=>t.heads.has(e))?.analyze}function hn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,f=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,d=s?s.originalCwd:c?void 0:n.cwd,u=po(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let m=Ot(u.words,n.environment,f,new Map([...n.envAssignments??[],...u.envAssignments])),p=m.envSplitValues??[];if(p.length>0){let x=[...p,...i(m.words)].join(" "),I=Ye(x);if(I)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:I.reason}),ue(I);if(n.strict)return he(r);let L=go(p,i(m.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:m.cwd===void 0?n.effectiveCwd:m.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments])});if(te)return te}}let h=m.rewritten?K(i(m.words)):on(o,m.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>h.length){let x=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments]),E=g[0];if(!E)return null;if(Ft(E))throw new N("wrapperPeelIterations");let S=M(E),T=m.cwd===null?void 0:m.cwd??f,R=m.cwd===null?void 0:d,P=m.cwd===void 0?n.effectiveCwd:m.cwd,q=s?s.allowTmpdirVar:!tr(v,n.environment),Z=Of(o,m.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),ue(Z);let ee=To(g,n.policy);if(ee){for(let x of[ee.childIndex,...ee.alternativeChildIndices]){Wf(y.wrapperNormalizationBudget);let I=h.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=hn(I,t,{...y,effectiveCwd:P,envAssignments:v});if(L)return L}return null}let X=l?void 0:S==="eval"?Wo(h):S==="trap"&&!a?Jd(h):void 0;if(a&&s&&S==="eval"){if(X?.kind==="dynamic")return gn(s,n.policy);if(X?.kind==="literal"){let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v});if(x)return x}return yn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!ma(n.commandView)))return he(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:S==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?J.has(S):Uf(E,S)){if(nt(g))return null;if(a&&s){let x=tt(g);if(x){if(s.dynamicSourceInput??s.dynamicInput){let L=gn(s,n.policy);if(L)return L}if(ur(x)){let L=gn(s,n.policy);if(L)return L}return n.analyzeNested(x,{effectiveCwd:P,envAssignments:v})}let I=et(h);if(I.kind==="dynamic")return gn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?gn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?gn(s,n.policy):null}if(l){let x=tt(g),I=x?n.analyzeNested(x,{effectiveCwd:P,envAssignments:v}):et(h).kind==="dynamic"?he(r):null;if(I)return I}if(s===void 0){let x=TR(g,v,P,n,r,t);if(x)return x;let I=tt(g);if(I){let Kt=Fo(h,I);if(Kt.kind==="dynamic")return he(r);let ui=Kt.kind==="literal"?Kt.source:I,Qa=IR(ui);r?.recordSegment({type:"shell-wrapper",wrapper:S,innerCommand:Qa}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Qa,depth:t+1});let el=n.analyzeNested(ui,{effectiveCwd:P,envAssignments:v});if(el)return el;return ur(ui)?he(r):null}let L=et(h);if(L.kind==="dynamic")return he(r);if(L.kind==="literal")return Ko(L.source,P,v,n,r,t);let te=Qd(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return he(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:P,envAssignments:v})}}if(!s&&(S==="source"||S===".")){let x=g[1]==="-p"?2:null;if(x!==null){let Kt=n.commandView?h[x]:void 0;if(!Kt)return null;if(Kt.provenance!=="literal")return he(r)}let I=x===null?1:3,L=g[I]==="--"?I+1:I,te=n.commandView?h[L]:void 0;if(!te)return null;if(te.provenance==="literal")return Ko(te.text,P,v,n,r,t);if(n.strict||!n.commandView||!ma(n.commandView))return he(r)}if(_e.has(S)&&!l){if(!s&&n.strict&&Ea(ir(g),h))return he(r);let x=Ad(g,(L)=>Ut(n.analyzeNested(L,{effectiveCwd:P,envAssignments:v}))),I=A(x,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),ue(I)}if(ke(S)&&!l){if(!s&&n.strict&&Ea(co(g),h))return he(r);let x=wu(g);if(a&&s)return PR(S,x,P,v,n,s);if(x){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:S,codeArg:x,paranoidBlocked:I}),I){let te=A(b("interpreter.one-liner-paranoid",Vn),n.policy);if(te)return ue(te)}if(Ns(S,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let L=n.analyzeNested(x,{effectiveCwd:P,envAssignments:v});if(L&&!$f(L,x))return L;if(Kn(x)){let te=A(b("interpreter.dangerous-command",ln),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:ln}),ue(te)}r=void 0}}if(S==="busybox"&&g.length>1)return Wf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),hn(h.slice(1),t,{...y,effectiveCwd:P,envAssignments:v});let D=s?null:A(Nf(S,g),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),ue(D);let le=r===y.trace?y:{...y,trace:r},xe={words:h,head:S,cwd:T,originalCwd:R,envAssignments:v,allowTmpdirVar:q,dynamicArguments:m.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:P,options:le,analyzeChildTokens:(x,I)=>a&&s?xa(x,t,le,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ut(hn(K(x),t+1,{...le,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:v}))??Je(x,le.policy.rules),analyzeChild:(x,I)=>xa(x,t,le,I)},je=s&&(S==="xargs"||S==="parallel")?void 0:Bf(S);if(S==="rm"||S==="xargs"||S==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let Te=r&&S==="git"?Hd(xe.words,Ra(xe)):void 0,li=Ff(Te?Te.match:je?.(xe)??null,n.policy);if(r)kR(xe,li,Te?.relaxation??null);if(li)return ue(li);if(a&&s&&(S==="rm"||S==="rmdir")){if(!(S==="rm"&&(Ge(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?yn(s,n.policy):null)??AR(s,n.policy)}let Xa=je!==void 0,Ja=!s&&!Xa&&!Mr.has(S),ci=r&&Ja?[]:void 0;if(Ja)for(let x=1;x<g.length;x++){let I=g[x];if(!I)continue;ci?.push(I);let L=Ff(wR(g,x,t,le,T,R,P,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:ci??[],embeddedCommandFound:M(I)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:ci??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&Xa)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let vr=Je(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!vr,reason:vr?.reason}),vr)return ue(vr);return a&&s?yn(s,n.policy):null}function xa(e,t,n,r){return Ut(hn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function wR(e,t,n,r,o,i,s,a){for(let l of Fe(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let f=M(c);if(Uf(c,f)||Bf(f)!==void 0&&f!=="xargs"&&f!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=xa(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!tr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function PR(e,t,n,r,o,i){if(!t)return yn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=A(b("interpreter.one-liner-paranoid",Vn),o.policy);if(a)return ue(a)}if(Ns(e,t))return yn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!$f(s,t))return s;if(Kn(t)){let a=A(b("interpreter.dangerous-command",ln),o.policy);if(a)return ue(a)}return yn(i,o.policy)}function $f(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(wo)||e.reason===fn)&&!Nr(t)}function gn(e,t){let n=e.shellDynamicMatch?A(e.shellDynamicMatch,t):null;return n?ue(n):null}function yn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?A(e.dynamicSourceMatch,t):null;return n?ue(n):null}function AR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?A(e.rmDynamicMatch,t):null;return n?ue(n):null}function TR(e,t,n,r,o,i){let s=nf(e);if(s.argvSource?.kind==="absent")return he(o);if(s.argvSourceApplies&&s.argvSource){let l=Ko(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Ko(a,n,t,r,o,i,!0)}function Ko(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return he(o);let a=jn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?he(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function IR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function kR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function Wf(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function he(e){return e?.recordSegment({type:"error",message:zf}),ue(OR())}function OR(){return{id:"",reason:zf,intent:"stop_and_explain"}}function Uf(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function Ff(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:A(e,t)}var MR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,NR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function DR(e,t){let n=Vf(e,t);if(n.length===0)return!1;let r=n[jf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return MR.test(e.join(" "))}function Hf(e,t,n,r){if(e.dialect==="powershell"){let a=LR(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return Gf(zR(a.target),t,n.paths)}let o=e.words.map(w);if(!DR(o,n))return;if(!t)return null;let i=Vf(o,n,t),s=jf(i);if(s===-1||i[s]!=="cd")return null;return Gf(i[s+1],t,n.paths)}function Gf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return BR(ft(t,e,n),t,n)?t:null}catch{return null}}function LR(e,t){let n=WR(e[0])?1:0,r=e[n];if(!FR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!NR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return GR(e.slice(n+1),t)}function WR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function FR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function GR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function zR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function jf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Vf(e,t,n){let r=$R(e);return mt([...r],t,n)}function BR(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return Vo(e)===Vo(t);return Vo(r)===Vo(o)}function $R(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var wa="TMPDIR",Pa="IFS",Kf=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,qf=/^[A-Za-z_][A-Za-z0-9_]*$/,Yf=new Set(["export","typeset","declare","readonly"]),UR=new Set(["builtin","command","time"]);function Zf(e,t){return{env:e,effectiveEnvAssignments:qR(e,t),shellAssignments:new Map}}function Xf(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function Aa(e,t){let n=Qf(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),Ta(t,s)});let r=n.commandIndex;if(r!==-1&&Yf.has(e[r]??""))e.filter((s)=>qf.test(s)&&_a(s)).forEach((s)=>{YR(t,s)});let o=r===-1?-1:em(e,r);if(o===-1||e[o]!=="unset")return;let i=XR(e,o);if(i===null)return;e.slice(i).forEach((s)=>{ZR(t,s)})}function Jf(e,t){let n=Qf(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Qf(e,t){let n=e.findIndex((s)=>!HR(s)),r=n!==-1&&Yf.has(e[em(e,n)]??""),o=KR(t);return{assignments:e.flatMap((s,a)=>{let l=jR(s,o,t.env);if(!l)return[];if(n!==-1&&a>n&&!r&&!fo(l.name))return[];return o.set(l.name,l.value),[{...l,persists:n===-1||r}]}),commandIndex:n}}function em(e,t){let n=t;while(UR.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function HR(e){return we(e)!==null||Kf.test(e)}function jR(e,t,n){return we(e)??VR(e,t,n)}function VR(e,t,n){let r=mo(e,n,t);if(r)return r;let o=e.match(Kf)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function _a(e){return e===wa||e===Pa||Ws(e)}function KR(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function qR(e,t){let n=[wa,Pa].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Ta(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function YR(e,t){Ta(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function ZR(e,t){if(!_a(t)&&!qf.test(t))return;if(e.shellAssignments.set(t,""),fo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!_a(t)||t===wa||t===Pa||kn(t)){Ta(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function XR(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var JR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Ht="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Na(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Oe(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((f)=>f.code.includes("heredoc"));if(c){if(!n.strict)return Ma(e,n);let f=`${wo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:f}),{reason:f,segment:e,intent:"stop_and_explain"}}return sm(e,n),{reason:fn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return sm(e,n),{reason:fn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Ma(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Zf(n.environment.env,n.envAssignments);return Zo(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function Zo(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let f=e.nodes[l+1],d=f?.kind==="connector"?f.operator:void 0,u=QR(e,l,c,a,d),m=a==="&&"||a==="||",p=m?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=m||bn(d);if(c.kind==="function"){let Z=h.flatMap((X)=>{let U=mr(X);return U.functionDefinitions.set(c.name,c.body),Ia(X,[U],u,d==="&",bn(d))}),ee=ka(Z,[],g,y,a,d);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of h){let D=Zo(c.body,t,n,r,[mr(U)]);if(D.result)return D;if(Z.push(...Ia(U,D.states,u,d==="&",bn(d))),v)ee.push(U,...u?D.states.map((le)=>qo(U,le)):D.states)}let X=ka(Z,ee,g,y,a,d);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),S=e.nodes[l-2],T=Xo(a)&&S?.kind==="command"?Xd(S)??tx(S):void 0,R=[],P=[];for(let Z of h){let ee=nx(c,t,n,r,[mr(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>qo(Z,U));for(let U of X){let D=mr(U),le=ix(c,t,n.trace?{...n,trace:am(n.trace,E)}:n,r,D,Xo(a),T);if(le)return{result:le,states:i};let xe=Cx(c,D.functionDefinitions);if(xe)n.budget.charge("derivedTokens",Jo(xe));let je=xe?t+1>=V.recursionDepth.cap?Oa(c.displayText,n,[D]):Zo(xe,t+1,n,r,[D]):{result:null,states:[D]};if(je.result)return je;if(R.push(...Ia(Z,je.states,u,d==="&",bn(d))),v)P.push(Z),P.push(...je.states.map((Te)=>u?qo(Z,Te):Te))}}let q=ka(R,P,g,y,a,d);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function QR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(Xo(r)||Xo(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&ex(e,t)}function Ia(e,t,n,r,o){let i=n?t.map((a)=>qo(e,a)):[...t],s=o?i.flatMap((a)=>Cn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function qo(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function ex(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(rx(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Xo(e){return e==="|"||e==="|&"}function tx(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function bn(e){return e==="&&"||e==="||"}function ka(e,t,n,r,o,i){let s={success:Yo([...n,...e]),failure:Yo([...r,...t])},a=bn(i)?s:void 0;return{states:bn(o)||a?Yo([...s.success,...s.failure]):s.success,conditionalStates:a}}function am(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function nx(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=ox(e);if(s){if(t+1>=V.recursionDepth.cap)return Oa(s,n,o);let a=Oe(s,"powershell");if(a.status==="limited")return Oa(s,n,o);if(a.status!