cc-safety-net 2.4.3 → 2.4.5

package/dist/bin/hook.js

@@ -1,47 +1,47 @@
 #!/usr/bin/env node
-var xp=["-h","--help"];function Ur(e,t){let n=Object.entries(e.booleans??{}),r=Object.entries(e.values??{}),o=Object.entries(e.lists??{}),i=Object.fromEntries(n.map(([u])=>[u,!1])),s={},a=Object.fromEntries(o.map(([u])=>[u,[]])),l=[],c=[],d=!1,m=-1;for(let[u,f]of t.entries()){if(u<=m)continue;if(f==="--"){l.push(...t.slice(u+1));break}if(xp.includes(f)){d=!0;continue}let p=n.find(([,y])=>y.includes(f));if(p){i[p[0]]=!0;continue}let g=r.find(([,y])=>y.includes(f));if(g){let y=t[u+1];if(y===void 0||y.startsWith("-")){c.push(`${f} requires a value`);continue}s[g[0]]=y,m=u+1;continue}let h=o.find(([,y])=>y.includes(f));if(h){let y=t.slice(u+1),v=y.findIndex((b)=>b.startsWith("-")),E=y.slice(0,v===-1?y.length:v);if(E.length===0){c.push(`${f} requires at least one value`);continue}a[h[0]]=[...a[h[0]]??[],...E],m=u+E.length;continue}if(f.startsWith("-")){c.push(`Unknown option for ${e.label}: ${f}`);continue}if(e.positionals==="tail"){l.push(...t.slice(u));break}l.push(f)}if(e.positionals!=="list"&&e.positionals!=="tail")c.push(...l.map((u)=>`Unexpected argument for ${e.label}: ${u}`));return{flags:i,values:s,lists:a,positionals:l,help:d,errors:c}}var Hn=require("node:path");var Di="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",rt="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",$n="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Mi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Un={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},Z=Object.freeze({realpathAttempts:{cap:16384,...Mi},processedCandidateBytes:{cap:4194304,...Mi},pathEnvironmentExpansion:{cap:64,...Mi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Un},trackedHeredocFiles:{cap:64,...Un},controlFlowStates:{cap:64,...Un},wrapperPeelIterations:{cap:20,...Un},derivedCommandShape:Un});class O extends Error{kind;name="AnalysisLimit";constructor(e){super(Z[e].reason);this.kind=e}}function de(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>Z[t].cap)throw new O(t)}}}var _p=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function xt(e){return wp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function wp(e){return _p.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Ap={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Pp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,Ap[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+var Np=["-h","--help"];function Vr(e,t){let n=Object.entries(e.booleans??{}),r=Object.entries(e.values??{}),o=Object.entries(e.lists??{}),i=Object.fromEntries(n.map(([d])=>[d,!1])),s={},a=Object.fromEntries(o.map(([d])=>[d,[]])),l=[],c=[],u=!1,m=-1;for(let[d,f]of t.entries()){if(d<=m)continue;if(f==="--"){l.push(...t.slice(d+1));break}if(Np.includes(f)){u=!0;continue}let p=n.find(([,y])=>y.includes(f));if(p){i[p[0]]=!0;continue}let h=r.find(([,y])=>y.includes(f));if(h){let y=t[d+1];if(y===void 0||y.startsWith("-")){c.push(`${f} requires a value`);continue}s[h[0]]=y,m=d+1;continue}let g=o.find(([,y])=>y.includes(f));if(g){let y=t.slice(d+1),v=y.findIndex((S)=>S.startsWith("-")),E=y.slice(0,v===-1?y.length:v);if(E.length===0){c.push(`${f} requires at least one value`);continue}a[g[0]]=[...a[g[0]]??[],...E],m=d+E.length;continue}if(f.startsWith("-")){c.push(`Unknown option for ${e.label}: ${f}`);continue}if(e.positionals==="tail"){l.push(...t.slice(d));break}l.push(f)}if(e.positionals!=="list"&&e.positionals!=="tail")c.push(...l.map((d)=>`Unexpected argument for ${e.label}: ${d}`));return{flags:i,values:s,lists:a,positionals:l,help:u,errors:c}}var jn=require("node:path");var zi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",rt="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",qn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Gi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Kn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},X=Object.freeze({realpathAttempts:{cap:16384,...Gi},processedCandidateBytes:{cap:4194304,...Gi},pathEnvironmentExpansion:{cap:64,...Gi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Kn},trackedHeredocFiles:{cap:64,...Kn},controlFlowStates:{cap:64,...Kn},wrapperPeelIterations:{cap:20,...Kn},derivedCommandShape:Kn});class M extends Error{kind;name="AnalysisLimit";constructor(e){super(X[e].reason);this.kind=e}}function de(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>X[t].cap)throw new M(t)}}}var Lp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function _t(e){return Wp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Wp(e){return Lp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Fp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Gp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,Fp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function Ni(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function fn(e={}){return{reason:$n,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function pl(e){return Pp({...e,redact:xt})}function gl(e){return xt(e instanceof Error?e.message:String(e))}var Ee=require("node:path");var Tp=256,$r=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function ke(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function _t(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Gi(e,t){return Li(e,0,t)}function Li(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Wi(e,o+2),a=Ip(e,o,t);if(a===null){if($r.has(s))throw new O("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=kp(l,t,n),o=a+1;continue}let i=Wi(e,o+1);if(!i){r+="$",o++;continue}r+=Fi(i,n)??`$${i}`,o+=i.length+1}return r}function Ip(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>Z.pathEnvironmentExpansion.cap)throw new O("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function kp(e,t,n){let r=e.slice(2,-1),o=Wi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Fi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if($r.has(o))throw new O("pathEnvironmentExpansion");return e}if(!$r.has(o))return e;if(s.endsWith("="))throw new O("pathEnvironmentExpansion");let a=Fi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new O("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Li(i.slice(s.length),t+1,n);return l?Li(i.slice(s.length),t+1,n):""}function Wi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Fi(e,t){if(!$r.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function D(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){yl(n,i);let s=t.realpath(i);if(s!==null)return hl(n,e,s,o);let a=Ee.dirname(i);if(a===i||o.length>=Tp)return hl(n,e,i,o);o.push(Ee.basename(i)),i=a}}function hl(e,t,n,r){let o=r.length===0?n:Ee.join(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Op(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;yl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function yl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ge(e,t,n,r){let o=bl(e,t,n);if(!o)return"";return D(o,n.paths,r).replace(/\\/g,"/")}function Cl(e,t,n,r,o){let i=bl(e,t,n);if(!i)return null;if(o(Ee.basename(i)))return D(i,n.paths,r).replace(/\\/g,"/");let s=Op(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function bl(e,t,n){let r=n.home,o=Gi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Ee.resolve(r,o.slice(2)):o,s=ke(i);return Ee.normalize(Ee.isAbsolute(s)?s:Ee.resolve(t,s))}var _l=require("node:util"),Mp=new Set(["applypatch","patch"]),Dp=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Np=new Set(["grep","grepsearch","rg"]),Lp=new Set(["find","findbyname","glob"]),Wp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Fp=new Set(["command","diff","input","patch","patchtext"]),Sl=new TextEncoder,Gp=new TextDecoder,zp=/\s/,Hp=64;class be extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var jn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function wl(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Vr(e){return Wp.has(wl(e))}function Al(e){let t=wl(e);if(Mp.has(t))return"patch";if(Np.has(t))return"grep";if(Lp.has(t))return"glob";if(Dp.has(t))return"path";return"unknown"}function wt(e){if(!e||typeof e!=="object")return;Ol(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)ot();return}if(t.get||t.set)ot();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Kr(e,t){return Pl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Pl(e,t,n,r){let o=kl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Pl(a,t,n,r+1);return typeof a==="string"&&t.has(Tl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Tl(e){return e.replace(/-/g,"_").toLowerCase()}function qr(e){return Il(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Up)}function Il(e,t,n,r){let o=kl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Il(a,o.array?t:Fp.has(Tl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Bp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>jn.maxDepth||t.nodes>jn.maxNodes)ot();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>jn.maxStringBytes||t.stringBytes>jn.maxAggregateStringBytes)ot()}function kl(e,t,n){if(Bp(e,t,n),!e||typeof e!=="object")return null;let r=Ol(e);if(t.ancestors.has(e))ot();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>jn.maxKeys)ot();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)ot();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Ol(e){if(_l.types.isProxy(e))ot();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)ot();return t}function ot(){throw new be}function Up(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=$p(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...zi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...zi(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(...Bi(jr(c.slice(4),!0),jr(d.slice(4),!0))),l++;continue}if(!r)t.push(...zi(c))}return t}function $p(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function zi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return xl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return xl(n[1]);if(e.startsWith("diff --git "))return jp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Rl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Rl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Jp(i[1]);return[]}function jp(e){let t=Vp(e);if(t.length===2&&t[0]&&t[1])return Bi(t[0],t[1]);let n=Kp(e);return n?Bi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Vp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Bt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Bt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Ml(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Bt(e[n]))n++;return n===e.length?t:[]}function Kp(e){let t=0;while(t<e.length&&Bt(e[t]))t++;let n=e.length;while(n>t&&Bt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Bt(e[o])){o++;continue}let i=o;while(o<n&&Bt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Hp)ot();if(qp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function qp(e,t,n,r,o){if(Hi(e,t,n,r,o))return!0;let i=vl(e,"/",t,n),s=vl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Hi(e,t,i,r,s))return!1;return Hi(e,i+1,n,s+1,o)}function Hi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function vl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Bt(e){return e!==void 0&&zp.test(e)}function Ml(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Gp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Sl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Sl.encode(Yp(s[0]??""))),o+=2}return null}function Yp(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function Zp(e){return Vn(Qp(e))}function Bi(e,t){if(e==="/dev/null")return El(t);if(t==="/dev/null")return El(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Vn);let n=Xp(e,t)??(e===t?Dl(e):null);return[e,t,...n?[n]:[]].flatMap(Vn)}function El(e){let t=Dl(e);return[e,...t?[t]:[]].flatMap(Vn)}function Dl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Xp(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Rl(e){return Zp(jr(e,!0))}function Jp(e){return Vn(jr(e,!1))}function jr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Ml(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Qp(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Vn(e){return e===""||e==="/dev/null"?[]:[e]}function xl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}var ct=require("node:path");function ut(e,t,n){if(_t(e))return;let r=t.flatMap((i)=>Ui(i,n));if(!r[0])return;let o=Ui(ct.isAbsolute(e)?e:ct.resolve(r[0],e),n)[0];if(!o)return;return r.some((i)=>$i(o,i))?o:void 0}function it(e,t){return e.flatMap((n)=>Ui(n,t))[0]}function Ui(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function $i(e,t){let n=ct.relative(t,e);return n===""||n!==".."&&!n.startsWith(`..${ct.sep}`)&&!ct.isAbsolute(n)}var eg=8388608;async function Nl(e){let t=[],n=0;for await(let r of e){let o=typeof r==="string"?Buffer.from(r,"utf-8"):Buffer.from(r.buffer,r.byteOffset,r.byteLength);if(n+=o.byteLength,n>eg)throw tg(e),Error("hook input byte limit exceeded");t.push(o)}return Buffer.concat(t,n).toString("utf-8")}function tg(e){let t=e.destroy??e.cancel;if(!t)return;try{Promise.resolve(t.call(e)).catch(()=>{})}catch{}}function Yr(e,t,n){try{return JSON.parse(e)}catch{t({reason:n});return}}function se(e,t){let n=t.get(e);return n?{kind:"command",shell:n}:{kind:Al(e)}}function Ll(e,t,n,r,o,i){let s=e===void 0?i:e,a=typeof s==="string"&&s.trim()!==""?it([s],o):void 0;if(a)return{configCwd:a,executionCwd:a};return ee(r,t,n,ng(s)),null}function ee(e,t,n,r){let o;try{o=wt(t)}catch(i){if(!(i instanceof be))throw i}e(fn({command:o,segment:r,toolName:n}))}function ng(e){return typeof e==="string"?e:void 0}var gn=require("node:fs"),Zr=require("node:os");var Bl=require("node:fs"),Ul=require("node:path");var Fl=require("node:child_process"),z=require("node:fs"),ne=require("node:path"),rg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],og=5000;function Gl(e,t=vg(),n=og){let r=ig(e),o=r===null?null:sg(r);if(r===null||o===null)return null;let i=bg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function ig(e){try{let t=z.realpathSync(ne.resolve(e));return z.statSync(t).isDirectory()?t:null}catch{return null}}function sg(e){let t=Cg(e);if(!t)return null;try{let n=z.lstatSync(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=ji(t);if(!r?.commonDir)return null;if(!cg(r.gitDir,t))return null;return ug(r.gitDir,ne.dirname(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function ji(e){try{let t=ag(e);if(!t)return null;let n=z.realpathSync(ne.isAbsolute(t)?t:ne.resolve(ne.dirname(e),t));if(!z.statSync(n).isDirectory())return null;return{gitDir:n,commonDir:lg(n)}}catch{return null}}function ag(e){let t=z.readFileSync(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function lg(e){try{let t=z.readFileSync(ne.join(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=z.realpathSync(ne.isAbsolute(t)?t:ne.resolve(e,t));return z.statSync(n).isDirectory()?n:null}catch{return null}}function cg(e,t){let n=dg(e);return n===null?!1:zl(e,n,t)}function ug(e,t){let n=mg(e);return n===null?!0:zl(e,n,t)}function dg(e){let t=ne.join(e,"gitdir");if(!z.existsSync(t))return null;let n=z.readFileSync(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function mg(e){let t=ne.join(e,"config.worktree");return z.existsSync(t)?pg(t):null}function zl(e,t,n){try{return fg(ne.isAbsolute(t)?t:ne.resolve(e,t),n)}catch{return!1}}function fg(e,t){try{let n=z.statSync(e),r=z.statSync(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Wl(z.realpathSync.native(e))===Wl(z.realpathSync.native(t))}function Wl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function pg(e){let t=z.readFileSync(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=gg(s[1]??"")}return r}function gg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return yg(t.slice(1,-1))}var hg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function yg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:hg[n]??t)}function Cg(e){try{return Vi(z.realpathSync(e))}catch{return null}}function Vi(e){let t=e;while(!0){let n=ne.join(t,".git");if(z.existsSync(n))return n;let r=ne.dirname(t);if(r===t)return null;t=r}}function bg(e,t,n,r){if(Sg(t))return!0;if(n===null)return!0;let o=Fl.spawnSync(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Eg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Hl(o.stdout.trim())}function Sg(e){return[ne.join(e.commonDir,"config"),ne.join(e.gitDir,"config.worktree")].filter((t)=>z.existsSync(t)).some((t)=>Rg(t))}function vg(){return rg.find((e)=>z.existsSync(e))??null}function Kn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Eg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Kn(t)))}function Rg(e){let t;try{t=z.readFileSync(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(xg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Hl(c)}return r}function xg(e){return e==="include"||e.startsWith("includeif ")}function Hl(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function $l(e,t){if(e==="")return null;let n=de(),r=Vi(ge(e,e,t,n)),o=r?