=="complete")return tm(i,n,r,o);n.budget.charge("derivedTokens",Jo(a)),i.push({program:a,depth:t+1})}}return tm(i,n,r,o)}function rx(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function tm(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=Zo(i.program,i.depth,t,n,[mr(a)]);if(l.result)return l;s.push(...l.states)}o=Yo(s)}return{result:null,states:o}}function ox(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function Jo(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+Jo(o),0):n.kind==="group"||n.kind==="function"?Jo(n.body):0),0)}function Oa(e,t,n){return t.trace?.recordSegment({type:"error",message:$e}),{result:{reason:$e,segment:e,intent:"stop_and_explain"},states:[...n]}}function ix(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=fx(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};lm(e,o,"before-consumer",a.environment.paths,a.budget);let c=on(e.dialect,e.words).map(w),f=e.displayText,d=Jf(c,o.shellGitContextState);if(e.dialect==="powershell"){let p=A(Sd(e,i,Sx(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!p,reason:p?.reason}),p)return bx(f,p)}if(c.length===1&&c[0]?.includes(" ")&&!Fn(e.dialect,e.words)){let p=A(Ye(c[0]),a.policy),h=p!==null&&!a.strict&&vu(e,a.rootProgram);if(p&&!h)return a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!0,reason:p.reason}),{reason:p.reason,segment:f,ruleId:p.id,intent:p.intent};a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!1});let g=nm(e,l,o,d,s,a);if(g)return g;return Aa(c,o.shellGitContextState),null}let u=hn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:d,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(p,h)=>{let g=h&&Object.hasOwn(h,"effectiveCwd")?h.effectiveCwd:o.effectiveCwd,y=Na(p,t+1,{...a,effectiveCwd:g,envAssignments:h?.envAssignments??d,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:h?.functionDefinitions,worktreeMode:h?.worktreeMode??a.worktreeMode,trace:a.trace?am(a.trace,a.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(u)return{...u,segment:f};let m=nm(e,l,o,d,s,a);if(m)return m;return Aa(c,o.shellGitContextState),null}function nm(e,t,n,r,o,i){let s=mx(e,t,n,r??new Map,i);if(s)return s;return lm(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),lx(e,t,n,i.environment.paths,i.budget),hx(e,n,o,i.environment,i.trace),null}var sx=new Set([">>","<>"]);function lm(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?ax(s):sx.has(s.operator)))continue;rm(s.target,t,r,o)}if(n!=="before-consumer"||!Re(e.words[0],"tee"))return;let i=cm(e.words.slice(1));if(!i)return;for(let s of i.operands)rm(s,t,r,o)}function ax(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function rm(e,t,n,r){let o=e?.provenance==="literal"?jn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function lx(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!Qo(i))return;for(let s of cx(e)){let a=jn(s.text,n.effectiveCwd,r,o);if(!a||!xu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function cx(e){let t=dx(e.redirections)?.target,n=om(t)?[t]:[];if(Re(e.words[0],"cat"))return ux(e.words)?n:[];if(!Re(e.words[0],"tee"))return[];let r=cm(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(om))return[];return[...r.operands,...n]}function ux(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function dx(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function cm(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&Re(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function om(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function Re(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Qo(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function fx(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return Ht;let n=t[0];if(!n?.heredoc)return Ht;if(!Qo(n.heredoc))return JR;if(n.fd!==void 0&&n.fd!==0)return Ht;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return Ht;let r=e.redirections.some((s)=>s!==n&&im(s.target));if(Re(e.words[0],"cat"))return r?Ht:void 0;if(Re(e.words[0],"tee"))return r||e.words.slice(1).some(im)?Ht:void 0;let o=e.words[0],i=e.words[1];if(Re(o,"git")&&(Re(i,"apply")||Re(i,"commit")))return;if(Re(o,"gh")&&(Re(i,"pr")||Re(i,"issue"))&&Re(e.words[2],"create"))return;return Ht}function im(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function mx(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(gx(e,i,n,r,o))return null;let a=px(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Ma(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function px(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Qo(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!ke(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=A(b("interpreter.one-liner-paranoid",Vn),n.policy);if(c)return c}if(!Kn(s))return null;let l=A(b("interpreter.dangerous-command",ln),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function gx(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Qo(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Ot(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return nt(a)}function hx(e,t,n,r,o){let i=Hf(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function mr(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Xf(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function Yo(e){let t=[];for(let n of e){if(!t.some((r)=>yx(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function yx(e,t){return e.effectiveCwd===t.effectiveCwd&&Cn(e.shellGitContextState.env,t.shellGitContextState.env)&&Cn(e.literalHeredocFiles,t.literalHeredocFiles)&&Cn(e.functionDefinitions,t.functionDefinitions)&&Cn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Cn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function Cn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function Cx(e,t){let n=Gn(e);return n===void 0?void 0:t.get(n)}function bx(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function Sx(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Ma(e,t){let n=A(Ye(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function sm(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:fn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var vx=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function um(e,t,n,r){let o=Na(e,0,{...t,...Uc(t),budget:t.budget??ye(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function dm(e,t,n){try{return{decision:e()}}catch(r){let o=Ex(r,t,n);if(!o)throw r;return o}}function Ex(e,t,n){if(!(e instanceof N)||!vx.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var Rx=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),La=new Set(["cc-safety-net","ccsn"]),xx=new Set(["bunx","npx","pnpx"]),_x=new Set(["pnpm","yarn"]),wx=new Set(["npm","pnpm","yarn"]),Px=new Set(["bun","node"]);function ti(e,t,n={}){if(La.has(e))return 0;if(xx.has(e)){if(n.broad)return Da(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return ei(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&wx.has(e)&&n.broad&&t[r]==="exec"){let o=Da(t.slice(r+1));return o===null?null:r+1+o}if(_x.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&ei(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Da(t.slice(r+1));return o===null?null:r+1+o}if(Px.has(e)){let o=n.broad&&r!==-1?r:0;if(fm(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&fm(t[o+1]))return o+2}return null}function Da(e){let t=e.findIndex((r)=>ei(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!ei(r))break;n++}return n}function ei(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return La.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return La.has(e.slice(0,t))}function fm(e){let t=e?.replaceAll("\\","/");return[...Rx].some((n)=>t===n||t?.endsWith(`/${n}`))}var mm="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function pm(e,t,n){let r=pe(e,"input-candidate");if(!r)return null;let o=un(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>Ax(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function Ax(e,t){let n=mt([...e],t),r=n.slice(1),o=ti(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ni}from"node:path";var Cm="This path contains the protected policy config and you must not modify or delete it.",Tx=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function bm(e,t,n){let r=Dx(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return gm(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=pe(e,"input-candidate");if(e.invocation.route.kind==="command")return o?hm(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=hm(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return gm(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||xr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function gm(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>pr(a,n,r,o,i));return s?{target:s}:null}function hm(e,t,n,r,o){let i=un(e,t,r,o,{findSegmentTarget:(s,a)=>Ix(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>pr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>Nx(s,t,n,r,o)?.target??null});return i?{target:i}:null}function Ix(e,t,n,r,o){if(Jn(e))return null;let i=Mt([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&kx(a)){let l=Ox(a).find((c)=>ym(me(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Oo(i,1)||ia(i,r)){let c=(ko(K(i))??K(["."])).find((f)=>{let d=me(f.text,t.variables);return pr(d,t.cwd,n,r,o)||ym(d,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=vo(a).sources.find((c)=>Lx(me(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(Mx(i,s))return null;for(let l of[...e,...i])for(let c of Sm(l))if(pr(me(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function kx(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function Ox(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function Mx(e,t){if(!Tx.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function Nx(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Sm(i))if(pr(s,t,n,r,o))return{target:s};return null}function Sm(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function Dx(e,t,n){let r=(a)=>gr(ie(a,e.executionCwd,t,n)),o=r(Jt(t)),i=[r(Mn(e.executionCwd)),r(Mn(e.configCwd))],s=new Set(i.map((a)=>ni(a)));for(let a=ni(o);;a=ni(a))if(s.add(a),ni(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function pr(e,t,n,r,o){let i=cl(e,t,r,o,(s)=>gr(s)===kr);return i!==null&&n.files.has(gr(i))}function ym(e,t,n,r,o){return n.directoriesAndAncestors.has(gr(ie(e,t,r,o)))}function Lx(e,t,n,r,o){let i=gr(ie(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function gr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ri,posix as Wx,resolve as ii,win32 as Fx}from"node:path";import{fileURLToPath as Gx}from"node:url";var Im="Access to a sensitive path is not allowed.",km=new Set(["echo","printf"]),zx=new Set(["find"]),Bx=new Set(["-exec","-execdir"]),$x=new Set([";","+"]),Ux=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),Hx=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Om=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),jx=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),Vx=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Mm=new Set(["-c","-e","-r","-E","--eval","--exec"]),Kx=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),qx=new Set(["grep","rg"]),vm=new Set(["jq","gojq","jaq"]),Em="f",Rm="file",Yx="files",Zx=new Set(["e","f"]),Xx=new Set(["regexp","file"]),Jx=new Set(["e","f","A","B","C","m"]),Qx=new Set(["regexp","file","after-context","before-context","context","max-count"]),Wa="__CC_SAFETY_NET_PIPE_INPUT__",Ga=/[\w./~@+-]*[./~][\w./~@+-]*/g,e_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,t_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,n_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,r_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,o_=/\b(?:system|exec)\s*$/,i_=/\b(?:eval|exec)\s*\(/g,s_=/\b(?:eval|exec)\s*$/,a_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function xm(e,t,n,r,o,i){for(let s of e){let a=s.target;if(iw(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=rw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&sw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Nm(e,t,n,r,o={}){let i=_m(e,n,r),s=xm(i,t,e.invocation.context.configCwd,n,r);if(s===null)return null;let a=s.ruleId!=="secret.deny-path"&&o.strict===!1?_m(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:xm(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&l_(e,n))return null;return l}function l_(e,t){let n=pe(e,"input-candidate")??pe(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of So(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(Xe(a.text,t))}let o=St(r);if(o.length===0)return!1;let i=it(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>Ux.has(a))}function _m(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=pe(e,"input-candidate");return[...s?Sn(s.shell,e.store,r,t,o,n,c_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function c_(e){return e.program.dialect==="powershell"}function Sn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Le;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...G_(Xe(e.source,r),t,n,r,o,i)],l=(c)=>Xe(S_(c,s),r);return bo(e,o,r,i,{word:l,segment:(c,f,d,u,m)=>{if(c.length===0)return null;if(a.push(...si(c,t,n,r,f.cwd,i,m)),d!==null)a.push(...d_(d,c,t,n,r,f.cwd,i));return null},redirection:(c,f)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Dm(c.consumer,[c.body],t,n,r,f.cwd,i,(d)=>f_(c.consumer??[],d,t,n,r,f.cwd,i)));if(c.targetOrder==="legacy-segment")return Bs;return a.push({target:l(c.target),cwd:f.cwd}),null}}),a}function za(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Le;return s.status==="complete"?Sn(s,t,n,r,o,i):null}function si(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(vm.has(it(St(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...si(p,t,n,r,o,i)]}let l=b_(e).map(a),c=St(e);if(c.length===0)return l;let f=c[0]??"",d=it(f).toLowerCase(),u=c.slice(1),m=u_(f,d,u);if(m)return[...l,...m.map(a)];if(km.has(d))return n.capturedOutput===!0?[...l,...Lm(e).map(a)]:l;if(d==="eval")return[...l,...za(u.join(" "),t,n,r,o,i)??u.map(a)];if(d==="export")return[...l,...u.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:ot(d,p)).map(a)];if(d==="git")return[...l,...E_(u).map(a)];if(vm.has(d))return[...l,...v_(u).map(a)];if(qx.has(d))return[...l,...K_(u).map(a)];if(zx.has(d))return[...l,...w_(u,t,n,r,o,i).map(a)];if(_e.has(d))return[...l,...u.flatMap((p)=>ot("awk",p)).map(a),...u.flatMap((p)=>A_(p,t,n,r,o,i)),...u.flatMap(T_).map(a)];if(d==="curl")return[...l,...u.flatMap((p)=>ot(d,p)).map(a),...R_(u).map(a)];if(Qn(d)){let p=Xn.has(d)?Se([d,...u]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new Le;if(h.status==="complete")return[...l,...Sn(h,t,n,r,o,i),...u.slice(p.commandIndex).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...P_(d,u,t,n,r,o,i)]}return[...l,...u.flatMap((p)=>ot(d,p)).map(a)]}function u_(e,t,n){let r=ti(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function d_(e,t,n,r,o,i,s){if(h_(t,n,r,o,i,s))return Lm(e).map((a)=>({target:a,cwd:i}));return Dm(t,m_(e),n,r,o,i,s,()=>[])}function f_(e,t,n,r,o,i,s){let a=St(e);if(!Qn(it(a[0]??"").toLowerCase()))return[];return za(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Dm(e,t,n,r,o,i,s,a){let l=y_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>Xn.has(l)?Sn(n.getShellSyntax(c),n,r,o,i,s):oi(l,c,n,r,o,i,s))}function Lm(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase();if(!km.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Ba(r.replaceAll("%%","%"))];return t.slice(1)}function m_(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return p_(r);return[]}function p_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ba(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>g_(t,r.slice(i*n,(i+1)*n)))}function g_(e,t){let n=0;return Ba(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ba(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function h_(e,t,n,r,o,i){let s=St(e);if(s.length===0||it(s[0]??"").toLowerCase()!=="xargs")return!1;let a=$t(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,f=c===null?[...l,Wa]:l.map((d)=>d.split(c).join(Wa));return si(f,t,n,r,o,i).some((d)=>d.target.includes(Wa))}function y_(e){let t=St(e);if(t.length===0)return null;let n=it(t[0]??"").toLowerCase();if(!Qn(n))return null;return C_(n,t.slice(1))?n:null}function C_(e,t){let n=$a(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Mm.has(o)||Wm(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(a_.get(n)?.has(o))r++;continue}return!1}return!0}function $a(e){return/^python\d/.test(e)?"python":e}function b_(e){let t=[];for(let n of e){if(Gm(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var wm=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function S_(e,t){if(!t||!wm.test(e))return e;return`~${e.replace(wm,"").replace(/\\/g,"/")}`}function ot(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function v_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>ot("jq",i))}return e.flatMap((r,o)=>o===t?[]:ot("jq",r))}function E_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>ot("git",i))];if(t.push(...ot("git",r)),!be.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:ot("git",o)),n++}return t}function R_(e){return e.flatMap((t,n)=>{let r=__(t);if(r!==null)return Pm(r.flag,r.value);let o=x_(e[n-1]);return o===null?[]:Pm(o,t)})}function Pm(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Fa(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Fa(t.slice(n+1))}return t.startsWith("@")?Fa(t.slice(1)):[]}function x_(e){if(e===void 0)return null;if(Om.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function __(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Om.has(r)?{flag:r,value:e.slice(n+1)}:null}function Fa(e){return e===""||e==="-"?[]:[e]}function w_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!Bx.has(e[l]??""))continue;let c=e.slice(l+1),f=c.findIndex((m)=>$x.has(m)),d=f===-1?c:c.slice(0,f),u=si(d,t,n,r,o,i).map((m)=>m.target);if(a.push(...u.filter((m)=>m!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,h)=>{if(!Hx.has(m))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function P_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Mm.has(c)||Wm(e,c)){let d=t[l+1];if(d!==void 0)a.push(...oi(e,d,n,r,o,i,s)),l++;continue}let f=/^--(?:eval|exec)=(.*)$/.exec(c);if(f!==null&&f[1]!==void 0){a.push(...oi(e,f[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Wm(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return Kx.get(t[t.length-1]??"")?.has($a(e))??!1}function A_(e,t,n,r,o,i){if(!e.includes("system"))return[];return ta(e)?.commands.flatMap((s)=>Sn(t.getShellSyntax(s),t,n,r,o,i))??[]}function T_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function I_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Ua),...e.match(Ga)??[]]}function oi(e,t,n,r,o,i,s){let a=(m)=>({target:m,cwd:i}),l=O_(t,k_(e));if(l===null)return I_(t).map(a);let c=l.masked.match(r_)!==null||l.literals.some((m)=>o_.test(l.masked.slice(0,m.start))),f=l.masked.match(i_)!==null||l.literals.some((m)=>s_.test(l.masked.slice(0,m.start))),d=r.refineInlineData===!0&&!Xn.has(e),u=d&&!(L_(l.masked)||c||f)?[]:l.literals;return[...u.map((m)=>m.text).filter((m)=>m!=="").map(a),...u.flatMap((m)=>Ua(m.text)).map(a),...d?[]:l.literals.flatMap((m)=>m.text.match(Ga)??[]).map(a),...c?l.literals.flatMap((m)=>za(m.text,n,r,o,i,s)??[a(m.text)]):[],...f?l.literals.flatMap((m)=>oi(e,m.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
-`:h),n,r,o,i,s)):[],...(l.masked.match(Ga)??[]).map(a)]}function k_(e){let t=$a(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function O_(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(t_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&D_(e,o))return null;let a=t==="python"?M_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,f=N_(e,c,l);if(f===null)return null;let d=e.slice(c,f);if(/[fF]/.test(a)&&d.includes("{"))return null;if(t==="simple"&&s==='"'&&n_.test(d))return null;r.push({start:c,text:d});for(let u=o;u<f+l.length;u++)n[u]=" ";o=f+l.length-1}return{masked:n.join(""),literals:r}}function M_(e,t){return e_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function N_(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function D_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function L_(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(jx.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>Vx.has(i)))continue;if(o.length>1)return!0;if(W_(e,r)===".")return!0;if(F_(e,r+n.length)==="(")return!0}return!1}function W_(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function F_(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function G_(e,t,n,r,o,i){return H_(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Sn(a,t,{...n,capturedOutput:!0},r,o,i),...z_(a,r)?B_(a,r).map((l)=>({target:l,cwd:o})):[]]})}function z_(e,t){let n=So(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||it(Xe(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Xe(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function B_(e,t){return So(e).flatMap((n)=>n.kind==="word"?[Xe(n.text,t)]:n.kind==="redirection"&&n.target?[Xe(n.target,t)]:[]).flatMap(Ua)}function Ua(e){let t=U_(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||$_(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function $_(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function U_(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function H_(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Nn(o,n))continue;if(Fm(e,r,n)){let i=j_(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=V_(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function j_(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Nn(i,n))continue;if(Fm(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function V_(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Fm(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function K_(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let f=/^--([^=]+)(?:=(.*))?$/.exec(c);if(f!==null){let d=f[1]??"",u=f[2];if(d===Yx)o=!0;if(Xx.has(d))r=!0;if(u!==void 0){if(d===Rm)t.push(u);continue}if(Qx.has(d)){let m=e[l+1];if(d===Rm&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let d=c.slice(1),u="",m="";for(let h=0;h<d.length;h++){let g=d[h]??"";if(Zx.has(g))r=!0;if(Jx.has(g)){u=g,m=d.slice(h+1);break}}if(u==="")continue;if(m.length>0){if(u===Em)t.push(m);continue}let p=e[l+1];if(u===Em&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function St(e){let t=e.findIndex((n)=>!Gm(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Gm(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var q_=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Y_=".env.",Z_=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),X_=[".env.example.",".env.sample."];function J_(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Q_(e){return e.length>0&&!/\s/.test(e)}function ew(e,t,n,r){try{let o=Cr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof N)throw o;return!1}}var tw=new Set(["node_modules","__pycache__"]),nw=[["vendor","bundle"],["vendor","cache"]];function rw(e,t,n,r,o){if(J_(e))return null;let i=He(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>Q_(s)||ew(e,t,r,o);if(Z_.has(s)||X_.some((u)=>s.startsWith(u)))return null;let c=B(cw(e,t,r,o));for(let u of Qi){let m=`~/${u.suffixParts.join("/")}`;if((Tm(a,m)||Tm(c,m))&&rt(u.id,n))return u.id}let f=ow(i,t,n,r,o);if(f)return f;if(q_.has(s))return null;for(let u of Ji)if(s===u.basename&&rt(u.id,n))return u.id;if(s.startsWith(Y_)&&rt(Fr.id,n)&&l())return Fr.id;for(let u of es)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let m=s.slice(u.prefix.length)[0];if((m==="-"||m==="_")&&rt(u.id,n)&&l())return u.id}for(let u of ts)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&rt(u.id,n))return u.id}if(aw(a))return null;if(!s.includes(".")&&Dn.pattern.test(s)&&rt(Dn.id,n))return Dn.id;let d=lw(s,n);if(d)return d;return null}function ow(e,t,n,r,o){return Gr.find((i)=>{if(!rt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||yr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,He("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||hr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ae(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ae(z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ae(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?yr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,He(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||hr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||hr(e,s,["credentials"])||hr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ae(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((f)=>yr(e,f,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?z(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ae(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ae(z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?yr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((f)=>W(e,He(f,t,r,o),l))}case"secret.cli.pi":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=He("~",t,r,o);return[ae(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ae(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||hr(e,ae(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ae(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ae(He("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((f)=>W(e,f,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?yr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ae(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ae(z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,He("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&jt(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,He("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Am=new WeakMap;function z(e,t,n,r,o){let i=Am.get(o)??new Map;Am.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=He(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>zm(e,ae(t,r)))}function hr(e,t,n){return n.some((r)=>jt(B(e),B(ae(t,r))))}function yr(e,t,n,r,o){return zm(e,He(t,n,r,o))}function zm(e,t){return B(e)===B(t)}function ae(e,...t){return Be([e,...t].filter(Boolean).join("/"))}function iw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Cr(e,t,o,i));return n.some((a)=>jt(s,B(Cr(a,r,o,i))))}function sw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Cr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Be(G(Ce(a),o.paths,i)):"",c=B(l),f=o.env.get("CC_SAFETY_NET_HOME"),d=B(f?Be(G(ii(Ce(f)),o.paths,i)):l&&Be(G(`${l}/.cc-safety-net`,o.paths,i)));if(d&&jt(s,d))return!1;return n.some((u)=>{let m=B(Cr(u,r,o,i));if(!m)return!1;if(c&&(c===m||c.startsWith(m.endsWith("/")?m:`${m}/`)))return!1;return jt(s,m)})}function aw(e){let t=e.split("/");return t.some((n)=>tw.has(n))||nw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function lw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ns)if(r===o.extension&&rt(o.id,t))return o.id;for(let o of rs)if(o.pattern.test(r)&&rt(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function rt(e,t){return!t?.disabledRules?.includes(e)}function He(e,t,n,r){let{home:o,normalized:i}=Ha(e,n,r);if(!i)return"";if(!o)return i;let s=ja(i,o),a=ri(s)?s:Be(ii(t,s)),l=Be(G(a,n.paths,r));if(!jt(l,o)){if(ri(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Tm(e,t){return e===t||e.startsWith(`${t}/`)}function cw(e,t,n,r){let{home:o,normalized:i}=Ha(e,n,r);if(!i||!o)return"";let s=ja(i,o),a=Wx.normalize(ri(s)?s:Be(ii(t,s))),l=Be(Ce(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,f=[o,l].find((u)=>u!==""&&jt(c(a),c(u)));if(f===void 0)return"";let d=a.slice(f.length);return d?