_g(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function _g(e,t,n,r){try{let o=ge(e,t,n,r),i=Bl.statSync(e),s=i.isFile()?o:null,a=i.isFile()?ji(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[pn(ge(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[pn(e.replace(/\\/g,"/")),...l]:l)];return{entry:pn(o),markerFile:s?pn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let m=pn(Ul.join(d,"hooks").replace(/\\/g,"/"));return[m,pn(ge(m,t,n,r))]}))]}}catch{return null}}function pn(e){return process.platform==="win32"?e.toLowerCase():e}var wg={realpath:(e)=>{try{return gn.realpathSync(e)}catch{return null}},entryKind:(e)=>{let t=gn.lstatSync(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return gn.statSync(e).isDirectory()}catch{return!1}}};function Vl(){return Ag({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:ke(process.env.HOME||Zr.homedir()),tmpdir:Zr.tmpdir(),paths:wg})}function Ag(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>jl(n,i,()=>$l(i,o)),worktreeFacts:(i)=>jl(r,i,()=>Gl(i)),...t};return o}function jl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var hn=["fail_closed","paranoid_rm","paranoid_interpreters"],Xr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ae={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Jr=["standard","strict","paranoid"];function Pg(e,t){if(!t)return e;return Jr.indexOf(t)>Jr.indexOf(e)?t:e}function Tg(e){let t=Zi(ae.level,e);if(t===void 0||t==="")return;if(Jr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ae.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Jr.join(", ")}.`);return}function Ig(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Kl(e){return Ig(Zi(ae.auditScope,e))==="all"}function qi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Yi(e={},t){let n=e.safety?.level??"standard",r=Tg(t),o=Pg(n,r),i=Xr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ae.level.name}=${r}`),l.paranoidRm.push(`env ${ae.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ae.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Ut(ae.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ae.strict.name}`);if(Ut(ae.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ae.paranoid.name}`),l.paranoidInterpreters.push(`env ${ae.paranoid.name}`);if(Ut(ae.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ae.paranoidRm.name}`);if(Ut(ae.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ae.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Ut(ae.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:qi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Ut(e,t){let n=typeof e==="string"?Ki(e,t):Zi(e,t);return n==="1"||n?.toLowerCase()==="true"}function Ki(e,t){return t.get(e)}function Zi(e,t){let n=Ki(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Ki(e.legacyName,t);return}function qn(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}var Jn=require("node:path");var W=require("node:fs"),U=require("node:path");function Xi(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var kg=Symbol("PolicyFilesystemScope"),Og=Symbol("PolicyFilesystemTarget"),Mg=W.constants.O_NOFOLLOW??0;class he extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function $t(e,t){return{[kg]:!0,root:U.resolve(e),label:t}}function ql(e,t){let n=U.normalize(t);if(t===""||U.isAbsolute(t)||n===".."||n.startsWith(`..${U.sep}`))throw new he(e.label);return{[Og]:!0,scope:e,relativePath:n,path:U.join(e.root,n)}}function Yn(e,t){return ql(e,U.relative(e.root,U.resolve(t)))}function Yl(e,t="rules policy"){let n=U.resolve(e),r=U.parse(n).dir;return ql($t(r,t),U.relative(r,n))}function eo(e){return Xl(e.scope.label,()=>{if(!Qr(e))return null;let t=W.openSync(e.path,W.constants.O_RDONLY|Mg);return Dg(t,()=>{let n=W.fstatSync(t);if(!n.isFile())throw new he(e.scope.label);let r=W.readFileSync(t,"utf-8"),o=W.lstatSync(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new he(e.scope.label);return Qr(e),r})})}function Zl(e,t){if(e.path===t.path)return!0;return Xl(e.scope.label,()=>{if(!Qr(e)||!Qr(t))return!1;let n=(r)=>U.join(W.realpathSync(U.parse(r).dir),U.parse(r).base);return n(e.path)===n(t.path)})}function Xl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof he)throw r;throw new he(e)}}function Dg(e,t){try{return t()}finally{W.closeSync(e)}}function Qr(e,t="file"){let n=Ng(e.scope);if(!n)return!1;let r=e.relativePath.split(U.sep);for(let o of r.keys()){let i=U.join(e.scope.root,...r.slice(0,o+1)),s=W.lstatSync(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new he(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new he(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new he(e.scope.label);Lg(n,W.realpathSync(i),e.scope.label)}return!0}function Ng(e){if(!W.lstatSync(e.root,{throwIfNoEntry:!1}))return null;if(!W.statSync(e.root).isDirectory())throw new he(e.label);return W.realpathSync(e.root)}function Lg(e,t,n){let r=U.relative(e,t);if(r===".."||r.startsWith(`..${U.sep}`)||U.isAbsolute(r))throw new he(n)}var N=require("node:path");var jt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Jl="rulebook.json",Ql=".cc-safety-net/rules";var ec=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Wg=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Fg=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Gg="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),wA=new RegExp(`^${Fg}/(${jt.source.slice(1,-1)})/${Gg}$`);function zg(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function tc(e){if(to(e))try{return Ji(e),null}catch(t){return t instanceof Error?t.message:String(t)}return jt.test(e)?null:`Local rulebook sources must be bare names matching ${jt}: ${e}`}function Ji(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(ec);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Wg.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!jt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:zg(o),name:o}}function to(e){return ec.test(e)}var nc="rule.json",no="policy.json",rc=".cc-safety-net",Hg="rules",Bg="CC_SAFETY_NET_HOME",oc="`cc-safety-net rule update`";function Ug(e){return N.resolve(e,Ql)}function $g(e){return N.join(Ug(e),nc)}function Zn(e){return N.join(N.resolve(e),rc,no)}function Qi(e,t={}){return t.userConfigDir??(t.userConfigPath?N.dirname(t.userConfigPath):N.join(jg(e),Hg))}function jg(e){let t=e.env.get(Bg);return t?N.resolve(ke(t)):N.join(e.home,rc)}function Vg(e,t={}){return N.join(Qi(e,t),nc)}function yn(e,t={}){return N.join(N.dirname(Qi(e,t)),no)}function ic(e,t){let n=t.userConfigPath??Vg(e,t),r=t.projectConfigPath??$g(t.cwd),o=Kg(e,t),i=qg(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Yn(o,n),projectConfigTarget:Yn(i,r)}}function Kg(e,t){let n=t.userConfigPath?N.dirname(N.dirname(N.resolve(t.userConfigPath))):N.dirname(N.resolve(t.userConfigDir??Qi(e,t)));return $t(n,"user policy")}function qg(e,t){let n=N.resolve(t),r=N.resolve(e),o=N.relative(n,r);if(o!==".."&&!o.startsWith(`..${N.sep}`)&&!N.isAbsolute(o))return $t(n,"project policy");return $t(N.dirname(N.dirname(r)),"project policy")}function sc(e,t){return N.join(e,t,Jl)}var Oe=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),At=/^[a-zA-Z][a-zA-Z0-9_-]*$/,Pt=256,ie=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),ac=new Set(["python","python3","python2","node","ruby","perl"]),ro=/^python(?:[23](?:\.\d+)*)?$/,ze=new Set(["awk","gawk","nawk","mawk"]),oo=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var lc="Rulebook exceeds CC Safety Net's safe validation limits.",cc="Additional rulebook validation errors were omitted.",je=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function uc(e){if(es(e.allowed_commands,je.maxAllowedCommands)||es(e.rules,je.maxRules)||es(e.tests,je.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=je,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>je.maxStringCodeUnits||i&&o.length>je.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>je.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function es(e,t){return Array.isArray(e)&&e.length>t}var ts=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ns=64,rs="Rule config exceeds CC Safety Net's safe source limit.";function L(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function Re(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Yg={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},os=new Set(["--init-file","--rcfile"]);function is(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let d=t[c];if(d===void 0)break;if(e==="ksh"&&d==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&d==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&d==="o"&&c+1<t.length)break;if(r==="startup"&&d==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&d==="c")s=!0;if(r==="argv"&&d==="n")l=t[0]==="-";if(r==="argv"&&d==="s")a=t[0]==="-";if(!Yg[e]?.includes(d))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Me(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&os.has(l)&&!s.includes("="))i++;continue}let a=is(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Xn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function io(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Zg(e))Xn(n,t);return t.inSingle||t.inDouble}function Zg(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Xn(s,n)}return t}var ss=new Set(["rm","find","xargs","parallel"]),Xg=new Set(["git","busybox",...ss,...ie,...ac,...ze]),Jg=new Set(["python","node","ruby","perl"]);function dc(e){let t=L(e);return Xg.has(t)||Ve(t)}function Ve(e){return Jg.has(Qg(e))}function Qg(e){let t=k(e).toLowerCase();return ro.test(t)?"python":t}function as(e){try{let t=eo(eh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=rh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof he)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function eh(e){return typeof e==="string"?Yl(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),me=(e,t)=>({path:e,message:t,kind:"custom"});function mc(e){let t=new Set;return e.flatMap((n,r)=>{let o=Cn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[me(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ls=`must be one of ${ts.join(", ")}`,th=/^[^/]+\/[^/]+$/,nh=["version","rules","overrides","transparent_wrappers"];function rh(e){let t=oh(e);return{errors:cs(fh(t,nh,(n)=>n.kind==="custom"),": "," "),sources:mh(e,t)}}function oh(e){if(!Cn(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>ns;return[...e.version===1?[]:[_(["version"],"must be 1")],...ih(e.rules,t),...lh(e.overrides),...uh(e.transparent_wrappers),...t?[]:ah(e.rules),...Cn(e.overrides)?Object.keys(e.overrides).filter((n)=>!th.test(n)).map((n)=>me(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...dh(e.transparent_wrappers)]}function ih(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...fc(e,ns)?[_(["rules"],rs)]:[]];if(t)return[{path:["rules"],message:rs,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...sh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function fc(e,t){let n=pc(e);return n!==void 0&&!(n<=t)}function sh(e,t){let n=pc(e);return n!==void 0&&!(n>=t)}function pc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function ah(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[me(["rules",r],"must be a non-empty rulebook source string")];let o=tc(n);if(o)return[me(["rules",r],o)];if(t.has(n))return[me(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function lh(e){if(e===void 0)return[];if(!Cn(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!Cn(n))return[_(["overrides",t],'must be "off" or an object')];return[...ch(n.reason,["overrides",t,"reason"]),...n.intent===void 0||ds(n.intent)?[]:[_(["overrides",t,"intent"],ls)]]})}function ch(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...fc(e,Pt)?[_(t,`must be at most ${Pt} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>Pt?[_(t,`must be at most ${Pt} characters`)]:[]}function uh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return At.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function dh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!At.test(n))return[];if(t.has(n))return[me(["transparent_wrappers",r],`duplicate command "${n}"`)];if(dc(n))return[me(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function mh(e,t){let n=Cn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function fh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function cs(e,t,n){return[...new Set(e.map((r)=>{let o=us(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function us(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function ds(e){return ts.includes(e)}function Cn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function hc(e){let t=hh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var ph=`required non-empty string up to ${Pt} characters`,gc="must be a non-empty array of unique non-empty strings",gh="required non-empty array of non-empty strings";function hh(e){if(!Tt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!uc(e))return{errors:[lc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...cs(yh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>je.maxValidationErrors?[...t.slice(0,je.maxValidationErrors),cc]:t,ruleNames:new Set(yc(e).map((n)=>n.toLowerCase()))}}function yc(e){let t=Tt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=Tt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function yh(e,t){return[...typeof e.name==="string"&&jt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Ch(e.allowed_commands),...bh(e.rules,t),...Rh(e.tests),...xh(e),..._h(e)]}function Ch(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&At.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!At.test(n))return[];if(t.has(n))return[me(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function bh(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!Tt(n))return[_(["rules",r],"must be an object")];return t?vh(n,["rules",r]):Sh(n,["rules",r])}),...mc(e)]}function Sh(e,t){return[...Cc(e.name,t),...bc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&At.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...so(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Sc(e.reason,t),...vc(e.intent,t)]}function vh(e,t){return[...Cc(e.name,t),...bc(e.command,t),...Sc(e.reason,t),...vc(e.intent,t),...Eh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function Cc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return jt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function bc(e,t){return typeof e==="string"&&At.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function Sc(e,t){return typeof e==="string"&&e!==""&&e.length<=Pt?[]:[_([...t,"reason"],ph)]}function vc(e,t){return e===void 0||ds(e)?[]:[_([...t,"intent"],ls)]}function Eh(e,t){if(!Tt(e))return[_(t,"required object")];return[...so(e.command_path,[...t,"command_path"],gh,!1),...e.any_args===void 0?[]:so(e.any_args,[...t,"any_args"],gc,!0),...e.exclude_args===void 0?[]:so(e.exclude_args,[...t,"exclude_args"],gc,!0)]}function so(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[me([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[me(t,n)]:[],...r&&new Set(e).size!==e.length?[me(t,"must not contain duplicate values")]:[]]}function Rh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!Tt(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[me(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function xh(e){if(!Array.isArray(e.tests))return[];let t=new Set(yc(e));return[...new Set(e.tests.flatMap((n)=>Tt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>me(["tests"],`blocked fixture references unknown rule "${n}"`))}function _h(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=Tt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[me(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function Tt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ac(e,t){let n=ic(e,t),r=!1;try{r=Zl(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof he)return Dh(n,f.message);throw f}let o=as(n.userConfigTarget),i=r?{config:null,errors:[]}:as(n.projectConfigTarget),s=_c(n.userConfigPath,o.errors),a=_c(n.projectConfigPath,i.errors),l=new Set,c=o.config?Ec(o.config,Jn.dirname(n.userConfigPath),"user",n.userScope,l):wc(),d=i.config?Ec(i.config,Jn.dirname(n.projectConfigPath),"project",n.projectScope,l):wc(),m=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...Rc(c.rules,m),...Rc(d.rules,u)],transparent_wrappers:Oh(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?xc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Mh(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?xc(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Ec(e,t,n,r=$t(Jn.dirname(Jn.dirname(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=Ah(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let m=d.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:wh(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((u)=>`${m.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function wh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Ah(e,t,n){let r=Ph(e),o=sc(t,r),i=Ih(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Th(e)}`]};let s=kh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Ph(e){return to(e)?Ji(e).name:e}function Th(e){return to(e)?`run ${oc} to vendor ${e}`:"create that file or remove that source from the rules config"}function Ih(e,t){try{return{content:eo(Yn(t,e))}}catch(n){if(n instanceof he)return{error:n.message};throw n}}function kh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:hc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function Oh(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Rc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function xc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Mh(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function _c(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Dh(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function wc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}var yo=require("node:fs");var Pc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ms=new Set(Pc.map((e)=>e.id)),ao=Pc,Nh=new Map(ao.map((e)=>[e.id,e.intent]));function S(e,t){return{id:e,reason:t,intent:Nh.get(e)??"manual_only"}}var fs=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],lo={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Lh=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Wh=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ps=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Wh.flatMap((e)=>Lh.