`~${d}`:"~"}function Cr(e,t,n,r){let{home:o,normalized:i}=Ha(e,n,r);if(!i)return"";let s=o?ja(i,o):i;return Be(G(ri(s)?s:ii(t,s),n.paths,r))}function Ha(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Be(G(Ce(r),t.paths,n)):"",i=Be(Ce(uw(Xe(e,t))));return{home:o,normalized:i}}function uw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return Gx(e)}catch{return e}}function ja(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ae(t,e.slice(2));return e}function dw(e){if(process.platform==="win32")return!0;return Fx.parse(e).root.length>1}function Be(e){let t=e.trim(),n=(t.includes("\\")&&dw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function it(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Vt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var fw={findPolicyMutation:bm,findGitMetadataMutation:td,resolveGitMetadata:mw,loadPolicySnapshot:$c,findSensitiveTarget:Nm,analyzeCommand:um,getModes:Pi};function Bm(e,t){let n={...fw,...t.dependencies},r=hw(e),o=br(e)?e.command:r,i=vt("policy-protection",o,()=>er(e)),s=pe(i,"input-candidate"),a=pe(i,"declared-command");if(br(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:$e,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:vd,intent:"stop_and_explain"}};let l=ye(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),f=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(f){let E=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Cm,intent:"hard_stop",evidence:{command:E,segment:f.target}}}}let d=vt("policy-protection",o,()=>pm(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:mm,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let u=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Pe,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...pw(m)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:br(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:Im,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!br(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Va("command-validation",o),...g};let v=vt("command-analysis",o,()=>dm(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},gw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function mw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function pw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function gw(e){return pe(e,"declared-command")?.program}function hw(e){try{return wn(e.input)}catch(t){let n=br(e)?e.command:void 0;throw new Vt("policy-protection",Va("policy-protection",t instanceof Ve?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Vt(e,Va(e,r instanceof Ve?void 0:t,r),r)}}function Va(e,t,n){let r=n instanceof N||n instanceof Le;return{stage:e,decision:{kind:"deny",reason:r?fi:En,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function br(e){return e.route.kind==="command"}import{appendFileSync as Tw,mkdirSync as Iw}from"node:fs";import{isAbsolute as kw,join as Ya}from"node:path";import{lstatSync as Um,readdirSync as yw,readFileSync as Cw,rmdirSync as bw,statSync as Hm,unlinkSync as Sw,utimesSync as vw,writeFileSync as Ew}from"node:fs";import{join as Sr}from"node:path";function $m(e,t={}){return Kr(Jt(e,t),e.home).policy.audit.retention_days}var qa=86400000,Rw=".last-prune",xw=/^\d{4}-\d{2}$/,_w=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,jm=(e)=>Math.floor(e/qa);function Km(e,t,n=()=>new Date){try{let r=n().getTime();if(!Hm(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Sr(t,Rw),i=Hm(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&jm(i)===jm(r))return;let s=r-$m(e)*qa,a=new Date(r).toISOString().slice(0,7);for(let l of Ka(t)){if(l.isDirectory()){ww(Sr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))Pw(Sr(t,l.name),s)}Ew(o,"",{mode:384}),vw(o,r/1000,r/1000)}catch{}}function ww(e,t,n){for(let r of Ka(e)){if(!r.isDirectory()||!xw.test(r.name))continue;let o=Sr(e,r.name);for(let i of Ka(o)){if(!i.isFile())continue;let s=_w.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+qa;if(!Number.isFinite(a)||a>=t)continue;qm(Sr(o,i.name))}if(r.name!==n)Vm(o)}Vm(e)}function Pw(e,t){try{let n=Um(e);if(n.mtimeMs>=t)return;let r=Cw(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(Aw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Um(e).mtimeMs!==n.mtimeMs)return;qm(e)}catch{}}function Aw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Ka(e){try{return yw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function qm(e){try{Sw(e)}catch{}}function Vm(e){try{bw(e)}catch{}}var Ow="2.4.2",Mw=1e4,Nw=2000,Dw=256,Lw=32768;function Ww(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function Fw(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Za(e,t,n,r,o,i,s={}){let a=Ww(t);if(!a)return;let l=zw(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),f=ai(st(n),s.failureStage?Number.POSITIVE_INFINITY:Mw),d=ai(st(r),Nw),u=s.toolName?ai(st(s.toolName),Dw):void 0,m=i===null?void 0:ai(st(i),Lw),p=Ya(l,Fw(m?.value??null),c.slice(0,7));Iw(p,{recursive:!0,mode:448});let h=Ya(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Ti)(),v:Ow,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:f.value,segment:d.value,...f.truncated||d.truncated||u?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};Tw(h,`${JSON.stringify(g)}
-`,{encoding:"utf-8",mode:384}),Km(e,l,s.now)}catch{}}function ai(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function Gw(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&kw(n)?n:null}function zw(e){let t=Gw(e);return t?Ya(t,".cc-safety-net","logs"):null}function Zm(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Ym(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Ym(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Ym(e){return"command"in e?e.command??"":""}function Xm(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Za(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Jm(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Za(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function ep(e,t,n){try{let r=Bm(t,{environment:e,...n.guard});return Qm(e,t,r,n),r}catch(r){if(!(r instanceof Vt))throw r;throw Qm(e,t,r.evaluation,n,!(r.cause instanceof Ve),{stage:r.stage,errorCode:Bw(r.cause)}),r}}function Qm(e,t,n,r,o=!0,i){Xm(e,Zm(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function Bw(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Ve)return"tool-input-limit";if(e instanceof Le)return"structural-shell-syntax-limit";return"unexpected-error"}function Et(e,t={}){return{malformed:!0,denial:Rn(t),cwd:e}}function tp(e,t={}){return(n,r)=>{try{return $w(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Rn())}}}function $w(e,t,n,r){let o=Ml();if(n.cancelled?.(t))return n.block(Rn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Jm(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let f=nl(l,{includeEvidence:c});return f?n.block(f):n.allow};try{let l=ep(o,i,{guard:{auditAllowed:Nl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Vt))throw l;if(xt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${ol(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var np="exec",Uw=new Set(["auto","gateway"]);function rp(e){e.on("before_tool_call",Hw(e),{matcher:[np],priority:50})}function Hw(e,t={}){return tp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>jw(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>qw(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function jw(e,t,n,r){if(!e||typeof e!=="object")return Et(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Et(null);if(o!==np)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Et(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Et(null,{toolName:o});if(s.host!==void 0&&!Uw.has(s.host))return Et(null,{command:a,toolName:o});let l=Vw(n,t.agentId,r);if(!l)return Et(null,{command:a,toolName:o});let c=Kw(l,s,r);if(!c)return Et(l,{command:a,segment:typeof s.workdir==="string"?s.workdir:void 0,toolName:o});return Pn(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function Vw(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return Si(".",[r],n)}catch{return}}function Kw(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return Si(r,[e],n)}function qw(e){return{block:!0,blockReason:rl(e)}}var HD={...tl,register:rp};export{HD as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Vo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function dr(e){return e?w(e):""}function aR(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function _a(e,t){return Ra(Me(e,"posix"),t)}function mr(e){return _a(e,new Set(Array.from(e.matchAll(gf)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Ra(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Ra(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Ra(o,n))||bf(r.words,n))return!0;fR(r,n)}return!1}function bf(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(fr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return pf(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Se(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&pf(s[l],t)}let i=lR(e,n,t);if(i===null)return!1;if(i===-1)return!0;return bf(e.slice(i),t)}function lR(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return cR(e,t+1);if(r==="exec")return uR(e,t+1);if(r==="env")return dR(e,t+1,n);return null}function cR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function uR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function dR(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return fr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return fr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function fR(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(fr(n,t))t.add(r.name)}}function fr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(gf)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(JE.test(o)||t.has(o))}))}function pf(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||fr(e,t))}var mR=["--init-file","--rcfile"],pR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function tt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Sf(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Sf(e,t,!1);if(r!==null)return r}}return null}function nt(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Se(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Sf(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function vf(e){let t=k(e[0]??"").toLowerCase(),n=gR(e,t),r=pR.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function gR(e,t){let n=Se(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?mR.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let f=l.split("=",1)[0]??l;if(t==="bash"&&Yi.has(f)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Zi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var wa="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Pa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",hR="__CC_SAFETY_NET_XARGS_INPUT__",Ko="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",qo="rm",yR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,CR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,bR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,SR=/^(?:[0-9]+|[@*])$/;function xf(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Ut(n),i=n.slice(r),s=b("xargs.shell-dynamic",Pa);if(ER(i,o,t)&&A(s,t.policy))return A(s,t.policy);for(let a of Fe(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?A(s,t.policy):null;if(c)return c;let u=Tf(l,o,a.wrapperEnvAssignments),f=a.head==="rm"&&o!==null&&Pf(l,o),d=t.analyzeChild(l,{...zt(a,t),dynamicInput:u,dynamicSourceInput:f||wf(l,a.head,o,a.wrapperEnvAssignments,u,t.environment),dynamicRmInput:f,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",wa)});if(d)return d;let m=vR(l,o,t.policy?.rules??[],A(s,t.policy));if(m)return m;if(a.head==="git"){let h=o===null?[...l,hR]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...zt(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=Je(l,t.policy?.rules??[]);if(p)return p}return null}function vR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function _f(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=uf(e,r,t.length,n);return o===null?[]:[o]}function wf(e,t,n,r,o,i){if(J.has(t)){if(nt(e))return!1;if(n!==null&&RR(e,n))return!0;let s=tt(e);if(!s){let a=et(K(e));if(a.kind==="literal")return n!==null&&a.source.includes(n);return a.kind==="none"&&o}if(n!==null&&s.includes(n))return!0;if(Ye(s))return!0;return xR(s,n,r)}if(Oe(t))return Ef(e,n,mo,Mu(t));if(we.has(t))return Ef(e,n,ia,Od);if(t==="eval"){let s=Ho(K(e));if(s.kind==="dynamic")return!0;if(n!==null)return s.kind==="literal"&&s.source.includes(n);return o}if(t==="find")return _R(e,n,i);if(t==="git"){let s=Re(e);return n===null?s.subcommand===null:(s.subcommand?.includes(n)??!1)||s.subcommand!==null&&pn.has(s.subcommand.toLowerCase())&&Af(s.rest,n).some((a)=>a.includes(n))}return!1}function Ef(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Ko]).sources.some((a)=>a.value===Ko);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Ko}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Ko}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>_f(l,t,a))));return $o(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function ER(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Fe(e,n),(i)=>i.head)),o=t===null?[...e,qo]:e.map((i,s)=>s===0?i:i.replaceAll(t,qo));return Array.from(Fe(o,n)).some((i)=>i.head===qo&&!r.has(qo))}function Pf(e,t){return Af(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Af(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Tf(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function RR(e,t){let n=Se(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return _f(i,t,o).some((l)=>{let c=e.map((f,d)=>d===s?f.replaceAll(t,l):f),u=Se(c);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(n.commandIndex===null&&u.commandIndex!==null)return!0;if(n.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(c[u.commandIndex]??"").includes(l))return!0;return u.scriptIndex!==null&&(c[u.scriptIndex]??"").includes(l)})}))}function xR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(yR))if(Rf(o,r))return!0;for(let o of e.matchAll(CR))for(let i of(o[1]??"").matchAll(bR))if(Rf(i,r))return!0;return _a(e,r)}function Rf(e,t){let n=e[1]??e[2];return n!==void 0&&(SR.test(n)||t.has(n))}function _R(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Qe(s)){let l=lr(e,i);i=l.nextIndex-1;for(let c of Fe(l.tokens,{environment:n,cwd:void 0})){let u=Tf(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Pf(c.tokens,t)||wf(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=ht(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Ut(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var pr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",gr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",PR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",AR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Zo=/\{[^{}\s]*\}/g,If=/\{\}|\{-?\d+\}/g,TR=["e","f","source","file","-e","-f","--source","--file"],IR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],kR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),OR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),kf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),MR=new Set(["--workdir","--wd"]),Of="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Te(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Wf(e){return Te([...e],(t)=>Ye(t))}function Gf(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=gn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Kf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:f}=o;if(c){let p=gn(t);if(p)return p;let h=Wf(t.envAssignments?.values()??[]);if(h)return h}if(l){let p=FR(t);if(p)return p}if(u!==void 0&&a){let p=gn(t);if(p)return p}let d=zR(u,t.cwd,t.environment.paths);if(d===null){let p=gn(t);if(p)return p}let m=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(f){if([...Fe(i,m)].flatMap((h)=>[...h.envAssignments.values()]).some(Ia)){let h=gn(t);if(h)return h}return null}if(i.length===0){let p=s.map((g)=>g[0]??"");t.budget.charge("derivedTokens",p.length);let h=$f(m.envAssignments,m.cwd,a);return Te(p,(g)=>t.analyzeNested(g,h))}return Te(Fe(i,m),(p)=>NR(p,o,t,m))}function NR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(jf)){let g=gn(n);if(g)return g}let u=Wf(c);if(u)return u;let f=c.some(G),d=i||f,m=a&&d,p=$f(e.envAssignments,e.wrapperCwd,s||m);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Te(o,(E)=>n.analyzeChild(Yo(l,E,n.budget),zt(e,r)))};if(nt(l))return g();let y=tt(l);if(y){if(Vf(y)){let R=bt(n);if(R)return R;if(o.length===0)return null;return Te(o,(P)=>n.analyzeNested(Df(y,P,n.budget),p))}if(G(y)){if(o.length>0)return Te(o,(q)=>n.analyzeNested(Df(y,q,n.budget),p));let R=cr(y);if(R?.[0]&&M(R[0])==="rm"&&ze(R)){let q=Nf(n);if(q)return q}let P=R?n.analyzeChild(R,{...zt(e,r),dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",gr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",pr)}):null;if(P)return P;return n.analyzeNested(y,p)}let E=!f&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((R)=>jo(K(R===void 0?l:i?l.map((P)=>Uf(P,R)):[...l,...R]),y)):[];if(E.some((R)=>R.kind==="dynamic")){let R=bt(n);if(R)return R}let S=E.flatMap((R)=>R.kind==="literal"?[R.source]:[]);if(S.length>0)return n.budget.charge("derivedTokens",S.length),Te(S,(R)=>n.analyzeNested(R,p));if(mr(y)){let R=bt(n);if(R)return R}let T=n.analyzeNested(y,p);if(T)return T;if(d)return bt(n);return null}let v=et(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&G(v.source))return bt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=bt(n);if(E)return E;let S=g();if(S)return S;if(i)return null;let T=o.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return n.budget.charge("derivedTokens",T.length),Te(T,(R)=>n.analyzeNested(R,p))}if(d||a)return bt(n)??g();return null}if(e.head==="rm"&&ze(l)){if(i&&o.length>0)return Te(o,(y)=>Aa(Yo(l,y,n.budget,If),e.cwd,r));if(o.length>0)return Te(o,(y)=>Aa(Lf(l,y,n.budget),e.cwd,r));let g=Aa(l.flatMap((y,v)=>{if(v===0||!G(y))return[y];return y.startsWith("-")?[y.replace(If,"")]:[]}),e.cwd,r);if(g)return g;return Nf(n)}let h=o.length>0?o:[void 0];return Te(h,(g)=>{let y=g===void 0?l:i?Yo(l,g,n.budget):Lf(l,g,n.budget),v=b("parallel.shell-dynamic",gr),E=a&&e.head==="find"?GR(y,r):null,S=zf(y,a,n)??E?.customResult??null,T=M(e.head),R=a&&(T==="rm"&&Ta(y)||T==="xargs"&&Bf(y)||E?.rmOptions===!0),P=a&&(R||E?.executedSource===!0||E===null&&Ff(y,T)),q=n.analyzeChild(y,{...zt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:R,dynamicSourceInput:S!==null||P,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",pr)});if(P){let Z=A(v,n.policy);if(Z)return Z}return q??S??Je(y,n.policy?.rules??[])})}function Ff(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return WR(e);if(t==="git")return DR(e);if(t==="find")return!0;if(we.has(t))return Mf(e,TR,ar);if(Oe(t))return Mf(e,IR,fo);return!1}function Ta(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||Vf(o)))}function DR(e){if(LR(e))return!0;let t=Re(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!pn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function LR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function WR(e){if(nt(e))return!1;let t=tt(e);if(t!==null)return G(t);let n=et(K(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function Mf(e,t,n){let r=n(e);if(r.some((o)=>G(o.value)))return!0;if(!e.some(G))return n([...e,Of]).some((o)=>o.value===Of);return $o(r,t,(o)=>n(e.map((i)=>Uf(i,[o]))))}function zf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(G))return bt(n);return Te(o,(i)=>Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function GR(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of Fe(i,t))n.executedSource||=Ff(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ta(a.tokens)||a.head==="xargs"&&Bf(a.tokens),n.customResult??=zf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Qe(a)){i=[],n.executedSource||=G(a);continue}let l=ht(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function Bf(e){let t=e.slice(Ut(e).childStart);return M(t[0]??"")==="rm"&&Ta(t)}function Xo(e,t){return(n)=>A(b(e,t),n.policy)}var bt=Xo("parallel.shell-dynamic",gr),FR=Xo("parallel.command-stream-dynamic",PR),gn=Xo("parallel.command-stream-dynamic",AR),Nf=Xo("parallel.rm-recursive-force-dynamic",pr);function Aa(e,t,n){return A(Uo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Lt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function $f(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Uf(e,t){return e.replace(Zo,(n)=>Hf(n,t))}function Yo(e,t,n,r=Zo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Hf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Df(e,t,n){return Yo([e],t,n)[0]??""}function Lf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Hf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function G(e){return e.search(Zo)!==-1}function jf(e){if(Ia(e))return!0;for(let t of e.matchAll(Zo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Ia(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Vf(e){return/^\{[^{}\s]*\}$/.test(e)}function zR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!wR(e))return null;try{return ft(t??e,e,n)}catch{return null}}function Kf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=la(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=la(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||OR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(kf.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=kf.has(p)?2:1;continue}if(MR.has(y)){c=!0;let E=v??h;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(kR.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Ia:jf);let u=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){u.push(p),p=[];continue}if(g!==void 0)p.push(g)}u.push(p)}c||=u.length>1;let f=BR(u),d=n.some(G),m=n.length===0&&o===-1;return{template:n,jobs:f,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:m,unsupported:c,workdir:a,dryRun:l}}function BR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function qf(e){return Kf(e).childStart}var $R="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Jo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Oa(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function ka(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Zf(e,t,n,r,o=!1,i){let a=(zn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",$R):null;return A(a,i)??Xf(e,t,n,o,i)}function Xf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Oa(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=sn(e,t),l=HR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((f)=>f<=l))return A(b("shell.dynamic-structure",Jo),o);if(A(Bo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((f,d)=>d>l&&w(f)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&pn.has(c)&&i.some((f)=>f>l&&(u===-1||f<u)))return A(b("shell.dynamic-structure",Jo),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&jR(t)?A(b("shell.dynamic-structure",Jo),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=ze(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?A(b("shell.dynamic-structure",Jo),o):null}if(s==="xargs")return Yf(e,t.slice(Ut(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return Yf(e,t.slice(qf(t.map(w))),"parallel",n,r,o);return null}function Yf(e,t,n,r,o,i){if(t.length===0)return null;let s=UR(t,r);if(zn(e,s)){let l=A(b(`${n}.shell-dynamic`,n==="xargs"?Pa:gr),i);if(l)return l}let a=Xf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Oa(l)&&ka(l)))return A(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?wa:pr),i);return null}function UR(e,t){let n=Ot(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function HR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(be.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function jR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Oa(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||ka(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||ka(s)))return!0;continue}if(t=!0,a)return!0;let l=ht(s.text);if(l>0){n=l;continue}if(Qe(s.text))o=!0,r=!0}return!1}function Ma(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!ao(t[n.tokenIndex],n.value)})}var VR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",KR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",qR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Jf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",VR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",KR);if(e==="shred"&&n.length>0)return b("shred.target",qR);return null}var em=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Uo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Bo(e.words,Na(e))},{heads:new Set(["find"]),analyze:(e)=>Gd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>xf(e.words,{...Qf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Gf(e.words,{...Qf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})}];function Qf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ht(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Na(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var om="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function im(e){return em.find((t)=>t.heads.has(e))?.analyze}function yn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,f=s?s.originalCwd:c?void 0:n.cwd,d=ho(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let m=Ot(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=m.envSplitValues??[];if(p.length>0){let x=[...p,...i(m.words)].join(" "),I=Ye(x);if(I)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:I.reason}),ue(I);if(n.strict)return he(r);let L=yo(p,i(m.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:m.cwd===void 0?n.effectiveCwd:m.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...m.envAssignments])});if(te)return te}}let h=m.rewritten?K(i(m.words)):sn(o,m.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>h.length){let x=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...d.envAssignments,...m.envAssignments]),E=g[0];if(!E)return null;if(Ft(E))throw new N("wrapperPeelIterations");let S=M(E),T=m.cwd===null?void 0:m.cwd??u,R=m.cwd===null?void 0:f,P=m.cwd===void 0?n.effectiveCwd:m.cwd,q=s?s.allowTmpdirVar:!rr(v,n.environment),Z=Zf(o,m.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),ue(Z);let ee=No(g,n.policy);if(ee){for(let x of[ee.childIndex,...ee.alternativeChildIndices]){tm(y.wrapperNormalizationBudget);let I=h.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=yn(I,t,{...y,effectiveCwd:P,envAssignments:v});if(L)return L}return null}let X=l?void 0:S==="eval"?Ho(h):S==="trap"&&!a?yf(h):void 0;if(a&&s&&S==="eval"){if(X?.kind==="dynamic")return hn(s,n.policy);if(X?.kind==="literal"){let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v});if(x)return x}return Cn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!xa(n.commandView)))return he(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:S==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?J.has(S):am(E,S)){if(nt(g))return null;if(a&&s){let x=tt(g);if(x){if(s.dynamicSourceInput??s.dynamicInput){let L=hn(s,n.policy);if(L)return L}if(mr(x)){let L=hn(s,n.policy);if(L)return L}return n.analyzeNested(x,{effectiveCwd:P,envAssignments:v})}let I=et(h);if(I.kind==="dynamic")return hn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?hn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?hn(s,n.policy):null}if(l){let x=tt(g),I=x?n.analyzeNested(x,{effectiveCwd:P,envAssignments:v}):et(h).kind==="dynamic"?he(r):null;if(I)return I}if(s===void 0){let x=JR(g,v,P,n,r,t);if(x)return x;let I=tt(g);if(I){let qt=jo(h,I);if(qt.kind==="dynamic")return he(r);let hi=qt.kind==="literal"?qt.source:I,il=QR(hi);r?.recordSegment({type:"shell-wrapper",wrapper:S,innerCommand:il}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:il,depth:t+1});let sl=n.analyzeNested(hi,{effectiveCwd:P,envAssignments:v});if(sl)return sl;return mr(hi)?he(r):null}let L=et(h);if(L.kind==="dynamic")return he(r);if(L.kind==="literal")return Qo(L.source,P,v,n,r,t);let te=Cf(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return he(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:P,envAssignments:v})}}if(!s&&(S==="source"||S===".")){let x=g[1]==="-p"?2:null;if(x!==null){let qt=n.commandView?h[x]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return he(r)}let I=x===null?1:3,L=g[I]==="--"?I+1:I,te=n.commandView?h[L]:void 0;if(!te)return null;if(te.provenance==="literal")return Qo(te.text,P,v,n,r,t);if(n.strict||!n.commandView||!xa(n.commandView))return he(r)}if(we.has(S)&&!l){if(!s&&n.strict&&Ma(ar(g),h))return he(r);let x=Md(g,(L)=>Ht(n.analyzeNested(L,{effectiveCwd:P,envAssignments:v}))),I=A(x,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),ue(I)}if(Oe(S)&&!l){if(!s&&n.strict&&Ma(fo(g),h))return he(r);let x=Ou(g);if(a&&s)return ZR(S,x,P,v,n,s);if(x){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:S,codeArg:x,paranoidBlocked:I}),I){let te=A(b("interpreter.one-liner-paranoid",qn),n.policy);if(te)return ue(te)}if(zs(S,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let L=n.analyzeNested(x,{effectiveCwd:P,envAssignments:v});if(L&&!sm(L,x))return L;if(Yn(x)){let te=A(b("interpreter.dangerous-command",cn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:cn}),ue(te)}r=void 0}}if(S==="busybox"&&g.length>1)return tm(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),yn(h.slice(1),t,{...y,effectiveCwd:P,envAssignments:v});let D=s?null:A(Jf(S,g),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),ue(D);let ce=r===y.trace?y:{...y,trace:r},_e={words:h,head:S,cwd:T,originalCwd:R,envAssignments:v,allowTmpdirVar:q,dynamicArguments:m.