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var co=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Tc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Fh=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],gs=Tc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),hs=Tc.flatMap((e)=>Fh.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Qn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ys=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),Cs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Gh=[...fs,lo,...ps,...gs,...hs,Qn,...ys,...Cs,...co].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),uo=new Set(co.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),bs=new Set(Gh.map((e)=>e.id));var De=require("node:path"),Ic=process.platform==="win32",zh=/[*?]/;function er(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Ss(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=er(e.trim(),t);if(!De.isAbsolute(n))return"must be an absolute path or start with ~/";return tr(n,t)}function vs(e,t){let n=kc(e,t);if(n===null)return"must be a non-empty path string";if(!De.isAbsolute(n))return null;if(tr(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Hh="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Bh="cannot cover the guard's own configuration";function kc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return er(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Es(e,t){let n=kc(e,t);if(n===null)return"must be a non-empty path string";if(zh.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!De.isAbsolute(n))return null;if(tr(n,t)!==null)return Hh;return Uh(n,t)?Bh:null}function Uh(e,t){let n=mo(e),r=mo(De.join(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${De.sep}`)}function tr(e,t){let n=mo(e),r=mo(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(De.sep)?n:`${n}${De.sep}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function mo(e){let t=De.normalize(e);if(Ic)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Ic?3:1)&&t.endsWith(De.sep))t=t.slice(0,-1);return t}var Oc=30,fo=1,po=365;function Mc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Dc=new Set(ao.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(Dc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function fe(e,t,n){if(Dc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Nc(e,t){return Object.freeze(Object.fromEntries(ao.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Lc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Nc(e,t)})}var Wc={standard:0,strict:1,paranoid:2};function zc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:Rs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:Rs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:Rs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:$h(e,t)}}function Rs(e,t){return[...new Set([...e,...t??[]])]}function $h(e,t){let n=t.safety?.level,r=Xr[e.safety.level];return[...n&&Wc[n]<Wc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...hn.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Fc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Fc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!uo.has(o))),...e.destructive_command_protection.enabled?Gc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Gc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Fc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Gc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var ws=new Set(["standard","strict","paranoid"]),$c={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Oc}};function jc(e,t){let n=ey(yn(e,t),e.home),r=Co(Zn(t.cwd),e.home),o=Vh(r.parsed,e.home),i=Object.keys(o.policy).length>0?zc(n.gui??$c,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?_s(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var jh="project policy audit settings are ignored; audit is user scope only";function Vh(e,t){if(!Ne(e))return{policy:{},diagnostics:[]};let n=Ne(e.safety)?e.safety:{},r=Ne(e.workflow)?e.workflow:{},o=Ne(e.destructive_command_protection)?e.destructive_command_protection:{},i=Ne(e.secret_protection)?e.secret_protection:{},s={...ws.has(n.level)?{level:n.level}:{},...Ne(n.overrides)?Hc({overrides:Vc(n.overrides,hn,["safety","overrides"],Vt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:ho(o.overrides,ms,qc,Vt)}:{},...o.allow_paths!==void 0?{allow_paths:Sn(o.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],Vt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:ho(i.overrides,bs,Yc,Vt)}:{},...i.deny_paths!==void 0?{deny_paths:Sn(i.deny_paths,vs,t,["secret_protection","deny_paths"],Vt)}:{},...i.allow_paths!==void 0?{allow_paths:Sn(i.allow_paths,Es,t,["secret_protection","allow_paths"],Vt)}:{}};return{policy:Hc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[jh]}}function Vc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],As));return[]}))}function Hc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Vt=()=>{return},As="must be a boolean",Ps="must be an object if provided",Kc=`must be an integer between ${fo} and ${po}`,qc={path:["destructive_command_protection","overrides"],label:"destructive command"},Yc={path:["secret_protection","overrides"],label:"secret protection"},Kh=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function qh(e,t){let n=[];return{policy:Zc(e,t,(o)=>{n.push(o)}),issues:n}}function Yh(e,t){return Zc(e,t,Vt)}function Zc(e,t,n){if(!Ne(e))return n(_([],"Config must be an object")),go();if(e.version!==1)n(_(["version"],"must be 1"));let r=bn(e.safety,["safety"],["level","overrides"],n),o=bn(r.overrides,["safety","overrides"],hn,n),i=bn(e.workflow,["workflow"],["worktree_mode"],n),s=bn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=bn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=bn(e.audit,["audit"],["retention_days"],n);return Xc(e,Kh,[],n),{version:1,safety:{level:Zh(r.level,n),overrides:Vc(o,hn,["safety","overrides"],n)},workflow:{worktree_mode:xs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:xs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:ho(s.overrides,ms,qc,n),allow_paths:Sn(s.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:xs(a.enabled,["secret_protection","enabled"],!0,n),overrides:ho(a.overrides,bs,Yc,n),deny_paths:Sn(a.deny_paths,vs,t,["secret_protection","deny_paths"],n),allow_paths:Sn(a.allow_paths,Es,t,["secret_protection","allow_paths"],n)},audit:{retention_days:Xh(l.retention_days,n)}}}function bn(e,t,n,r){if(e===void 0)return{};if(!Ne(e))return r(_(t,Ps)),{};return Xc(e,n,t,r),e}function Xc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function Zh(e,t){if(e===void 0)return"standard";if(ws.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function xs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,As));return n}function Xh(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=fo&&e<=po))t(_(["audit","retention_days"],Kc));return Mc(e)}function ho(e,t,n,r){if(e===void 0)return{};if(!Ne(e))return r(_(n.path,Ps)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function Sn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?me([...r,s],a):_([...r,s],a)),[]})}function Ne(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function go(){return structuredClone($c)}function Co(e,t){if(!yo.existsSync(e))return{exists:!1,policy:go(),errors:[]};try{let n=yo.readFileSync(e,"utf-8");if(!n.trim())return{exists:!0,policy:go(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=qh(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${Qh(i)}`),fallback:Ne(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:go(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var Jh=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ps,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[As,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Kc,`not an integer between ${fo} and ${po}`]]);function Qh(e){let t=us(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=Jh.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function ey(e,t){let n=Co(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ne(r))return{policy:Uc(),errors:[]};let o=Yh(r,t);return{policy:_s(o),gui:o,errors:[],levelPresent:Bc(r)}}if(n.parsed===void 0)return{policy:Uc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:_s(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Bc(n.parsed)}}function Bc(e){let t=Ne(e)&&Ne(e.safety)?e.safety:{};return ws.has(t.level)}function Jc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...uo].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Uc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Jc({}),denyPaths:[],allowPaths:[]}}}function _s(e){return{safety:ty(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Jc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function ty(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function Qc(e,t){let n=Ac(e,t),r=jc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...iy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return sy(o,ny(n,r),s,r.policyScopes)}function ny(e,t){let n=oy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:ay(e.errors.length>0?ry(e.errors):void 0,e.warnings.length>0?Is(e.warnings.join("; ")):void 0,n)}}function ry(e){return`${Is(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function oy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function iy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function sy(e,t,n=Object.freeze({}),r){let o=Ts(structuredClone(e)),i=r?{policyScopes:Ts(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ts(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ts(t);return Object.freeze(e)}function ay(...e){return Is(e.filter((t)=>!!t).join("; "))}function Is(e){return/[.!?]$/.test(e)?e:`${e}.`}function eu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:ks(t.fail_closed,e.strict,"strict"),paranoid_rm:ks(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:ks(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Lc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:qi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function ks(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function nr(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var ly=/^[A-Za-z_][A-Za-z0-9_]*=/;function bo(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function rr(e){let t=bo(e.words[0],"time")?1:0,n=t===1&&bo(e.words[t],"-p")?t+1:t,r=t===1&&bo(e.words[n],"--")?n+1:n,o=bo(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!ly.test(s.text));return i?.provenance==="literal"?i.text:void 0}var It=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function So(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function cy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>xe(t)))})}function vo(e,t,n){e.push(n),t.reset()}function Eo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Os(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function vn(e,t,n,r,o,i,s){return Os({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function xe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return cy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:xe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ms(e,t,n){if(t>=n||nu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!nu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=tu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=tu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ds(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=uy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?dy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function tu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function nu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function uy(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function dy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var su=new Set(["&&","||","|","|&"]);function au(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return xe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=_o(e,0,e.length,t,{used:0,max:t.maxWords},0);return xe({kind:"program",dialect:"posix",source:e,span:n,status:Po(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function _o(e,t,n,r,o,i,s){let a=[],l=[],c=So(),d=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((g)=>g.text);vo(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(s&&f===s)return m(),iu(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(Ao(f)){if(f===`
-`||f==="\r"){m();let b=f==="\r"&&e[u+1]===`
-`?u+2:u+1,T=a.at(-1);if(T?.kind!=="connector"||!su.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,b),span:Object.freeze({start:u,end:b})}));if(d.length>0){let R=Ds(e,b,n,d.splice(0));l.push(...R.issues),u=R.next;continue}u=b;continue}u++;continue}if(f==="#"){while(u<n&&e[u]!==`
-`&&e[u]!=="\r")u++;continue}let p=c.start===-1?Oy(e,u,n):void 0;if(p){if(Ls(a,l),i>=r.maxDepth)return En(a,l,u,"depth-limit",r.maxDepth);if(!Ns(o))return En(a,l,u,"word-limit",r.maxWords);let b=_o(e,p.braceIndex+1,n,r,o,i+1,"}"),T=b.next,R={start:p.braceIndex+1,end:b.closed?T-1:T},A=ru(e,R,b);if(a.push({kind:"function",name:p.name,span:{start:u,end:T},body:A}),l.push(...b.issues),b.pendingHeredocs.length>0||ir(b.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(d.push(...b.pendingHeredocs),b.limited)return xo(a,l,b.next);if(!b.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=T;continue}let g=wo(e,u);if(g){if(m(),!gu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:g,span:Object.freeze({start:u,end:u+g.length})})),u+=g.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:u,end:u+1}}),u++;continue}if((f==="("||f==="{"&&by(e,u,n))&&c.start===-1){if(Ls(a,l),i>=r.maxDepth)return En(a,l,u,"depth-limit",r.maxDepth);let b=f==="("?")":"}",T=_o(e,u+1,n,r,o,i+1,b),R=T.next,A={start:u+1,end:T.closed?R-1:R},J=ru(e,A,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:u,end:R},body:J}),l.push(...T.issues),T.pendingHeredocs.length>0||ir(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(d.push(...T.pendingHeredocs),T.limited)return xo(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});u=R;continue}let h=(f==="<"||f===">")&&e[u+1]!=="("?gy(e,u):null;if(h){let b=c.words.at(-1),T=b&&b.span.end===u&&/^[0-9]+$/.test(b.raw)?Number(b.raw):void 0;if(T!==void 0)c.words.pop();let R=T===void 0?u:b?.span.start??u;c.start=c.start===-1?u:c.start;let A=u+h.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let J=e[A],re=A>u+h.length&&J==="#",ce=!J||Ao(J)||!!wo(e,A)||J===s||J===")"||re||(J==="<"||J===">")&&e[A+1]!=="(",oe=h==="<<"||h==="<<-",K=oe?Ms(e,A,n):void 0,F=K?{word:vn(e,A,K.next,K.delimiter,"literal",K.quoted),nested:[],issues:[],next:K.next,limited:!1}:!ce?Ws(e,A,n,r,o,i):void 0;if(F){if(l.push(...F.issues),F.limited)return xo(a,l,F.next);if(!Ns(o))return En(a,l,F.next,"word-limit",r.maxWords)}let Ce=F?.next??u+h.length,Ge={kind:"redirection",operator:h,span:{start:R,end:Ce},...T===void 0?{}:{fd:T},...F?{target:F.word}:{}};if(c.redirections.push(Ge),oe&&!K)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(K){if(K.ambiguous||K.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let lt=c.nested;d.push({delimiter:K.delimiter,quotedDelimiter:K.quoted,stripTabs:h==="<<-",attach:($e)=>{if(Ge.heredoc=$e,$e.quotedDelimiter)return;lt.push(...fy(e,$e.bodySpan.start,$e.bodySpan.end,r,o,i+1))}})}if(!oe&&!F)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(F)c.nested.push(...F.nested);c.end=Ce,u=Ce;continue}if(c.start===-1)Ls(a,l);let y=Ws(e,u,n,r,o,i);if(l.push(...y.issues),y.limited)return xo(a,l,y.next);let v=Ey(c.words)?Ay(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return En(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let b of E){if(!Ns(o))return En(a,l,y.next,"word-limit",r.maxWords);c.words.push(b)}c.start=c.start===-1?u:c.start,c.end=y.next,c.nested.push(...y.nested),u=y.next>u?y.next:u+1}return m(),iu(a,l),l.push(...My(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function ru(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:Po(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ws(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],m=[],u=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||Ao(f)||(f===";"||f==="|"||f==="&")&&wo(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=my(e,a,n,r,o,i);if(s+=h.text,d.push(...h.nested),m.push(...h.issues),u||=h.limited,c=or(c,h.provenance),a=h.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let h=hy(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
-`){a+=2;continue}s+=h,a+=2;continue}let g=f==="$"||f==="<"||f===">"||f==="`"?To(e,a,n,r,o,i):null;if(g){let h=lu(g,d,m);if(u||=h.limited,c=or(c,h.provenance),a=h.next,u)break;continue}if(f==="$"){let h=du(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=or(c,"glob");s+=f,a++}return{word:vn(e,t,a,s,c,l,c==="literal"?void 0:Cy(e,t,a)),nested:d,issues:m,next:a,limited:u}}function my(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,m=t+1;while(m<n){let u=e[m];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:d};if(u==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
+`)}function Hi(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function pn(e={}){return{reason:qn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function vl(e){return Gp({...e,redact:_t})}function El(e){return _t(e instanceof Error?e.message:String(e))}var Ee=require("node:path");var zp=256,Kr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function ke(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function wt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function ji(e,t){return Bi(e,0,t)}function Bi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ui(e,o+2),a=Hp(e,o,t);if(a===null){if(Kr.has(s))throw new M("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Bp(l,t,n),o=a+1;continue}let i=Ui(e,o+1);if(!i){r+="$",o++;continue}r+=$i(i,n)??`$${i}`,o+=i.length+1}return r}function Hp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>X.pathEnvironmentExpansion.cap)throw new M("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Bp(e,t,n){let r=e.slice(2,-1),o=Ui(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return $i(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Kr.has(o))throw new M("pathEnvironmentExpansion");return e}if(!Kr.has(o))return e;if(s.endsWith("="))throw new M("pathEnvironmentExpansion");let a=$i(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new M("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Bi(i.slice(s.length),t+1,n);return l?Bi(i.slice(s.length),t+1,n):""}function Ui(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function $i(e,t){if(!Kr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function D(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){xl(n,i);let s=t.realpath(i);if(s!==null)return Rl(n,e,s,o);let a=Ee.dirname(i);if(a===i||o.length>=zp)return Rl(n,e,i,o);o.push(Ee.basename(i)),i=a}}function Rl(e,t,n,r){let o=r.length===0?n:Ee.join(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Up(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;xl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function xl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function he(e,t,n,r){let o=wl(e,t,n);if(!o)return"";return D(o,n.paths,r).replace(/\\/g,"/")}function _l(e,t,n,r,o){let i=wl(e,t,n);if(!i)return null;if(o(Ee.basename(i)))return D(i,n.paths,r).replace(/\\/g,"/");let s=Up(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function wl(e,t,n){let r=n.home,o=ji(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Ee.resolve(r,o.slice(2)):o,s=ke(i);return Ee.normalize(Ee.isAbsolute(s)?s:Ee.resolve(t,s))}var Ol=require("node:util"),$p=new Set(["applypatch","patch"]),jp=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Vp=new Set(["grep","grepsearch","rg"]),Kp=new Set(["find","findbyname","glob"]),qp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Yp=new Set(["command","diff","input","patch","patchtext"]),Al=new TextEncoder,Zp=new TextDecoder,Xp=/\s/,Jp=64;class Se extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Yn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Ml(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Yr(e){return qp.has(Ml(e))}function Dl(e){let t=Ml(e);if($p.has(t))return"patch";if(Vp.has(t))return"grep";if(Kp.has(t))return"glob";if(jp.has(t))return"path";return"unknown"}function At(e){if(!e||typeof e!=="object")return;Gl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)ot();return}if(t.get||t.set)ot();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Zr(e,t){return Nl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Nl(e,t,n,r){let o=Fl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Nl(a,t,n,r+1);return typeof a==="string"&&t.has(Ll(s))?[a]:l});return n.ancestors.delete(o.object),i}function Ll(e){return e.replace(/-/g,"_").toLowerCase()}function Xr(e){return Wl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(eg)}function Wl(e,t,n,r){let o=Fl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Wl(a,o.array?t:Yp.has(Ll(s)),n,r+1));return n.ancestors.delete(o.object),i}function Qp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Yn.maxDepth||t.nodes>Yn.maxNodes)ot();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Yn.maxStringBytes||t.stringBytes>Yn.maxAggregateStringBytes)ot()}function Fl(e,t,n){if(Qp(e,t,n),!e||typeof e!=="object")return null;let r=Gl(e);if(t.ancestors.has(e))ot();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Yn.maxKeys)ot();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)ot();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Gl(e){if(Ol.types.isProxy(e))ot();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)ot();return t}function ot(){throw new Se}function eg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=tg(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Vi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Vi(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...qi(qr(c.slice(4),!0),qr(u.slice(4),!0))),l++;continue}if(!r)t.push(...Vi(c))}return t}function tg(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Vi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return kl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return kl(n[1]);if(e.startsWith("diff --git "))return ng(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Il(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Il(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return cg(i[1]);return[]}function ng(e){let t=rg(e);if(t.length===2&&t[0]&&t[1])return qi(t[0],t[1]);let n=og(e);return n?qi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function rg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Ut(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Ut(e[n]))n++;t.push(e.slice(i,n));continue}let o=zl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Ut(e[n]))n++;return n===e.length?t:[]}function og(e){let t=0;while(t<e.length&&Ut(e[t]))t++;let n=e.length;while(n>t&&Ut(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Ut(e[o])){o++;continue}let i=o;while(o<n&&Ut(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Jp)ot();if(ig(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function ig(e,t,n,r,o){if(Ki(e,t,n,r,o))return!0;let i=Pl(e,"/",t,n),s=Pl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ki(e,t,i,r,s))return!1;return Ki(e,i+1,n,s+1,o)}function Ki(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Pl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Ut(e){return e!==void 0&&Xp.test(e)}function zl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Zp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Al.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Al.encode(sg(s[0]??""))),o+=2}return null}function sg(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function ag(e){return Zn(ug(e))}function qi(e,t){if(e==="/dev/null")return Tl(t);if(t==="/dev/null")return Tl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Zn);let n=lg(e,t)??(e===t?Hl(e):null);return[e,t,...n?[n]:[]].flatMap(Zn)}function Tl(e){let t=Hl(e);return[e,...t?[t]:[]].flatMap(Zn)}function Hl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function lg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Il(e){return ag(qr(e,!0))}function cg(e){return Zn(qr(e,!1))}function qr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=zl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function ug(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Zn(e){return e===""||e==="/dev/null"?[]:[e]}function kl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}var ct=require("node:path");function ut(e,t,n){if(wt(e))return;let r=t.flatMap((i)=>Yi(i,n));if(!r[0])return;let o=Yi(ct.isAbsolute(e)?e:ct.resolve(r[0],e),n)[0];if(!o)return;return r.some((i)=>Zi(o,i))?o:void 0}function it(e,t){return e.flatMap((n)=>Yi(n,t))[0]}function Yi(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Zi(e,t){let n=ct.relative(t,e);return n===""||n!==".."&&!n.startsWith(`..${ct.sep}`)&&!ct.isAbsolute(n)}var dg=8388608;async function Bl(e){let t=[],n=0;for await(let r of e){let o=typeof r==="string"?Buffer.from(r,"utf-8"):Buffer.from(r.buffer,r.byteOffset,r.byteLength);if(n+=o.byteLength,n>dg)throw mg(e),Error("hook input byte limit exceeded");t.push(o)}return Buffer.concat(t,n).toString("utf-8")}function mg(e){let t=e.destroy??e.cancel;if(!t)return;try{Promise.resolve(t.call(e)).catch(()=>{})}catch{}}function Jr(e,t,n){try{return JSON.parse(e)}catch{t({reason:n});return}}function se(e,t){let n=t.get(e);return n?{kind:"command",shell:n}:{kind:Dl(e)}}function Ul(e,t,n,r,o,i){let s=e===void 0?i:e,a=typeof s==="string"&&s.trim()!==""?it([s],o):void 0;if(a)return{configCwd:a,executionCwd:a};return ee(r,t,n,fg(s)),null}function ee(e,t,n,r){let o;try{o=At(t)}catch(i){if(!(i instanceof Se))throw i}e(pn({command:o,segment:r,toolName:n}))}function fg(e){return typeof e==="string"?e:void 0}var hn=require("node:fs"),Qr=require("node:os");var Yl=require("node:fs"),Zl=require("node:path");var jl=require("node:child_process"),z=require("node:fs"),ne=require("node:path"),pg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],gg=5000;function Vl(e,t=Og(),n=gg){let r=hg(e),o=r===null?null:yg(r);if(r===null||o===null)return null;let i=Ig(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function hg(e){try{let t=z.realpathSync(ne.resolve(e));return z.statSync(t).isDirectory()?t:null}catch{return null}}function yg(e){let t=Tg(e);if(!t)return null;try{let n=z.lstatSync(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Xi(t);if(!r?.commonDir)return null;if(!Sg(r.gitDir,t))return null;return vg(r.gitDir,ne.dirname(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Xi(e){try{let t=Cg(e);if(!t)return null;let n=z.realpathSync(ne.isAbsolute(t)?t:ne.resolve(ne.dirname(e),t));if(!z.statSync(n).isDirectory())return null;return{gitDir:n,commonDir:bg(n)}}catch{return null}}function Cg(e){let t=z.readFileSync(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function bg(e){try{let t=z.readFileSync(ne.join(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=z.realpathSync(ne.isAbsolute(t)?t:ne.resolve(e,t));return z.statSync(n).isDirectory()?n:null}catch{return null}}function Sg(e,t){let n=Eg(e);return n===null?!1:Kl(e,n,t)}function vg(e,t){let n=Rg(e);return n===null?!0:Kl(e,n,t)}function Eg(e){let t=ne.join(e,"gitdir");if(!z.existsSync(t))return null;let n=z.readFileSync(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Rg(e){let t=ne.join(e,"config.worktree");return z.existsSync(t)?_g(t):null}function Kl(e,t,n){try{return xg(ne.isAbsolute(t)?t:ne.resolve(e,t),n)}catch{return!1}}function xg(e,t){try{let n=z.statSync(e),r=z.statSync(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return $l(z.realpathSync.native(e))===$l(z.realpathSync.native(t))}function $l(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function _g(e){let t=z.readFileSync(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=wg(s[1]??"")}return r}function wg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Pg(t.slice(1,-1))}var Ag={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function Pg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:Ag[n]??t)}function Tg(e){try{return Ji(z.realpathSync(e))}catch{return null}}function Ji(e){let t=e;while(!0){let n=ne.join(t,".git");if(z.existsSync(n))return n;let r=ne.dirname(t);if(r===t)return null;t=r}}function Ig(e,t,n,r){if(kg(t))return!0;if(n===null)return!0;let o=jl.spawnSync(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Mg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&ql(o.stdout.trim())}function kg(e){return[ne.join(e.commonDir,"config"),ne.join(e.gitDir,"config.worktree")].filter((t)=>z.existsSync(t)).some((t)=>Dg(t))}function Og(){return pg.find((e)=>z.existsSync(e))??null}function Xn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Mg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Xn(t)))}function Dg(e){let t;try{t=z.readFileSync(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Ng(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=ql(c)}return r}function Ng(e){return e==="include"||e.startsWith("includeif ")}function ql(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Xl(e,t){if(e==="")return null;let n=de(),r=Ji(he(e,e,t,n)),o=r?Lg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Lg(e,t,n,r){try{let o=he(e,t,n,r),i=Yl.statSync(e),s=i.isFile()?o:null,a=i.isFile()?Xi(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[gn(he(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[gn(e.replace(/\\/g,"/")),...l]:l)];return{entry:gn(o),markerFile:s?gn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=gn(Zl.join(u,"hooks").replace(/\\/g,"/"));return[m,gn(he(m,t,n,r))]}))]}}catch{return null}}function gn(e){return process.platform==="win32"?e.toLowerCase():e}var Wg={realpath:(e)=>{try{return hn.realpathSync(e)}catch{return null}},entryKind:(e)=>{let t=hn.lstatSync(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return hn.statSync(e).isDirectory()}catch{return!1}}};function Ql(){return Fg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:ke(process.env.HOME||Qr.homedir()),tmpdir:Qr.tmpdir(),paths:Wg})}function Fg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Jl(n,i,()=>Xl(i,o)),worktreeFacts:(i)=>Jl(r,i,()=>Vl(i)),...t};return o}function Jl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var yn=["fail_closed","paranoid_rm","paranoid_interpreters"],eo={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ae={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},to=["standard","strict","paranoid"];function Gg(e,t){if(!t)return e;return to.indexOf(t)>to.indexOf(e)?t:e}function zg(e){let t=ns(ae.level,e);if(t===void 0||t==="")return;if(to.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ae.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${to.join(", ")}.`);return}function Hg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function ec(e){return Hg(ns(ae.auditScope,e))==="all"}function es(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function ts(e={},t){let n=e.safety?.level??"standard",r=zg(t),o=Gg(n,r),i=eo[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ae.level.name}=${r}`),l.paranoidRm.push(`env ${ae.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ae.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if($t(ae.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ae.strict.name}`);if($t(ae.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ae.paranoid.name}`),l.paranoidInterpreters.push(`env ${ae.paranoid.name}`);if($t(ae.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ae.paranoidRm.name}`);if($t(ae.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ae.paranoidInterpreters.name}`);let c=!!e.worktreeMode||$t(ae.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:es(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function $t(e,t){let n=typeof e==="string"?Qi(e,t):ns(e,t);return n==="1"||n?.toLowerCase()==="true"}function Qi(e,t){return t.get(e)}function ns(e,t){let n=Qi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Qi(e.legacyName,t);return}function Jn(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}var nr=require("node:path");var W=require("node:fs"),U=require("node:path");function rs(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Bg=Symbol("PolicyFilesystemScope"),Ug=Symbol("PolicyFilesystemTarget"),$g=W.constants.O_NOFOLLOW??0;class ye extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function jt(e,t){return{[Bg]:!0,root:U.resolve(e),label:t}}function tc(e,t){let n=U.normalize(t);if(t===""||U.isAbsolute(t)||n===".."||n.startsWith(`..${U.sep}`))throw new ye(e.label);return{[Ug]:!0,scope:e,relativePath:n,path:U.join(e.root,n)}}function Qn(e,t){return tc(e,U.relative(e.root,U.resolve(t)))}function nc(e,t="rules policy"){let n=U.resolve(e),r=U.parse(n).dir;return tc(jt(r,t),U.relative(r,n))}function ro(e){return oc(e.scope.label,()=>{if(!no(e))return null;let t=W.openSync(e.path,W.constants.O_RDONLY|$g);return jg(t,()=>{let n=W.fstatSync(t);if(!n.isFile())throw new ye(e.scope.label);let r=W.readFileSync(t,"utf-8"),o=W.lstatSync(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ye(e.scope.label);return no(e),r})})}function rc(e,t){if(e.path===t.path)return!0;return oc(e.scope.label,()=>{if(!no(e)||!no(t))return!1;let n=(r)=>U.join(W.realpathSync(U.parse(r).dir),U.parse(r).base);return n(e.path)===n(t.path)})}function oc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ye)throw r;throw new ye(e)}}function jg(e,t){try{return t()}finally{W.closeSync(e)}}function no(e,t="file"){let n=Vg(e.scope);if(!n)return!1;let r=e.relativePath.split(U.sep);for(let o of r.keys()){let i=U.join(e.scope.root,...r.slice(0,o+1)),s=W.lstatSync(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ye(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ye(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ye(e.scope.label);Kg(n,W.realpathSync(i),e.scope.label)}return!0}function Vg(e){if(!W.lstatSync(e.root,{throwIfNoEntry:!1}))return null;if(!W.statSync(e.root).isDirectory())throw new ye(e.label);return W.realpathSync(e.root)}function Kg(e,t,n){let r=U.relative(e,t);if(r===".."||r.startsWith(`..${U.sep}`)||U.isAbsolute(r))throw new ye(n)}var N=require("node:path");var Vt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,ic="rulebook.json",sc=".cc-safety-net/rules";var ac=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var qg=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Yg=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Zg="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),UA=new RegExp(`^${Yg}/(${Vt.source.slice(1,-1)})/${Zg}$`);function Xg(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function lc(e){if(oo(e))try{return os(e),null}catch(t){return t instanceof Error?t.message:String(t)}return Vt.test(e)?null:`Local rulebook sources must be bare names matching ${Vt}: ${e}`}function os(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(ac);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!qg.