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:P,options:ce,analyzeChildTokens:(x,I)=>a&&s?Da(x,t,ce,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ht(yn(K(x),t+1,{...ce,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:v}))??Je(x,ce.policy.rules),analyzeChild:(x,I)=>Da(x,t,ce,I)},je=s&&(S==="xargs"||S==="parallel")?void 0:im(S);if(S==="rm"||S==="xargs"||S==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let Ie=r&&S==="git"?cf(_e.words,Na(_e)):void 0,pi=nm(Ie?Ie.match:je?.(_e)??null,n.policy);if(r)ex(_e,pi,Ie?.relaxation??null);if(pi)return ue(pi);if(a&&s&&(S==="rm"||S==="rmdir")){if(!(S==="rm"&&(ze(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Cn(s,n.policy):null)??XR(s,n.policy)}let rl=je!==void 0,ol=!s&&!rl&&!Dr.has(S),gi=r&&ol?[]:void 0;if(ol)for(let x=1;x<g.length;x++){let I=g[x];if(!I)continue;gi?.push(I);let L=nm(YR(g,x,t,ce,T,R,P,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[],embeddedCommandFound:M(I)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&rl)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let Rr=Je(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Rr,reason:Rr?.reason}),Rr)return ue(Rr);return a&&s?Cn(s,n.policy):null}function Da(e,t,n,r){return Ht(yn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function YR(e,t,n,r,o,i,s,a){for(let l of Fe(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=M(c);if(am(c,u)||im(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=Da(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!rr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function ZR(e,t,n,r,o,i){if(!t)return Cn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=A(b("interpreter.one-liner-paranoid",qn),o.policy);if(a)return ue(a)}if(zs(e,t))return Cn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!sm(s,t))return s;if(Yn(t)){let a=A(b("interpreter.dangerous-command",cn),o.policy);if(a)return ue(a)}return Cn(i,o.policy)}function sm(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(ko)||e.reason===mn)&&!Lr(t)}function hn(e,t){let n=e.shellDynamicMatch?A(e.shellDynamicMatch,t):null;return n?ue(n):null}function Cn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?A(e.dynamicSourceMatch,t):null;return n?ue(n):null}function XR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?A(e.rmDynamicMatch,t):null;return n?ue(n):null}function JR(e,t,n,r,o,i){let s=vf(e);if(s.argvSource?.kind==="absent")return he(o);if(s.argvSourceApplies&&s.argvSource){let l=Qo(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Qo(a,n,t,r,o,i,!0)}function Qo(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return he(o);let a=Kn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?he(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function QR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function ex(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function tm(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function he(e){return e?.recordSegment({type:"error",message:om}),ue(tx())}function tx(){return{id:"",reason:om,intent:"stop_and_explain"}}function am(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function nm(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:A(e,t)}var nx=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,rx=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function ox(e,t){let n=um(e,t);if(n.length===0)return!1;let r=n[cm(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return nx.test(e.join(" "))}function lm(e,t,n,r,o){if(e.dialect==="powershell"){let g=sx(e.words,o);if(g.kind==="none")return;if(!t||g.kind==="unknown")return null;return rm(ux(g.target),t,n.paths)}let i=e.words.map(w),s=i.some((g)=>/^CDPATH\+?=/.test(g));if(!ox(i,n))return s?null:void 0;if(!t)return null;let a=um(i,n,t),l=cm(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((g)=>g.length<=1||!g.startsWith("-")||g==="--");if((u===-1?c:c.slice(0,u)).some((g)=>!/^-[LP]+$/.test(g)))return null;let d=u===-1?[]:c.slice(u),m=d[0]==="--"?d.slice(1):d;if(m.length!==1)return null;let p=m[0]??"",h=e.words.some((g)=>g.provenance==="variable"&&g.text===p)?ix(p,r):p;if(h===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(h)&&(s||n.env.has("CDPATH")))return null;return rm(h,t,n.paths)}function ix(e,t){let n=ur(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function rm(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return ft(t,e,n)}catch{return null}}function sx(e,t){let n=ax(e[0])?1:0,r=e[n];if(!lx(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!rx.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return cx(e.slice(n+1),t)}function ax(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function lx(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function cx(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function ux(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function cm(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function um(e,t,n){let r=dx(e);return mt([...r],t,n)}function dx(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var fx="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",jt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function za(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Me(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Fa(e,n);let u=`${ko}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return hm(e,n),{reason:mn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return hm(e,n),{reason:mn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Fa(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Zd(n.environment.env,n.envAssignments);return ni(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ni(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],f=u?.kind==="connector"?u.operator:void 0,d=mx(e,l,c,a,f),m=a==="&&"||a==="||",p=m?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=m||Sn(f);if(c.kind==="function"){let Z=h.flatMap((X)=>{let U=vn(X);return U.functionDefinitions.set(c.name,c.body),La(X,[U],d,f==="&",Sn(f))}),ee=Wa(Z,[],g,y,a,f);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of h){let D=ni(c.body,t,n,r,[vn(U)]);if(D.result)return D;if(Z.push(...La(U,D.states,d,f==="&",Sn(f))),v)ee.push(U,...d?D.states.map((ce)=>ei(U,ce)):D.states)}let X=Wa(Z,ee,g,y,a,f);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),S=e.nodes[l-2],T=ri(a)&&S?.kind==="command"?hf(S)??gx(S):void 0,R=[],P=[];for(let Z of h){let ee=hx(c,t,n,r,[vn(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ei(Z,U));for(let U of X){let D=vn(U),ce=bx(c,t,n.trace?{...n,trace:ym(n.trace,E)}:n,r,D,ri(a),T);if(ce)return{result:ce,states:i};let _e=Dx(c,D.functionDefinitions);if(_e)n.budget.charge("derivedTokens",oi(_e));let je=_e?t+1>=V.recursionDepth.cap?Ga(c.displayText,n,[D]):ni(_e,t+1,n,r,[D]):{result:null,states:Mx(c,D)};if(je.result)return je;if(R.push(...La(Z,je.states,d,f==="&",Sn(f))),v)P.push(Z),P.push(...je.states.map((Ie)=>d?ei(Z,Ie):Ie))}}let q=Wa(R,P,g,y,a,f);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function mx(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ri(r)||ri(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&px(e,t)}function La(e,t,n,r,o){let i=n?t.map((a)=>ei(e,a)):[...t],s=o?i.flatMap((a)=>bn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ei(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function px(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(yx(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ri(e){return e==="|"||e==="|&"}function gx(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Sn(e){return e==="&&"||e==="||"}function Wa(e,t,n,r,o,i){let s={success:ti([...n,...e]),failure:ti([...r,...t])},a=Sn(i)?s:void 0;return{states:Sn(o)||a?ti([...s.success,...s.failure]):s.success,conditionalStates:a}}function ym(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function hx(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=Cx(e);if(s){if(t+1>=V.recursionDepth.cap)return Ga(s,n,o);let a=Me(s,"powershell");if(a.status==="limited")return Ga(s,n,o);if(a.status!=="complete")return dm(i,n,r,o);n.budget.charge("derivedTokens",oi(a)),i.push({program:a,depth:t+1})}}return dm(i,n,r,o)}function yx(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function dm(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ni(i.program,i.depth,t,n,[vn(a)]);if(l.result)return l;s.push(...l.states)}o=ti(s)}return{result:null,states:o}}function Cx(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function oi(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+oi(o),0):n.kind==="group"||n.kind==="function"?oi(n.body):0),0)}function Ga(e,t,n){return t.trace?.recordSegment({type:"error",message:$e}),{result:{reason:$e,segment:e,intent:"stop_and_explain"},states:[...n]}}function bx(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=wx(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Cm(e,o,"before-consumer",a.environment.paths,a.budget);let c=sn(e.dialect,e.words),u=c.map(w),f=e.displayText,d=Yd(c,o.shellGitContextState),m=Jd(d,o.shellGitContextState);if(e.dialect==="powershell"){let g=A(_d(e,i,Wx(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!g,reason:g?.reason}),g)return Lx(f,g)}if(u.length===1&&u[0]?.includes(" ")&&!zn(e.dialect,e.words)){let g=A(Ye(u[0]),a.policy),y=g!==null&&!a.strict&&Pu(e,a.rootProgram);if(g&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:g.reason}),{reason:g.reason,segment:f,ruleId:g.id,intent:g.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let v=fm(e,l,o,m,s,a);if(v)return v;return Ca(d,o.shellGitContextState),null}let p=yn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:m,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(g,y)=>{let v=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=za(g,t+1,{...a,effectiveCwd:v,envAssignments:y?.envAssignments??m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?ym(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:f};let h=fm(e,l,o,m,s,a);if(h)return h;return Ca(d,o.shellGitContextState),null}function fm(e,t,n,r,o,i){let s=Px(e,t,n,r??new Map,i);if(s)return s;return Cm(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),Ex(e,t,n,i.environment.paths,i.budget),Ix(e,n,o,i.environment,i.trace),null}var Sx=new Set([">>","<>"]);function Cm(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?vx(s):Sx.has(s.operator)))continue;mm(s.target,t,r,o)}if(n!=="before-consumer"||!xe(e.words[0],"tee"))return;let i=bm(e.words.slice(1));if(!i)return;for(let s of i.operands)mm(s,t,r,o)}function vx(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function mm(e,t,n,r){let o=e?.provenance==="literal"?Kn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function Ex(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!ii(i))return;for(let s of Rx(e)){let a=Kn(s.text,n.effectiveCwd,r,o);if(!a||!Iu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function Rx(e){let t=_x(e.redirections)?.target,n=pm(t)?[t]:[];if(xe(e.words[0],"cat"))return xx(e.words)?n:[];if(!xe(e.words[0],"tee"))return[];let r=bm(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(pm))return[];return[...r.operands,...n]}function xx(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function _x(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function bm(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&xe(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function pm(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function xe(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function ii(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function wx(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return jt;let n=t[0];if(!n?.heredoc)return jt;if(!ii(n.heredoc))return fx;if(n.fd!==void 0&&n.fd!==0)return jt;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return jt;let r=e.redirections.some((s)=>s!==n&&gm(s.target));if(xe(e.words[0],"cat"))return r?jt:void 0;if(xe(e.words[0],"tee"))return r||e.words.slice(1).some(gm)?jt:void 0;let o=e.words[0],i=e.words[1];if(xe(o,"git")&&(xe(i,"apply")||xe(i,"commit")))return;if(xe(o,"gh")&&(xe(i,"pr")||xe(i,"issue"))&&xe(e.words[2],"create"))return;return jt}function gm(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function Px(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(Tx(e,i,n,r,o))return null;let a=Ax(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Fa(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function Ax(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!ii(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Oe(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=A(b("interpreter.one-liner-paranoid",qn),n.policy);if(c)return c}if(!Yn(s))return null;let l=A(b("interpreter.dangerous-command",cn),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function Tx(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!ii(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Ot(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return nt(a)}function Ix(e,t,n,r,o){let i=lm(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var kx=/^[A-Za-z_][A-Za-z0-9_]*$/,Ox=8;function Mx(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!kx.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=Ox&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=vn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function vn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Xd(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ti(e){let t=[];for(let n of e){if(!t.some((r)=>Nx(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function Nx(e,t){return e.effectiveCwd===t.effectiveCwd&&bn(e.shellGitContextState.env,t.shellGitContextState.env)&&bn(e.literalHeredocFiles,t.literalHeredocFiles)&&bn(e.functionDefinitions,t.functionDefinitions)&&bn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&bn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function bn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function Dx(e,t){let n=Bn(e);return n===void 0?void 0:t.get(n)}function Lx(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function Wx(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Fa(e,t){let n=A(Ye(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function hm(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:mn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var Gx=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Sm(e,t,n,r){let o=za(e,0,{...t,...Yc(t),budget:t.budget??ye(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function vm(e,t,n){try{return{decision:e()}}catch(r){let o=Fx(r,t,n);if(!o)throw r;return o}}function Fx(e,t,n){if(!