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!Vt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Xg(o),name:o}}function oo(e){return ac.test(e)}var cc="rule.json",io="policy.json",uc=".cc-safety-net",Jg="rules",Qg="CC_SAFETY_NET_HOME",dc="`cc-safety-net rule update`";function eh(e){return N.resolve(e,sc)}function th(e){return N.join(eh(e),cc)}function er(e){return N.join(N.resolve(e),uc,io)}function is(e,t={}){return t.userConfigDir??(t.userConfigPath?N.dirname(t.userConfigPath):N.join(nh(e),Jg))}function nh(e){let t=e.env.get(Qg);return t?N.resolve(ke(t)):N.join(e.home,uc)}function rh(e,t={}){return N.join(is(e,t),cc)}function Cn(e,t={}){return N.join(N.dirname(is(e,t)),io)}function mc(e,t){let n=t.userConfigPath??rh(e,t),r=t.projectConfigPath??th(t.cwd),o=oh(e,t),i=ih(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Qn(o,n),projectConfigTarget:Qn(i,r)}}function oh(e,t){let n=t.userConfigPath?N.dirname(N.dirname(N.resolve(t.userConfigPath))):N.dirname(N.resolve(t.userConfigDir??is(e,t)));return jt(n,"user policy")}function ih(e,t){let n=N.resolve(t),r=N.resolve(e),o=N.relative(n,r);if(o!==".."&&!o.startsWith(`..${N.sep}`)&&!N.isAbsolute(o))return jt(n,"project policy");return jt(N.dirname(N.dirname(r)),"project policy")}function fc(e,t){return N.join(e,t,ic)}var Oe=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),Pt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,Tt=256,ie=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),pc=new Set(["python","python3","python2","node","ruby","perl"]),so=/^python(?:[23](?:\.\d+)*)?$/,He=new Set(["awk","gawk","nawk","mawk"]),ao=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var gc="Rulebook exceeds CC Safety Net's safe validation limits.",hc="Additional rulebook validation errors were omitted.",Ve=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function yc(e){if(ss(e.allowed_commands,Ve.maxAllowedCommands)||ss(e.rules,Ve.maxRules)||ss(e.tests,Ve.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Ve,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Ve.maxStringCodeUnits||i&&o.length>Ve.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Ve.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function ss(e,t){return Array.isArray(e)&&e.length>t}var as=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ls=64,cs="Rule config exceeds CC Safety Net's safe source limit.";function L(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function Re(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var sh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},us=new Set(["--init-file","--rcfile"]);function ds(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!sh[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Me(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&us.has(l)&&!s.includes("="))i++;continue}let a=ds(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function tr(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function lo(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of ah(e))tr(n,t);return t.inSingle||t.inDouble}function ah(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);tr(s,n)}return t}var ms=new Set(["rm","find","xargs","parallel"]),lh=new Set(["git","busybox",...ms,...ie,...pc,...He]),ch=new Set(["python","node","ruby","perl"]);function Cc(e){let t=L(e);return lh.has(t)||Ke(t)}function Ke(e){return ch.has(uh(e))}function uh(e){let t=k(e).toLowerCase();return so.test(t)?"python":t}function fs(e){try{let t=ro(dh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=ph(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ye)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function dh(e){return typeof e==="string"?nc(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),me=(e,t)=>({path:e,message:t,kind:"custom"});function bc(e){let t=new Set;return e.flatMap((n,r)=>{let o=bn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[me(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ps=`must be one of ${as.join(", ")}`,mh=/^[^/]+\/[^/]+$/,fh=["version","rules","overrides","transparent_wrappers"];function ph(e){let t=gh(e);return{errors:gs(xh(t,fh,(n)=>n.kind==="custom"),": "," "),sources:Rh(e,t)}}function gh(e){if(!bn(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>ls;return[...e.version===1?[]:[_(["version"],"must be 1")],...hh(e.rules,t),...bh(e.overrides),...vh(e.transparent_wrappers),...t?[]:Ch(e.rules),...bn(e.overrides)?Object.keys(e.overrides).filter((n)=>!mh.test(n)).map((n)=>me(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Eh(e.transparent_wrappers)]}function hh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...Sc(e,ls)?[_(["rules"],cs)]:[]];if(t)return[{path:["rules"],message:cs,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...yh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function Sc(e,t){let n=vc(e);return n!==void 0&&!(n<=t)}function yh(e,t){let n=vc(e);return n!==void 0&&!(n>=t)}function vc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Ch(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[me(["rules",r],"must be a non-empty rulebook source string")];let o=lc(n);if(o)return[me(["rules",r],o)];if(t.has(n))return[me(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function bh(e){if(e===void 0)return[];if(!bn(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!bn(n))return[_(["overrides",t],'must be "off" or an object')];return[...Sh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||ys(n.intent)?[]:[_(["overrides",t,"intent"],ps)]]})}function Sh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...Sc(e,Tt)?[_(t,`must be at most ${Tt} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>Tt?[_(t,`must be at most ${Tt} characters`)]:[]}function vh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return Pt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Eh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!Pt.test(n))return[];if(t.has(n))return[me(["transparent_wrappers",r],`duplicate command "${n}"`)];if(Cc(n))return[me(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Rh(e,t){let n=bn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function xh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function gs(e,t,n){return[...new Set(e.map((r)=>{let o=hs(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function hs(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function ys(e){return as.includes(e)}function bn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Rc(e){let t=Ah(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var _h=`required non-empty string up to ${Tt} characters`,Ec="must be a non-empty array of unique non-empty strings",wh="required non-empty array of non-empty strings";function Ah(e){if(!It(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!yc(e))return{errors:[gc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...gs(Ph(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Ve.maxValidationErrors?[...t.slice(0,Ve.maxValidationErrors),hc]:t,ruleNames:new Set(xc(e).map((n)=>n.toLowerCase()))}}function xc(e){let t=It(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=It(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Ph(e,t){return[...typeof e.name==="string"&&Vt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Th(e.allowed_commands),...Ih(e.rules,t),...Dh(e.tests),...Nh(e),...Lh(e)]}function Th(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&Pt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!Pt.test(n))return[];if(t.has(n))return[me(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Ih(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!It(n))return[_(["rules",r],"must be an object")];return t?Oh(n,["rules",r]):kh(n,["rules",r])}),...bc(e)]}function kh(e,t){return[..._c(e.name,t),...wc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&Pt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...co(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Ac(e.reason,t),...Pc(e.intent,t)]}function Oh(e,t){return[..._c(e.name,t),...wc(e.command,t),...Ac(e.reason,t),...Pc(e.intent,t),...Mh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function _c(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return Vt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function wc(e,t){return typeof e==="string"&&Pt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function Ac(e,t){return typeof e==="string"&&e!==""&&e.length<=Tt?[]:[_([...t,"reason"],_h)]}function Pc(e,t){return e===void 0||ys(e)?[]:[_([...t,"intent"],ps)]}function Mh(e,t){if(!It(e))return[_(t,"required object")];return[...co(e.command_path,[...t,"command_path"],wh,!1),...e.any_args===void 0?[]:co(e.any_args,[...t,"any_args"],Ec,!0),...e.exclude_args===void 0?[]:co(e.exclude_args,[...t,"exclude_args"],Ec,!0)]}function co(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[me([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[me(t,n)]:[],...r&&new Set(e).size!==e.length?[me(t,"must not contain duplicate values")]:[]]}function Dh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!It(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[me(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Nh(e){if(!Array.isArray(e.tests))return[];let t=new Set(xc(e));return[...new Set(e.tests.flatMap((n)=>It(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>me(["tests"],`blocked fixture references unknown rule "${n}"`))}function Lh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=It(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[me(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function It(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Dc(e,t){let n=mc(e,t),r=!1;try{r=rc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ye)return jh(n,f.message);throw f}let o=fs(n.userConfigTarget),i=r?{config:null,errors:[]}:fs(n.projectConfigTarget),s=Oc(n.userConfigPath,o.errors),a=Oc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Tc(o.config,nr.dirname(n.userConfigPath),"user",n.userScope,l):Mc(),u=i.config?Tc(i.config,nr.dirname(n.projectConfigPath),"project",n.projectScope,l):Mc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Ic(c.rules,m),...Ic(u.rules,d)],transparent_wrappers:Uh(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?kc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?$h(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?kc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Tc(e,t,n,r=jt(nr.dirname(nr.dirname(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Fh(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:Wh(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Wh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Fh(e,t,n){let r=Gh(e),o=fc(t,r),i=Hh(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${zh(e)}`]};let s=Bh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Gh(e){return oo(e)?os(e).name:e}function zh(e){return oo(e)?`run ${dc} to vendor ${e}`:"create that file or remove that source from the rules config"}function Hh(e,t){try{return{content:ro(Qn(t,e))}}catch(n){if(n instanceof ye)return{error:n.message};throw n}}function Bh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Rc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function Uh(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Ic(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function kc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function $h(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Oc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function jh(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Mc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}var So=require("node:fs");var Nc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Cs=new Set(Nc.map((e)=>e.id)),uo=Nc,Vh=new Map(uo.map((e)=>[e.id,e.intent]));function b(e,t){return{id:e,reason:t,intent:Vh.get(e)??"manual_only"}}var bs=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],mo={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Kh=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],qh=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ss=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...qh.flatMap((e)=>Kh.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var fo=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Lc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Yh=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],vs=Lc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),Es=Lc.flatMap((e)=>Yh.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),rr={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Rs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),xs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Zh=[...bs,mo,...Ss,...vs,...Es,rr,...Rs,...xs,...fo].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),po=new Set(fo.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),_s=new Set(Zh.map((e)=>e.id));var De=require("node:path"),Wc=process.platform==="win32",Xh=/[*?]/;function or(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ws(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=or(e.trim(),t);if(!De.isAbsolute(n))return"must be an absolute path or start with ~/";return ir(n,t)}function As(e,t){let n=Fc(e,t);if(n===null)return"must be a non-empty path string";if(!De.isAbsolute(n))return null;if(ir(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Jh="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Qh="cannot cover the guard's own configuration";function Fc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return or(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Ps(e,t){let n=Fc(e,t);if(n===null)return"must be a non-empty path string";if(Xh.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!De.isAbsolute(n))return null;if(ir(n,t)!==null)return Jh;return ey(n,t)?Qh:null}function ey(e,t){let n=go(e),r=go(De.join(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${De.sep}`)}function ir(e,t){let n=go(e),r=go(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(De.sep)?n:`${n}${De.sep}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function go(e){let t=De.normalize(e);if(Wc)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Wc?3:1)&&t.endsWith(De.sep))t=t.slice(0,-1);return t}var Gc=30,ho=1,yo=365;function zc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Hc=new Set(uo.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(Hc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function fe(e,t,n){if(Hc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Bc(e,t){return Object.freeze(Object.fromEntries(uo.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Uc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Bc(e,t)})}var $c={standard:0,strict:1,paranoid:2};function Kc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:Ts(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:Ts(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:Ts(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:ty(e,t)}}function Ts(e,t){return[...new Set([...e,...t??[]])]}function ty(e,t){let n=t.safety?.level,r=eo[e.safety.level];return[...n&&$c[n]<$c[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...yn.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...jc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...jc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!po.has(o))),...e.destructive_command_protection.enabled?Vc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Vc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function jc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Vc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Os=new Set(["standard","strict","paranoid"]),Xc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Gc}};function Jc(e,t){let n=dy(Cn(e,t),e.home),r=vo(er(t.cwd),e.home),o=ry(r.parsed,e.home),i=Object.keys(o.policy).length>0?Kc(n.gui??Xc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ks(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var ny="project policy audit settings are ignored; audit is user scope only";function ry(e,t){if(!Ne(e))return{policy:{},diagnostics:[]};let n=Ne(e.safety)?e.safety:{},r=Ne(e.workflow)?e.workflow:{},o=Ne(e.destructive_command_protection)?e.destructive_command_protection:{},i=Ne(e.secret_protection)?e.secret_protection:{},s={...Os.has(n.level)?{level:n.level}:{},...Ne(n.overrides)?qc({overrides:Qc(n.overrides,yn,["safety","overrides"],Kt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:bo(o.overrides,Cs,tu,Kt)}:{},...o.allow_paths!==void 0?{allow_paths:vn(o.allow_paths,ws,t,["destructive_command_protection","allow_paths"],Kt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:bo(i.overrides,_s,nu,Kt)}:{},...i.deny_paths!==void 0?{deny_paths:vn(i.deny_paths,As,t,["secret_protection","deny_paths"],Kt)}:{},...i.allow_paths!==void 0?{allow_paths:vn(i.allow_paths,Ps,t,["secret_protection","allow_paths"],Kt)}:{}};return{policy:qc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[ny]}}function Qc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],Ms));return[]}))}function qc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Kt=()=>{return},Ms="must be a boolean",Ds="must be an object if provided",eu=`must be an integer between ${ho} and ${yo}`,tu={path:["destructive_command_protection","overrides"],label:"destructive command"},nu={path:["secret_protection","overrides"],label:"secret protection"},oy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function iy(e,t){let n=[];return{policy:ru(e,t,(o)=>{n.push(o)}),issues:n}}function sy(e,t){return ru(e,t,Kt)}function ru(e,t,n){if(!Ne(e))return n(_([],"Config must be an object")),Co();if(e.version!==1)n(_(["version"],"must be 1"));let r=Sn(e.safety,["safety"],["level","overrides"],n),o=Sn(r.overrides,["safety","overrides"],yn,n),i=Sn(e.workflow,["workflow"],["worktree_mode"],n),s=Sn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=Sn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=Sn(e.audit,["audit"],["retention_days"],n);return ou(e,oy,[],n),{version:1,safety:{level:ay(r.level,n),overrides:Qc(o,yn,["safety","overrides"],n)},workflow:{worktree_mode:Is(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Is(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:bo(s.overrides,Cs,tu,n),allow_paths:vn(s.allow_paths,ws,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Is(a.enabled,["secret_protection","enabled"],!0,n),overrides:bo(a.overrides,_s,nu,n),deny_paths:vn(a.deny_paths,As,t,["secret_protection","deny_paths"],n),allow_paths:vn(a.allow_paths,Ps,t,["secret_protection","allow_paths"],n)},audit:{retention_days:ly(l.retention_days,n)}}}function Sn(e,t,n,r){if(e===void 0)return{};if(!Ne(e))return r(_(t,Ds)),{};return ou(e,n,t,r),e}function ou(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function ay(e,t){if(e===void 0)return"standard";if(Os.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Is(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,Ms));return n}function ly(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=ho&&e<=yo))t(_(["audit","retention_days"],eu));return zc(e)}function bo(e,t,n,r){if(e===void 0)return{};if(!Ne(e))return r(_(n.path,Ds)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function vn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?me([...r,s],a):_([...r,s],a)),[]})}function Ne(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Co(){return structuredClone(Xc)}function vo(e,t){if(!So.existsSync(e))return{exists:!1,policy:Co(),errors:[]};try{let n=So.readFileSync(e,"utf-8");if(!n.trim())return{exists:!0,policy:Co(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=iy(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${uy(i)}`),fallback:Ne(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Co(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var cy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ds,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Ms,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[eu,`not an integer between ${ho} and ${yo}`]]);function uy(e){let t=hs(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=cy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function dy(e,t){let n=vo(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ne(r))return{policy:Zc(),errors:[]};let o=sy(r,t);return{policy:ks(o),gui:o,errors:[],levelPresent:Yc(r)}}if(n.parsed===void 0)return{policy:Zc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ks(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Yc(n.parsed)}}function Yc(e){let t=Ne(e)&&Ne(e.safety)?e.safety:{};return Os.has(t.level)}function iu(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...po].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Zc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:iu({}),denyPaths:[],allowPaths:[]}}}function ks(e){return{safety:my(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:iu(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function my(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function su(e,t){let n=Dc(e,t),r=Jc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...hy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return yy(o,fy(n,r),s,r.policyScopes)}function fy(e,t){let n=gy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:Cy(e.errors.length>0?py(e.errors):void 0,e.warnings.length>0?Ls(e.warnings.join("; ")):void 0,n)}}function py(e){return`${Ls(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function gy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function hy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function yy(e,t,n=Object.freeze({}),r){let o=Ns(structuredClone(e)),i=r?{policyScopes:Ns(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ns(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ns(t);return Object.freeze(e)}function Cy(...e){return Ls(e.filter((t)=>!!t).join("; "))}function Ls(e){return/[.!?]$/.test(e)?e:`${e}.`}function au(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Ws(t.fail_closed,e.strict,"strict"),paranoid_rm:Ws(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Ws(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Uc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:es({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Ws(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function sr(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var by=/^[A-Za-z_][A-Za-z0-9_]*=/;function Eo(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function ar(e){let t=Eo(e.words[0],"time")?1:0,n=t===1&&Eo(e.words[t],"-p")?t+1:t,r=t===1&&Eo(e.words[n],"--")?n+1:n,o=Eo(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!by.test(s.text));return i?.provenance==="literal"?i.text:void 0}var kt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Ro(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Sy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>xe(t)))})}function xo(e,t,n){e.push(n),t.reset()}function _o(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Fs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function En(e,t,n,r,o,i,s){return Fs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function xe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Sy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:xe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Gs(e,t,n){if(t>=n||cu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!cu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=lu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=lu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function zs(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=vy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?Ey(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function lu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function cu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function vy(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function Ey(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var fu=new Set(["&&","||","|","|&"]);function pu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return xe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Po(e,0,e.length,t,{used:0,max:t.maxWords},0);return xe({kind:"program",dialect:"posix",source:e,span:n,status:ko(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Po(e,t,n,r,o,i,s){let a=[],l=[],c=Ro(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((h)=>h.text);xo(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),mu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(Io(f)){if(f===`
+`||f==="\r"){m();let S=f==="\r"&&e[d+1]===`
+`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!fu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,S),span:Object.freeze({start:d,end:S})}));if(u.length>0){let R=zs(e,S,n,u.splice(0));l.push(...R.issues),d=R.next;continue}d=S;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
+`&&e[d]!=="\r")d++;continue}let p=c.start===-1?Uy(e,d,n):void 0;if(p){if(Bs(a,l),i>=r.maxDepth)return Rn(a,l,d,"depth-limit",r.maxDepth);if(!Hs(o))return Rn(a,l,d,"word-limit",r.maxWords);let S=Po(e,p.braceIndex+1,n,r,o,i+1,"}"),T=S.next,R={start:p.braceIndex+1,end:S.closed?T-1:T},A=uu(e,R,S);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:A}),l.push(...S.issues),S.pendingHeredocs.length>0||cr(S.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...S.pendingHeredocs),S.limited)return Ao(a,l,S.next);if(!S.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let h=To(e,d);if(h){if(m(),!Eu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:d,end:d+h.length})})),d+=h.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&Iy(e,d,n))&&c.start===-1){if(Bs(a,l),i>=r.maxDepth)return Rn(a,l,d,"depth-limit",r.maxDepth);let S=f==="("?")":"}",T=Po(e,d+1,n,r,o,i+1,S),R=T.next,A={start:d+1,end:T.closed?R-1:R},Q=uu(e,A,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:R},body:Q}),l.push(...T.issues),T.pendingHeredocs.length>0||cr(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return Ao(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=R;continue}let g=(f==="<"||f===">")&&e[d+1]!=="("?wy(e,d):null;if(g){let S=c.words.at(-1),T=S&&S.span.end===d&&/^[0-9]+$/.test(S.raw)?Number(S.raw):void 0;if(T!==void 0)c.words.pop();let R=T===void 0?d:S?.span.start??d;c.start=c.start===-1?d:c.start;let A=d+g.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let Q=e[A],re=A>d+g.length&&Q==="#",ce=!Q||Io(Q)||!!To(e,A)||Q===s||Q===")"||re||(Q==="<"||Q===">")&&e[A+1]!=="(",oe=g==="<<"||g==="<<-",K=oe?Gs(e,A,n):void 0,F=K?{word:En(e,A,K.next,K.delimiter,"literal",K.quoted),nested:[],issues:[],next:K.next,limited:!1}:!ce?Us(e,A,n,r,o,i):void 0;if(F){if(l.push(...F.issues),F.limited)return Ao(a,l,F.next);if(!Hs(o))return Rn(a,l,F.next,"word-limit",r.maxWords)}let be=F?.next??d+g.length,ze={kind:"redirection",operator:g,span:{start:R,end:be},...T===void 0?{}:{fd:T},...F?{target:F.word}:{}};if(c.redirections.push(ze),oe&&!K)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(K){if(K.ambiguous||K.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let lt=c.nested;u.push({delimiter:K.delimiter,quotedDelimiter:K.quoted,stripTabs:g==="<<-",attach:(je)=>{if(ze.heredoc=je,je.quotedDelimiter)return;lt.push(...xy(e,je.bodySpan.start,je.bodySpan.end,r,o,i+1))}})}if(!oe&&!F)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`});if(F)c.nested.push(...F.nested);c.end=be,d=be;continue}if(c.start===-1)Bs(a,l);let y=Us(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return Ao(a,l,y.next);let v=My(c.words)?Fy(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return Rn(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let S of E){if(!Hs(o))return Rn(a,l,y.next,"word-limit",r.maxWords);c.words.push(S)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return m(),mu(a,l),l.push(...$y(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function uu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:ko(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Us(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||Io(f)||(f===";"||f==="|"||f==="&")&&To(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(f==='"'){l=!0;let g=Ry(e,a,n,r,o,i);if(s+=g.text,u.push(...g.nested),m.push(...g.issues),d||=g.limited,c=lr(c,g.provenance),a=g.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Ay(e,a+2,n);if(s+=g.text,m.push(...g.issues),!g.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=g.next;continue}if(f==="\\"){let g=e[a+1];if(!g){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(g===`
+`){a+=2;continue}s+=g,a+=2;continue}let h=f==="$"||f==="<"||f===">"||f==="`"?Oo(e,a,n,r,o,i):null;if(h){let g=gu(h,u,m);if(d||=g.limited,c=lr(c,g.provenance),a=g.next,d)break;continue}if(f==="$"){let g=Cu(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(f==="*"||f==="?"||f==="[")c=lr(c,"glob");s+=f,a++}return{word:En(e,t,a,s,c,l,c==="literal"?void 0:Ty(e,t,a)),nested:u,issues:m,next:a,limited:d}}function Ry(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
 `){m+=2;continue}if(p==="\r"&&e[m+2]===`
-`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=Fs(e,m+3,n,"))"),g=p===-1?n:p+2;if(s+=e.slice(m,g),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=g;continue}let f=To(e,m,n,r,o,i);if(f){let p=lu(f,l,c);if(m=p.next,d||=p.limited,a=or(a,p.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:d};continue}if(u==="$"){let p=du(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=u??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function To(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let d=s?3:c?1:2,m=s?"))":c?"`":")",u=Fs(e,t+d,n,m),f=u===-1?n:u,p=u===-1?n:u+m.length;if(i>=r.maxDepth)return{program:ky(e,t+d,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],b=!1,T=t+d;while(T<f){let R=To(e,T,f,r,o,i+1);if(!R){T++;continue}if(v.push(...R.program.nodes),E.push(...R.program.issues),b||=R.program.status==="limited",T=R.next,b)break}if(u===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:xe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:Po(E,b),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let g=_o(e,t+d,f,r,o,i+1),h=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+d)} substitution is not closed`}]:[],y=(c||l)&&ir(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:xe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:Po([...g.issues,...h,...y],g.limited),issues:[...g.issues,...h,...y],nodes:g.nodes}),next:p,provenance:"command-substitution"}}function fy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?To(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function lu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Fs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
-`||l==="\r")&&s.length>0){let d=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=Ds(e,d,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=cu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let d=py(e,a+3,n);if(d===-1)return-1;a=d+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let d=e[a+2]==="-",m=a+(d?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let u=Ms(e,m,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:d,attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function py(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=cu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function cu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!Dy(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function wo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function gy(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function Ao(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function uu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function hy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=yy(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function yy(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return Ro(e,t+1,n,16,2,t+1);if(r==="u")return Ro(e,t+1,n,16,4,t+1);if(r==="U")return Ro(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return Ro(e,t,n,8,3,t+1);return{text:r,next:t+1}}function Ro(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function Po(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function du(e,t,n,r,o){let i=uu(e,t,n);return{text:r+e.slice(t,i),provenance:or(o,"variable"),next:i}}function Cy(e,t,n){let r=Eo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||m||u){let f=c?3:u?1:2,p=c?"))":u?"`":")",g=Fs(e,a+f,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=uu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function or(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function by(e,t,n){return t+1>=n||Ao(e[t+1]??"")||wo(e,t+1)!==null}var Sy=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),vy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Ey(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Ry(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Ry(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return xy(e,t);if(n==="env")return _y(e,t);if(n==="sudo")return wy(e,t);return}function xy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function _y(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Sy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function wy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(vy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function mu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=fu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>pu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function Ay(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=fu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>pu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>vn(e,t.span.start,t.span.end,a,"literal",!1))}}function fu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>ou(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",d=ou(c,o);if(!d||d.kind==="range")return{limited:"expansions"};let m=d.start+c.length-d.end,u=d.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+d.alternatives.length>t)return{limited:"words"};i.splice(l,1,...Py(c,d)),s+=u-c.length}return a===0?void 0:{values:i}}function ou(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Iy(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:Ty(e,r)}}function Py(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function Ty(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Iy(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function pu(e,t){let n=`x${e}`,r=Ws(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function ky(e,t,n,r){return xe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function En(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function xo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ns(e){return e.used++,e.used<=e.max}function Oy(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function ir(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>ir(n.nodes));return(t.kind==="group"||t.kind==="function")&&ir(t.body.nodes)})}function My(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function gu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function iu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!su.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Ls(e,t){if(!gu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function Dy(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var yu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Ny=new Set(["gc","cat","type","cp","mv","rm"]),Cu=["-rec","-for","-path","-literalpath","-whatif"],Ly=/^\$env:\w/i,Wy=/^(?:\$\{?\w+\}?|~)\\./;function bu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...yu].some((o)=>n.includes(o))&&!(n.includes("rm")&&Cu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!Fy(n))return!1;let r=Bs(e,t);if(Su(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Hs(r).some(Gy)}function Su(e){return e.nodes.some((t)=>{if(t.kind==="group")return Su(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function Fy(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Gy(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&yu.has(n))return!0;let r=e.slice(t+1);if(n&&Ny.has(n)&&r.some(zy))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Cu.some((s)=>i.startsWith(s))})}function zy(e){return Ly.test(e)||Wy.test(e)}function Bs(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return xe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Us(e,0,e.length,t,0);return xe({kind:"program",dialect:"powershell",source:e,span:n,status:jy(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Us(e,t,n,r,o,i=!1){let s=[],a=[],l=So(),c=0,d=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};vo(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let p=$y(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