(e instanceof N)||!Gx.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var zx=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),$a=new Set(["cc-safety-net","ccsn"]),Bx=new Set(["bunx","npx","pnpx"]),$x=new Set(["pnpm","yarn"]),Ux=new Set(["npm","pnpm","yarn"]),Hx=new Set(["bun","node"]);function ai(e,t,n={}){if($a.has(e))return 0;if(Bx.has(e)){if(n.broad)return Ba(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return si(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&Ux.has(e)&&n.broad&&t[r]==="exec"){let o=Ba(t.slice(r+1));return o===null?null:r+1+o}if($x.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&si(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ba(t.slice(r+1));return o===null?null:r+1+o}if(Hx.has(e)){let o=n.broad&&r!==-1?r:0;if(Em(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Em(t[o+1]))return o+2}return null}function Ba(e){let t=e.findIndex((r)=>si(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!si(r))break;n++}return n}function si(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return $a.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return $a.has(e.slice(0,t))}function Em(e){let t=e?.replaceAll("\\","/");return[...zx].some((n)=>t===n||t?.endsWith(`/${n}`))}var Rm="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function xm(e,t,n){let r=pe(e,"input-candidate");if(!r)return null;let o=dn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>jx(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function jx(e,t){let n=mt([...e],t),r=n.slice(1),o=ai(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as li}from"node:path";var Am="This path contains the protected policy config and you must not modify or delete it.",Vx=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Tm(e,t,n){let r=Jx(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return _m(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=pe(e,"input-candidate");if(e.invocation.route.kind==="command")return o?wm(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=wm(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return _m(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||wr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function _m(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>hr(a,n,r,o,i));return s?{target:s}:null}function wm(e,t,n,r,o){let i=dn(e,t,r,o,{findSegmentTarget:(s,a)=>Kx(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>hr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>Xx(s,t,n,r,o)?.target??null});return i?{target:i}:null}function Kx(e,t,n,r,o){if(er(e))return null;let i=Mt([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&qx(a)){let l=Yx(a).find((c)=>Pm(me(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Wo(i,1)||ua(i,r)){let c=(Lo(K(i))??K(["."])).find((u)=>{let f=me(u.text,t.variables);return hr(f,t.cwd,n,r,o)||Pm(f,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Ro(a).sources.find((c)=>Qx(me(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(Zx(i,s))return null;for(let l of[...e,...i])for(let c of Im(l))if(hr(me(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function qx(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function Yx(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function Zx(e,t){if(!Vx.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function Xx(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Im(i))if(hr(s,t,n,r,o))return{target:s};return null}function Im(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function Jx(e,t,n){let r=(a)=>yr(se(a,e.executionCwd,t,n)),o=r(Qt(t)),i=[r(Dn(e.executionCwd)),r(Dn(e.configCwd))],s=new Set(i.map((a)=>li(a)));for(let a=li(o);;a=li(a))if(s.add(a),li(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function hr(e,t,n,r,o){let i=gl(e,t,r,o,(s)=>yr(s)===Mr);return i!==null&&n.files.has(yr(i))}function Pm(e,t,n,r,o){return n.directoriesAndAncestors.has(yr(se(e,t,r,o)))}function Qx(e,t,n,r,o){let i=yr(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function yr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ci,posix as e_,resolve as di,win32 as t_}from"node:path";import{fileURLToPath as n_}from"node:url";var zm="Access to a sensitive path is not allowed.",Bm=new Set(["echo","printf"]),r_=new Set(["find"]),o_=new Set(["-exec","-execdir"]),i_=new Set([";","+"]),s_=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),a_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),$m=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),l_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),c_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Um=new Set(["-c","-e","-r","-E","--eval","--exec"]),u_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),d_=new Set(["grep","rg"]),km=new Set(["jq","gojq","jaq"]),Om="f",Mm="file",f_="files",m_=new Set(["e","f"]),p_=new Set(["regexp","file"]),g_=new Set(["e","f","A","B","C","m"]),h_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Ua="__CC_SAFETY_NET_PIPE_INPUT__",ja=/[\w./~@+-]*[./~][\w./~@+-]*/g,y_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,C_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,b_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,S_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,v_=/\b(?:system|exec)\s*$/,E_=/\b(?:eval|exec)\s*\(/g,R_=/\b(?:eval|exec)\s*$/,x_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Nm(e,t,n,r,o,i){for(let s of e){let a=s.target;if(Ew(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=Sw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&Rw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Hm(e,t,n,r,o={}){let i=Dm(e,n,r),s=Nm(i,t,e.invocation.context.configCwd,n,r);if(s===null)return null;let a=s.ruleId!=="secret.deny-path"&&o.strict===!1?Dm(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:Nm(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&__(e,n))return null;return l}function __(e,t){let n=pe(e,"input-candidate")??pe(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of Eo(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(Xe(a.text,t))}let o=St(r);if(o.length===0)return!1;let i=it(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>s_.has(a))}function Dm(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=pe(e,"input-candidate");return[...s?En(s.shell,e.store,r,t,o,n,w_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function w_(e){return e.program.dialect==="powershell"}function En(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new We;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...nw(Xe(e.source,r),t,n,r,o,i)],l=(c)=>Xe(W_(c,s),r);return vo(e,o,r,i,{word:l,segment:(c,u,f,d,m)=>{if(c.length===0)return null;if(a.push(...fi(c,t,n,r,u.cwd,i,m)),f!==null)a.push(...A_(f,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...jm(c.consumer,[c.body],t,n,r,u.cwd,i,(f)=>T_(c.consumer??[],f,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return Ks;return a.push({target:l(c.target),cwd:u.cwd}),null}}),a}function Va(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new We;return s.status==="complete"?En(s,t,n,r,o,i):null}function fi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(km.has(it(St(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...fi(p,t,n,r,o,i)]}let l=L_(e).map(a),c=St(e);if(c.length===0)return l;let u=c[0]??"",f=it(u).toLowerCase(),d=c.slice(1),m=P_(u,f,d);if(m)return[...l,...m.map(a)];if(Bm.has(f))return n.capturedOutput===!0?[...l,...Vm(e).map(a)]:l;if(f==="eval")return[...l,...Va(d.join(" "),t,n,r,o,i)??d.map(a)];if(f==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:ot(f,p)).map(a)];if(f==="git")return[...l,...F_(d).map(a)];if(km.has(f))return[...l,...G_(d).map(a)];if(d_.has(f))return[...l,...uw(d).map(a)];if(r_.has(f))return[...l,...U_(d,t,n,r,o,i).map(a)];if(we.has(f))return[...l,...d.flatMap((p)=>ot("awk",p)).map(a),...d.flatMap((p)=>j_(p,t,n,r,o,i)),...d.flatMap(V_).map(a)];if(f==="curl")return[...l,...d.flatMap((p)=>ot(f,p)).map(a),...z_(d).map(a)];if(tr(f)){let p=Qn.has(f)?Se([f,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new We;if(h.status==="complete")return[...l,...En(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...H_(f,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>ot(f,p)).map(a)]}function P_(e,t,n){let r=ai(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function A_(e,t,n,r,o,i,s){if(M_(t,n,r,o,i,s))return Vm(e).map((a)=>({target:a,cwd:i}));return jm(t,I_(e),n,r,o,i,s,()=>[])}function T_(e,t,n,r,o,i,s){let a=St(e);if(!tr(it(a[0]??"").toLowerCase()))return[];return Va(t,n,r,o,i,s)??[{target:t,cwd:i}]}function jm(e,t,n,r,o,i,s,a){let l=N_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>Qn.has(l)?En(n.getShellSyntax(c),n,r,o,i,s):ui(l,c,n,r,o,i,s))}function Vm(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase();if(!Bm.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Ka(r.replaceAll("%%","%"))];return t.slice(1)}function I_(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return k_(r);return[]}function k_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ka(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>O_(t,r.slice(i*n,(i+1)*n)))}function O_(e,t){let n=0;return Ka(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ka(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function M_(e,t,n,r,o,i){let s=St(e);if(s.length===0||it(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Ut(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Ua]:l.map((f)=>f.split(c).join(Ua));return fi(u,t,n,r,o,i).some((f)=>f.target.includes(Ua))}function N_(e){let t=St(e);if(t.length===0)return null;let n=it(t[0]??"").toLowerCase();if(!tr(n))return null;return D_(n,t.slice(1))?n:null}function D_(e,t){let n=qa(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Um.has(o)||Km(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(x_.get(n)?.has(o))r++;continue}return!1}return!0}function qa(e){return/^python\d/.test(e)?"python":e}function L_(e){let t=[];for(let n of e){if(Ym(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Lm=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function W_(e,t){if(!t||!Lm.test(e))return e;return`~${e.replace(Lm,"").replace(/\\/g,"/")}`}function ot(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function G_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>ot("jq",i))}return e.flatMap((r,o)=>o===t?[]:ot("jq",r))}function F_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>ot("git",i))];if(t.push(...ot("git",r)),!be.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:ot("git",o)),n++}return t}function z_(e){return e.flatMap((t,n)=>{let r=$_(t);if(r!==null)return Wm(r.flag,r.value);let o=B_(e[n-1]);return o===null?[]:Wm(o,t)})}function Wm(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ha(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ha(t.slice(n+1))}return t.startsWith("@")?Ha(t.slice(1)):[]}function B_(e){if(e===void 0)return null;if($m.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function $_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return $m.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ha(e){return e===""||e==="-"?[]:[e]}function U_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!o_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((m)=>i_.has(m)),f=u===-1?c:c.slice(0,u),d=fi(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...d.filter((m)=>m!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,h)=>{if(!a_.has(m))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function H_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Um.has(c)||Km(e,c)){let f=t[l+1];if(f!==void 0)a.push(...ui(e,f,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...ui(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Km(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return u_.get(t[t.length-1]??"")?.has(qa(e))??!1}function j_(e,t,n,r,o,i){if(!e.includes("system"))return[];return sa(e)?.commands.flatMap((s)=>En(t.getShellSyntax(s),t,n,r,o,i))??[]}function V_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function K_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Ya),...e.match(ja)??[]]}function ui(e,t,n,r,o,i,s){let a=(m)=>({target:m,cwd:i}),l=Y_(t,q_(e));if(l===null)return K_(t).map(a);let c=l.masked.match(S_)!==null||l.literals.some((m)=>v_.test(l.masked.slice(0,m.start))),u=l.masked.match(E_)!==null||l.literals.some((m)=>R_.test(l.masked.slice(0,m.start))),f=r.refineInlineData===!0&&!Qn.has(e),d=f&&!(Q_(l.masked)||c||u)?[]:l.literals;return[...d.map((m)=>m.text).filter((m)=>m!=="").map(a),...d.flatMap((m)=>Ya(m.text)).map(a),...f?[]:l.literals.flatMap((m)=>m.text.match(ja)??[]).map(a),...c?l.literals.flatMap((m)=>Va(m.text,n,r,o,i,s)??[a(m.text)]):[],...u?l.literals.flatMap((m)=>ui(e,m.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