-`){m();let y=f==="\r"&&e[u+1]===`
-`?u+2:u+1;s.push(Gs(e,u,y)),u=y;continue}u++;continue}let g=Ru(e,u);if(g){m(),s.push(Gs(e,u,u+g.length)),u+=g.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Eu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Us(e,u+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=xe({kind:"program",dialect:"powershell",source:e.slice(u+1,v),span:{start:u+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,d||=y.limited,u=y.next;continue}if(f==="}"){m(),s.push(Gs(e,u,u+1)),u++;continue}if(f===">"||f==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===f?u+2:u+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?hu(e,v,n,r,o):void 0,b=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:b}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,d||=E.limited;l.end=b,u=b;continue}if(f===","){l.start=l.start===-1?u:l.start,l.words.push(Os({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let h=hu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,d||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};u=h.next>u?h.next:u+1}return m(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function hu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,m=!1,u=(p)=>{let g=Hy(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),d+=zs(g.program),m||=g.program.status==="limited",s="command-substitution",g.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||Ru(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[f+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=g,f+=2;continue}if(e.startsWith("$(",f)){f=u(f);continue}if(p==="'"){a=!0,f++;let g=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){g=!0,f++;break}i+=e[f]??"",f++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let g=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){g=!0,f++;break}if(e.startsWith("$(",f)){f=u(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:vn(e,t,f,i,s,a,s==="literal"?void 0:By(e,t,f)),next:f,issues:l,nested:c,words:d,limited:m}}function Hy(e,t,n,r,o){let i=vu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:xe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Eu(r.maxDepth)],nodes:[]}),next:a};let l=Us(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:xe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function vu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function zs(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=zs(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=zs(r)}}return t}function By(e,t,n){let r=Eo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=vu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=Uy(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function Uy(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Eu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Hs(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Hs(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Hs)]})}function Ru(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function $y(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function jy(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Gs(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Ke(e,t="auto",n=It){if(t==="powershell"||t==="auto"&&bu(e.slice(0,n.maxInputLength),n))return Bs(e,n);return au(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function Rn(e,t){return e==="posix"?t:X(t.map((n)=>n.text))}function Io(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function X(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function $s(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function te(e){return e.value.length}function sr(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Le(e,t){sr(e,t)}function Kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function q(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function js(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function Y(e,t,n){if(t+n.length>te(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function dt(e,t,n){return!Kt(C(e,t-1))&&Y(e,t,n)&&!Kt(C(e,t+n.length))}function mt(e,t){return Kt(C(e,t-1))!==Kt(C(e,t))}function pe(e){return e===`
-`||e===";"||e==="&"||e==="|"}function xn(e){return e==="|"||e===";"}function ko(e,t,n){let r=$s(e,n);if(t==="rm")return Vy(r);if(t==="dd")return qy(r);return Tu(r,!0)}function Oo(e,t,n){let r=$s(e,n);if(t==="rm")return Yy(r);if(t==="reset-hard")return Au(r,"--ha","rd");if(t==="reset-merge")return Au(r,"--me","rge");if(t==="clean")return Qy(r);if(t==="checkout")return tC(r);if(t==="push-force")return nC(r);if(t==="push-refspec")return rC(r);if(t==="push-delete")return oC(r);if(t==="branch")return iC(r);if(t==="tag")return lC(r);if(t==="restore")return cC(r);return Tu(r,!1)}function Vy(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=te(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(dt(e,i,"rm")&&q(l)&&l!==`
-`)t=!0,i++;continue}let a=Ky(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===te(e)){if(o>=0){let l=xu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(q(s)){if(o<0)continue;if(Y(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=xu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function Ky(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(Y(e,t,String.raw`\n`))return t+2;if(Y(e,t,String.raw`\x0a`)||Y(e,t,String.raw`\x0A`))return t+5;if(Y(e,t,String.raw`\u000a`)||Y(e,t,String.raw`\u000A`))return t+7;return Y(e,t,String.raw`\012`)?t+4:-1}function xu(e,t,n){if(_u(e,t,n,"recursive"))return{recursive:!0,force:!1};if(_u(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function _u(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!Y(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function qy(e){let t=!1;for(let n=0;n<te(e);n++){if(pe(C(e,n))){t=!1;continue}if(dt(e,n,"dd")){t=!0,n++;continue}if(!t||!dt(e,n,"of")||!Y(e,n,"of=/dev/"))continue;let r=n+8;if(r<te(e)&&!q(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function Yy(e){let t=!1,n=!1,r=!1;for(let o=0;o<=te(e);){let i=C(e,o);if(o===te(e)||pe(i)){t=!1,n=!1,r=!1,o++;continue}let s=Xy(e,o);if(s>=0){if(Zy(e,s))return!0;let a=s,l=!1;while(q(C(e,a)))l||=C(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(Y(e,o,"--")&&(o===0||q(C(e,o-1)))&&(!C(e,o+2)||q(C(e,o+2))||pe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=Y(e,o,"--recursive")&&mt(e,o+11)||Vs(e,o,"recursive"),r||=Y(e,o,"--force")&&mt(e,o+7)||Vs(e,o,"force"),n&&r)return!0;o++}return!1}function Vs(e,t,n){if(!Y(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||q(o)||pe(o))break;if(o!==n[r])return!1;r++}return r>0&&mt(e,t+r+2)}function Zy(e,t){let n=t,r=!1,o=!1;while(n<te(e)){while(q(C(e,n)))n++;let i=n;while(n<te(e)&&!q(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&Y(e,i,"--"))return!1;let s=wu(e,i,"recursive"),a=wu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=Jy(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function wu(e,t,n){return Y(e,t,`--${n}`)&&mt(e,t+n.length+2)||Vs(e,t,n)}function Xy(e,t){if(t>0&&Kt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!q(C(e,n+1)))return-1;return n+1}function Jy(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=C(e,c)??"",m=(d==="r"||d==="f")&&mt(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&m,s||=d==="f"&&m,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&m,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Au(e,t,n){return lr(e,"reset",xn,!0,(r)=>C(e,r)==="-"&&_n(e,r,t,n)?!0:r)}function Qy(e){return lr(e,"clean",xn,!0,(t)=>{if(C(e,t)!=="-")return t;if(_n(e,t,"--fo","rce"))return!0;let n=ar(e,t,xn);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function Mo(e,t,n){if(!dt(e,t,"git"))return null;let r=t+3;if(!q(C(e,r)))return{commandEnd:-1,next:r};while(q(C(e,r)))r++;while(r<te(e)){if(pe(C(e,r)))return{commandEnd:-1,next:r};let o=ar(e,r,pe);if(dt(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&Y(e,r,"--"),s=eC(e,r,o);r=o;while(q(C(e,r)))r++;if(i)return{commandEnd:dt(e,r,n)?r+n.length:-1,next:ar(e,r,pe)};if(!s)continue;if(r>=te(e)||pe(C(e,r)))return{commandEnd:-1,next:r};r=ar(e,r,pe);while(q(C(e,r)))r++}return{commandEnd:-1,next:r}}function eC(e,t,n){for(let r of Oe)if(n-t===r.length&&Y(e,t,r))return!0;return!1}function tC(e){return Pu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function nC(e){return lr(e,"push",xn,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!Kt(C(e,t+2))&&!Y(e,t+2,"-with-lease"))return!0;let n=Iu(e,t,"--fo","rce");if(n>=0&&!Y(e,n,"-with-lease"))return!0;return t})}function rC(e){return lr(e,"push",pe,!1,(t)=>{if(q(C(e,t))&&C(e,t+1)==="+"&&t+2<te(e)&&!pe(C(e,t+2))&&!q(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function oC(e){return lr(e,"push",pe,!1,(t)=>{if(C(e,t)==="-"&&_n(e,t,"--de","lete"))return!0;if(q(C(e,t))&&C(e,t+1)===":"&&t+2<te(e)&&!q(C(e,t+2))&&!pe(C(e,t+2)))return!0;return t})}function iC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=te(e);o++){if(o===te(e)||pe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Mo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=ar(e,o,pe),s=sC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function sC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(_n(e,i,"--de","lete"))r=!0;if(_n(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&aC(C(e,s))){let d=C(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!mt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function aC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function lC(e){return Pu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Pu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<te(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(q(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Mo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&q(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(_n(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&mt(e,r+1))return!0;if(xn(o))i.outerActive=!1}return!1}function lr(e,t,n,r,o){let i=!1;for(let s=0;s<te(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=Mo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||q(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(C(e,d)))i=!1;s=c}if(l)i=!1}return!1}function cC(e){let t=!1;for(let n=0;n<te(e);n++){if(js(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Mo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(Y(e,n+2,"staged")||Y(e,n+2,"help")))t=!1}return t}function Tu(e,t){let n=!1;for(let r=0;r<te(e);r++){let o=C(e,r),i=t?js(o):pe(o);if(n&&q(o)&&C(e,r+1)==="-"&&dt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(dt(e,r,"find"))n=!0,r+=3}return!1}function ar(e,t,n){let r=t;while(r<te(e)&&!q(C(e,r))&&!n(C(e,r)))r++;return r}function Iu(e,t,n,r){if(!Y(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return mt(e,o)?o:-1}function _n(e,t,n,r){return Iu(e,t,n,r)>=0}function ft(e,t){sr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Le(t,a);if((s.regex?.test(a)??!1)||s.scan&&Oo(a,s.scan,t))return S("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var uC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ou(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;sr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Mu(t.nodes,r,i)}function Mu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Mu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return dC(r,t,n)})}function dC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!uC.test(o.text));return e.words.every((o,i)=>o===t||ku(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||ku(o.target.raw,n.anchored,!0)))}function ku(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var cr=require("node:path");function ur(e,t,n,r){let o=cr.isAbsolute(e)?cr.resolve(e):t?cr.resolve(t,e):void 0;if(!o)return;try{return D(o,n,r)}catch{return o}}function Du(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var wn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",dr="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Ks=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),mC=new Set(["-p","--print"]),fC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),pC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),gC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),hC=new Map([["python",new Set(["m"])]]),yC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),CC=new Set(["always","default","never"]),bC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),SC=/\\\r?\n/g,vC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Lu(e){return No(e).code}function Do(e){return No(e).sources}function Wu(e){return vC.get(Ys(e))??[]}function No(e){let t=Ys(e[0]??"");if(!Ks.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return qe(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return qe(t,n,r,o,i,s);if(t==="node"&&mC.has(s)){let m=e[i+1];if(m===void 0)return qe(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(RC(t,s)){let m=e[i+1];if(m===void 0)return qe(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return qe(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(xC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=EC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,qe(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return qe(t,n,r,o);if(yC.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&bC.has(s))||t==="python"&&!CC.has(m))return qe(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let u=s[m];if(u===void 0)break;if(hC.get(t)?.has(u)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return qe(t,n,r,o)}if(fC.get(t)?.has(u)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&u==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(pC.get(t)?.has(u)){if(m+1===s.length)i++;break}if(gC.get(t)?.has(u)&&m+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return qe(t,n,r,o);if(c)i++}return qe(t,n,r,o,void 0,void 0,!0)}function qe(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function EC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function qs(e,t){return Ys(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Ys(e){let t=k(e).toLowerCase();return ro.test(t)?"python":t}function RC(e,t){return Ks.get(e)?.has(t)??!1}function xC(e){return Ks.get(e)?.has("--eval")??!1}function mr(e,t){let n=AC(e,t);if(!Nu(n,t))return!1;Le(t,n);let r=wC(n);if(Nu(r,t))return!0;return Le(t,r),_C.test(r)}var _C=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function wC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Nu(e,t){if(ko(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Le(t,e),r.test(e))return!0;if(ko(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Le(t,e),r.test(e))return!0;if(ko(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Le(t,e),n.some((o)=>Oo(o,r))))}function AC(e,t){return Le(t,e),e.replace(SC,"")}var Tn=require("node:path");var pr=require("node:path");var kt=require("node:path");function Ot(e,t,n){if(_t(t))throw Error("Unsupported Windows namespace path");let r=kt.isAbsolute(t)?kt.parse(t).root:"",o=r||e;for(let i of TC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=kt.dirname(o);continue}let s=PC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function PC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${kt.sep}${t}`}function TC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Zs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],IC=new Set(Zs),kC=1024,Fu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Gu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),OC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Lo(e){return IC.has(e)}function Xs(e){return Lo(e)||Fu.has(e)||Gu.has(e)||Kn(e)}function pt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function zu(e,t){let n=pt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=kC?