+`:h),n,r,o,i,s)):[],...(l.masked.match(ja)??[]).map(a)]}function q_(e){let t=qa(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function Y_(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(C_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&J_(e,o))return null;let a=t==="python"?Z_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=X_(e,c,l);if(u===null)return null;let f=e.slice(c,u);if(/[fF]/.test(a)&&f.includes("{"))return null;if(t==="simple"&&s==='"'&&b_.test(f))return null;r.push({start:c,text:f});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function Z_(e,t){return y_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function X_(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function J_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Q_(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(l_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>c_.has(i)))continue;if(o.length>1)return!0;if(ew(e,r)===".")return!0;if(tw(e,r+n.length)==="(")return!0}return!1}function ew(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function tw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function nw(e,t,n,r,o,i){return aw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...En(a,t,{...n,capturedOutput:!0},r,o,i),...rw(a,r)?ow(a,r).map((l)=>({target:l,cwd:o})):[]]})}function rw(e,t){let n=Eo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||it(Xe(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Xe(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function ow(e,t){return Eo(e).flatMap((n)=>n.kind==="word"?[Xe(n.text,t)]:n.kind==="redirection"&&n.target?[Xe(n.target,t)]:[]).flatMap(Ya)}function Ya(e){let t=sw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||iw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function iw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function sw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function aw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Ln(o,n))continue;if(qm(e,r,n)){let i=lw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=cw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function lw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Ln(i,n))continue;if(qm(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function cw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function qm(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function uw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let f=u[1]??"",d=u[2];if(f===f_)o=!0;if(p_.has(f))r=!0;if(d!==void 0){if(f===Mm)t.push(d);continue}if(h_.has(f)){let m=e[l+1];if(f===Mm&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),d="",m="";for(let h=0;h<f.length;h++){let g=f[h]??"";if(m_.has(g))r=!0;if(g_.has(g)){d=g,m=f.slice(h+1);break}}if(d==="")continue;if(m.length>0){if(d===Om)t.push(m);continue}let p=e[l+1];if(d===Om&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function St(e){let t=e.findIndex((n)=>!Ym(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Ym(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var dw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),fw=".env.",mw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),pw=[".env.example.",".env.sample."];function gw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function hw(e){return e.length>0&&!/\s/.test(e)}function yw(e,t,n,r){try{let o=Sr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof N)throw o;return!1}}var Cw=new Set(["node_modules","__pycache__"]),bw=[["vendor","bundle"],["vendor","cache"]];function Sw(e,t,n,r,o){if(gw(e))return null;let i=He(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>hw(s)||yw(e,t,r,o);if(mw.has(s)||pw.some((d)=>s.startsWith(d)))return null;let c=B(ww(e,t,r,o));for(let d of is){let m=`~/${d.suffixParts.join("/")}`;if((Fm(a,m)||Fm(c,m))&&rt(d.id,n))return d.id}let u=vw(i,t,n,r,o);if(u)return u;if(dw.has(s))return null;for(let d of os)if(s===d.basename&&rt(d.id,n))return d.id;if(s.startsWith(fw)&&rt(zr.id,n)&&l())return zr.id;for(let d of ss)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let m=s.slice(d.prefix.length)[0];if((m==="-"||m==="_")&&rt(d.id,n)&&l())return d.id}for(let d of as)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&rt(d.id,n))return d.id}if(xw(a))return null;if(!s.includes(".")&&Wn.pattern.test(s)&&rt(Wn.id,n))return Wn.id;let f=_w(s,n);if(f)return f;return null}function vw(e,t,n,r,o){return Br.find((i)=>{if(!rt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||br(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,He("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Cr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?br(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,He(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Cr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Cr(e,s,["credentials"])||Cr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>br(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?z(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?br(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,He(u,t,r,o),l))}case"secret.cli.pi":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=He("~",t,r,o);return[le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),le(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Cr(e,le(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),le(He("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?br(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=le(z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,He("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&Vt(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,He("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Gm=new WeakMap;function z(e,t,n,r,o){let i=Gm.get(o)??new Map;Gm.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=He(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>Zm(e,le(t,r)))}function Cr(e,t,n){return n.some((r)=>Vt(B(e),B(le(t,r))))}function br(e,t,n,r,o){return Zm(e,He(t,n,r,o))}function Zm(e,t){return B(e)===B(t)}function le(e,...t){return Be([e,...t].filter(Boolean).join("/"))}function Ew(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Sr(e,t,o,i));return n.some((a)=>Vt(s,B(Sr(a,r,o,i))))}function Rw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Sr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Be(F(Ce(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),f=B(u?Be(F(di(Ce(u)),o.paths,i)):l&&Be(F(`${l}/.cc-safety-net`,o.paths,i)));if(f&&Vt(s,f))return!1;return n.some((d)=>{let m=B(Sr(d,r,o,i));if(!m)return!1;if(c&&(c===m||c.startsWith(m.endsWith("/")?m:`${m}/`)))return!1;return Vt(s,m)})}function xw(e){let t=e.split("/");return t.some((n)=>Cw.has(n))||bw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function _w(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ls)if(r===o.extension&&rt(o.id,t))return o.id;for(let o of cs)if(o.pattern.test(r)&&rt(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function rt(e,t){return!t?.disabledRules?.includes(e)}function He(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i)return"";if(!o)return i;let s=Xa(i,o),a=ci(s)?s:Be(di(t,s)),l=Be(F(a,n.paths,r));if(!Vt(l,o)){if(ci(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Fm(e,t){return e===t||e.startsWith(`${t}/`)}function ww(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i||!o)return"";let s=Xa(i,o),a=e_.normalize(ci(s)?s:Be(di(t,s))),l=Be(Ce(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Vt(c(a),c(d)));if(u===void 0)return"";let f=a.slice(u.length);return f?`~${f}`:"~"}function Sr(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i)return"";let s=o?Xa(i,o):i;return Be(F(ci(s)?s:di(t,s),n.paths,r))}function Za(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Be(F(Ce(r),t.paths,n)):"",i=Be(Ce(Pw(Xe(e,t))));return{home:o,normalized:i}}function Pw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return n_(e)}catch{return e}}function Xa(e,t){if(e==="~")return t;if(e.startsWith("~/"))return le(t,e.slice(2));return e}function Aw(e){if(process.platform==="win32")return!0;return t_.parse(e).root.length>1}function Be(e){let t=e.trim(),n=(t.includes("\\")&&Aw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Vt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function it(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Kt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Tw={findPolicyMutation:Tm,findGitMetadataMutation:ad,resolveGitMetadata:Iw,loadPolicySnapshot:qc,findSensitiveTarget:Hm,analyzeCommand:Sm,getModes:Mi};function Xm(e,t){let n={...Tw,...t.dependencies},r=Mw(e),o=vr(e)?e.command:r,i=vt("policy-protection",o,()=>nr(e)),s=pe(i,"input-candidate"),a=pe(i,"declared-command");if(vr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:$e,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:wd,intent:"stop_and_explain"}};let l=ye(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Am,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let f=vt("policy-protection",o,()=>xm(i,t.environment,l));if(f){let E=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Rm,intent:"hard_stop",evidence:{command:E,segment:f.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ae,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let m=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...kw(m)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:vr(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:zm,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!vr(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Ja("command-validation",o),...g};let v=vt("command-analysis",o,()=>vm(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Ow(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function Iw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function kw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Ow(e){return pe(e,"declared-command")?.program}function Mw(e){try{return An(e.input)}catch(t){let n=vr(e)?e.command:void 0;throw new Kt("policy-protection",Ja("policy-protection",t instanceof Ve?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Kt(e,Ja(e,r instanceof Ve?void 0:t,r),r)}}function Ja(e,t,n){let r=n instanceof N||n instanceof We;return{stage:e,decision:{kind:"deny",reason:r?Ci:xn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function vr(e){return e.route.kind==="command"}import{appendFileSync as Vw,mkdirSync as Kw}from"node:fs";import{isAbsolute as qw,join as tl}from"node:path";import{lstatSync as Qm,readdirSync as Nw,readFileSync as Dw,rmdirSync as Lw,statSync as ep,unlinkSync as Ww,utimesSync as Gw,writeFileSync as Fw}from"node:fs";import{join as Er}from"node:path";function Jm(e,t={}){return Yr(Qt(e,t),e.home).policy.audit.retention_days}var el=86400000,zw=".last-prune",Bw=/^\d{4}-\d{2}$/,$w=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,tp=(e)=>Math.floor(e/el);function rp(e,t,n=()=>new Date){try{let r=n().getTime();if(!ep(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Er(t,zw),i=ep(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&tp(i)===tp(r))return;let s=r-Jm(e)*el,a=new Date(r).toISOString().slice(0,7);for(let l of Qa(t)){if(l.isDirectory()){Uw(Er(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))Hw(Er(t,l.name),s)}Fw(o,"",{mode:384}),Gw(o,r/1000,r/1000)}catch{}}function Uw(e,t,n){for(let r of Qa(e)){if(!r.isDirectory()||!Bw.test(r.name))continue;let o=Er(e,r.name);for(let i of Qa(o)){if(!i.isFile())continue;let s=$w.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+el;if(!Number.isFinite(a)||a>=t)continue;op(Er(o,i.name))}if(r.name!==n)np(o)}np(e)}function Hw(e,t){try{let n=Qm(e);if(n.mtimeMs>=t)return;let r=Dw(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(jw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Qm(e).mtimeMs!==n.mtimeMs)return;op(e)}catch{}}function jw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Qa(e){try{return Nw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function op(e){try{Ww(e)}catch{}}function np(e){try{Lw(e)}catch{}}var Yw="2.4.4",Zw=1e4,Xw=2000,Jw=256,Qw=32768;function eP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function tP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function nl(e,t,n,r,o,i,s={}){let a=eP(t);if(!a)return;let l=rP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=mi(st(n),s.failureStage?Number.POSITIVE_INFINITY:Zw),f=mi(st(r),Xw),d=s.toolName?mi(st(s.toolName),Jw):void 0,m=i===null?void 0:mi(st(i),Qw),p=tl(l,tP(m?.value??null),c.slice(0,7));Kw(p,{recursive:!0,mode:448});let h=tl(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Di)(),v:Yw,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};Vw(h,`${JSON.stringify(g)}
+`,{encoding:"utf-8",mode:384}),rp(e,l,s.now)}catch{}}function mi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function nP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&qw(n)?n:null}function rP(e){let t=nP(e);return t?tl(t,".cc-safety-net","logs"):null}function sp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=ip(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?ip(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function ip(e){return"command"in e?e.command??"":""}function ap(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;nl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function lp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;nl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function up(e,t,n){try{let r=Xm(t,{environment:e,...n.guard});return cp(e,t,r,n),r}catch(r){if(!(r instanceof Kt))throw r;throw cp(e,t,r.evaluation,n,!(r.cause instanceof Ve),{stage:r.stage,errorCode:oP(r.cause)}),r}}function cp(e,t,n,r,o=!0,i){ap(e,sp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function oP(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Ve)return"tool-input-limit";if(e instanceof We)return"structural-shell-syntax-limit";return"unexpected-error"}function Et(e,t={}){return{malformed:!0,denial:_n(t),cwd:e}}function dp(e,t={}){return(n,r)=>{try{return iP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(_n())}}}function iP(e,t,n,r){let o=Fl();if(n.cancelled?.(t))return n.block(_n());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return lp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=ll(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=up(o,i,{guard:{auditAllowed:zl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Kt))throw l;if(xt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${ul(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var fp="exec",sP=new Set(["auto","gateway"]);function mp(e){e.on("before_tool_call",aP(e),{matcher:[fp],priority:50})}function aP(e,t={}){return dp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>lP(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>dP(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function lP(e,t,n,r){if(!e||typeof e!=="object")return Et(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Et(null);if(o!==fp)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Et(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Et(null,{toolName:o});if(s.host!==void 0&&!sP.has(s.host))return Et(null,{command:a,toolName:o});let l=cP(n,t.agentId,r);if(!l)return Et(null,{command:a,toolName:o});let c=uP(l,s,r);if(!c)return Et(l,{command:a,segment:typeof s.workdir==="string"?s.workdir:void 0,toolName:o});return Tn(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function cP(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return wi(".",[r],n)}catch{return}}function uP(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return wi(r,[e],n)}function dP(e){return{block:!0,blockReason:cl(e)}}var yL={...al,register:mp};export{yL as default};