{state:"valid",count:r}:{state:"invalid"}}function Wo(e,t,n){let o=e.match(OC)?.[1];if(!o||!Xs(o))return null;let i=e.indexOf("=");return{name:o,value:`${pt(o,t,n)??""}${e.slice(i+1)}`}}function Hu(e){return Uu(e,Gu)}function Bu(e){return Uu(e,Fu)}function Uu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var ju=/^[A-Za-z_][A-Za-z0-9_]*=/;function He(e){if(!ju.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Fo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=He(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Vu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function qt(e,t,n,r){if(!Vu(An(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<Z.wrapperPeelIterations.cap;m++){let u=$u(i),f=Fo(i);for(let[g,h]of f.envAssignments)s.set(g,h),a.set(g,h);if(i=f.words,i.length===0)break;while(i.length>0&&An(i).includes("=")&&!DC(i)){let g=NC(An(i),a,t.env)??Wo(An(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=An(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=WC(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=zC(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=HC(i);if(p==="builtin")i=i.slice(Ye(i,1)==="--"?2:1);if($u(i)===u)break}let d=Fo(i);for(let[m,u]of d.envAssignments)s.set(m,u),a.set(m,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:MC(d.words,o)}}function MC(e,t){return e.some((n)=>!t.has(n))}function $u(e){return e.map(w).join(" ")}function An(e){let t=e[0];return t?w(t):""}function Ye(e,t){let n=e[t];return n?w(n):void 0}function DC(e){return ju.test(An(e))}function NC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var LC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function WC(e,t,n){let r=1,o=n;while(r<e.length){let i=Ye(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Ye(e,r+1);o=s?fr(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=fr(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=fr(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(LC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var FC=new Set(["-i","-0","--null"]),GC=new Set(["-u","--unset","-C","--chdir","-P"]);function zC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Ye(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(FC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Ye(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:Ye(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(GC.has(c)){if(c==="-C"||c==="--chdir"){let m=Ye(e,a+1);s=m?fr(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=fr(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!He(c))break;while(a<e.length){let m=He(Ye(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Ye(e,a)==="--")a++;return l(a)}return l(a)}function fr(e,t,n){if(t==="")return null;if(!e&&!pr.isAbsolute(t))return null;let r=pr.isAbsolute(t)?pr.parse(t).root:n.realpath(e??"/");if(r===null)return null;try{return Ot(r,t,n)}catch{return null}}function HC(e){if(Ye(e,1)==="-v")return[...X(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Ye(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var BC=/['"\\$`{}#]/;function Go(e,t){if(e.some((r)=>BC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function Mt(e,t,n){return zo(e,t,n).tokens}function UC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Yt(e,t,n,r=0){let o=zo(e,t,n),i=(o.envSplitValues??[]).flatMap(UC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Yt(s,t,n,r+1)}function zo(e,t,n,r){if(!Vu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=qt(X(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var ta=Symbol("adopt-as-operand"),$C=new Set(["env","sudo","command","builtin"]),jC=new Set(["&&","||","|&","|","&",";"]),VC=new Set(["<<","<<<",">|"]),KC=new Set(["|","|&"]),qC=/[*@#?$!_-]/,YC=/^\w+(?::\w+)*/,ZC=Object.freeze([]),gr=Object.freeze({kind:"scope",edge:"enter"}),hr=Object.freeze({kind:"scope",edge:"exit"}),XC=Object.freeze([]),JC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),yr=new Set(["bash","sh","zsh","dash","ksh"]),QC=256,Xu=new WeakMap;function Ju(e,t){let n=t.status==="complete"?new Set(ea(t)):new Set,r=nb(e,n);if(io(r))return Ho("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Zt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Ho("structural-limit",r,t);if(o.invalid)return Ho("invalid",r,t);let s=Ho("complete",r,t,o.assignmentFallbacks);return Xu.set(s,Object.freeze(i)),s}function Uo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,d=[];for(let m of Qu(e)){if(m.kind==="scope"){if(m.edge==="enter"){d.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let u=o.segment(a,s,c,null,l);if(u)return u;let f=d.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let u=o.segment(a,s,c,m.operator,l);if(u)return u;s=eb(a,s,n,r),c=a.length>0&&KC.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let u=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(u===ta){l.add(a.length),a.push(i(m.target));continue}if(u)return u;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function $o(e){return Qu(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function _e(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:_e(i,t);return a?_e(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function Cr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function eb(e,t,n,r){let o=Cr(e)?new Map([...t.variables,...tb(e,t.variables)]):t.variables,i=Mt([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ge(_e(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function tb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],_e(o,t)]]:[]})}function Qu(e){return Xu.get(e)??ZC}function nb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Ho(e,t,n,r=XC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Zt(e,t){return e.nodes.flatMap((n,r)=>rb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function rb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Ze(lb(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Ze(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[Bo("{"),...Zt(e.body,a),...s?[Bo("}")]:[]]:[gr,Ze("("),...Zt(e.body,a),...s?[Ze(")")]:[],hr]}]}let o=mb(e,r.functions);if(o){if(r.depth>=It.maxDepth||++r.flags.expansions>QC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Ku(e,r),Bo(";"),...Zt(o,{...r,depth:r.depth+1}),Bo(";")]},...qu(e,t,n,r)]}return[{start:e.span.start,events:Ku(e,r)},...qu(e,t,n,r)]}function Ku(e,t){return[...e.words.map((n)=>({start:n.span.start,events:td(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:ob(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function ob(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?td(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[na(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:cb(r),targetOrder:VC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:rd(t)}:{}}),...s===void 0?o:o.slice(1)]}function qu(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[na(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Ze(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...ed(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?ib(t,n,r):[]]}function ib(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:ed(n.source.slice(r.span.end,e.span.end),n)}]}function ed(e,t){if(t.depth>=It.maxDepth)return t.flags.limited=!0,[];let n=Ke(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Zt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function td(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Ze("glob"):s!==""||e.quoted&&o.length===0?na(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of Js(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Ze(f));continue}s+=f.text,a||=f.glob}continue}let d=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=Js(f,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=d?Zt(d,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(gr,...p,hr);continue}let m=d?Zt(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(gr,...m,hr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Ze("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),gr,...m,...c.raw.endsWith(")")?[Ze(")")]:[],hr);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>Ze("(")),...u===1?[gr]:[],...m,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>Ze(")")):[],...u===1?[hr]:[])}return l(),o}function Js(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Yu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Yu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Yu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=ab(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return sb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&qC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?YC:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function sb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Js(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function ab(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function lb(e){return/^[\r\n]+$/.test(e)?";":e}function Ze(e){return Object.freeze({kind:"operator",operator:e,boundary:jC.has(e)})}function Bo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function na(e){return Object.freeze({kind:"word",text:e})}function cb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function br(e){return JC.has(e)||/^python\d/.test(e)}var ub=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function nd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=ub.get(e)?.has(n)??!1;return nd(e,t.slice(r?2:1))}function Qs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Qs(e.slice(1));if(!$C.has(t))return[...e];return Qs(nd(t,e.slice(1)))}function rd(e){let t=rr(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Qs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function db(e){let t=rd(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return br(n)&&!yr.has(n)}function ea(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ea(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>ea(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(db(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!pb(t))return r;return[...r,...o]})}function mb(e,t){let n=rr(e);return n===void 0?void 0:t.get(n)}function Dt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function fb(e){if(Dt(e.words[0],"git"))return Dt(e.words[1],"commit");if(!Dt(e.words[0],"gh")||!Dt(e.words[2],"create"))return!1;return Dt(e.words[1],"pr")||Dt(e.words[1],"issue")}function pb(e){return(Dt(e.words[0],"cat")||Dt(e.words[0],"tee")||fb(e))&&!e.words.some(Zu)&&!e.redirections.some((n)=>Zu(n.target))}function Zu(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var od=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),id=new Set([...od,"glob"]),gb=new Set([...id,"pattern"]);class Xe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Sr(e){let t=hb(),n=wt(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((d)=>d.source===s.source);if(a!==-1){let d=i[a];if(!d)return i;return i[a]={...d,usages:[...d.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:yb(e),store:t}}function we(e,t){return e.commands.find((n)=>n.usages.includes(t))}function gt(e,t){if(!e.includes("$"))return e;return Gi(e,t)}function hb(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Ke(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let d=n.get(a);if(d)return d;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=Ju(i,a);return e.set(i,c),c},getCommandProgram:r}}function yb(e){let t=e.route.kind==="grep"?id:e.route.kind==="glob"?gb:od;return[...Kr(e.input,t),...e.route.kind==="patch"?qr(e.input):[]]}var Cb=new Set(["-S","--suffix"]);function Pn(e,t,n,r,o){if(e.status==="structural-limit")throw new Xe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Uo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(_e(i.target,s.variables),s)?i.target:null})}function jo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Cb.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Be="Git metadata and hooks are protected. Ask the user before modifying them.";function ld(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Vr(e.invocation.toolName))return null;let a=e.paths.find((l)=>sd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=we(e,"input-candidate");if(!i)return null;let s=Pn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>Eb(a,l,t,n,r),isRedirectionTarget:(a,l)=>sd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Xt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Ko(ge(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(ra(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(m)=>c?Vo(m,l):bb(m,l);if(n.markerFiles.some(d))return!0;return r&&ad(n).some(d)}if(ra(a,n))return!0;return r&&ad(n).some((c)=>Vo(c,a))}function bb(e,t){let n=Tn.relative(t,e);if(n===""||n.startsWith("..")||Tn.isAbsolute(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function Sb(e,t,n,r,o){return Xt(e,t,n,!0,r,o)}function vb(e,t,n,r,o){if(!n)return!1;return ra(Ko(ge(e,t,r,o)),n)}function sd(e,t,n,r,o,i){let s=Ko(ge(e,t,r,o));return i.includes(s)||ud(s,n)}function cd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Vo(i,Ko(ge(s,t,r,o)))))}function ra(e,t){return t.entries.includes(e)||t.directories.includes(e)||ud(e,t)}function ud(e,t){return t.hooksDirectories.some((n)=>Vo(e,n))}function ad(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Vo(e,t){let n=Tn.relative(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!Tn.isAbsolute(n)}function Ko(e){return process.platform==="win32"?e.toLowerCase():e}function Eb(e,t,n,r,o){if(Cr(e))return null;let i=Yt([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=jo(i.slice(1)),a=s.sources.find((l)=>Sb(_e(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&vb(_e(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}var Q=require("node:path");var We=require("node:path"),Rb=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],xb=` 	
-`;function vr(e,t){if(Nt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!oa(e.get("TMPDIR")??"",t)}function Jt(e,t){if(e.has("TMPDIR"))return oa(e.get("TMPDIR")??"",t);let n=ia(e,t);if(n===void 0)return!0;return oa(n,t)}function ia(e,t){return pd(e,t,"TMPDIR")}function oa(e,t){if(!e)return!1;if(wb(e))return!1;return sa(e,t)}function Nt(e,t){let n=pd(e,t,"IFS");return n!==void 0&&n!==""&&n!==xb}function sa(e,t){let n=qo(e,t.paths);if(n===null)return!1;return fd(t).some((r)=>Pb(n,r))}function md(e,t){let n=qo(e,t.paths);if(n===null)return!1;return fd(t).some((r)=>Yo(r)===Yo(n))}var dd=new WeakMap;function fd(e){let t=dd.get(e);if(t)return t;let n=_b(e);return dd.set(e,n),n}function _b(e){let t=Rb.map((r)=>qo(r,e.paths)??We.normalize(r)),n=qo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&Ab(n))return[...t,n];return t}function wb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function pd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function Ab(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function qo(e,t){try{let n=We.normalize(e);if(!We.isAbsolute(n))return n;let r=We.parse(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=We.join(i,o[s]??"");if(t.entryKind(a)==="missing")return We.join(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Pb(e,t){let n=Yo(e),r=Yo(t);if(n===r)return!0;let o=r.endsWith(We.sep)?r:`${r}${We.sep}`;return n.startsWith(o)}function Yo(e){return process.platform==="win32"?e.toLowerCase():e}var Tb=process.platform==="win32",gd=64,Ib=16384;function Er(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!fe(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!fe(n,o.id,t.paranoid))return null;return S(o.id,o.reason)}function Rr(e){let t=mu(e,gd,gd,Ib);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:kb(e)}}function kb(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>Ob(e.raw,n.span.start-e.span.start))}function Ob(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Qt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??de();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:Wb(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Je(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&Gb(e))return{kind:"outside_anchored_cwd"};let o=!r&&Cd(e,t.posixShell);if(_t(e))return{kind:"outside_anchored_cwd"};if(la(e,r))return{kind:"root_or_home_target"};if(Mb(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Xt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(Db(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(Fb(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&Ub(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&$b(e,t.resolvedCwd??i,t.environment.paths,t.budget))return{kind:"cwd_self_target"};if(jb(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function hd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Je(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(Lb(i))return!1;if(md(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Vb(r??i,s,t.environment.paths,t.budget))}function la(e,t=!1){let n=e.trim(),r=Q.posix.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function Mb(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Q.isAbsolute(o)?o:t.resolvedCwd?Q.resolve(t.resolvedCwd,o):null;if(!i)return!1;let s=Ae(D(i,t.environment.paths,t.budget));if(s===Q.parse(s).root)return!0;return s===Ae(D(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function Ae(e){let t=Q.normalize(e);if(Tb){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function Db(e,t,n,r,o,i,s,a){let l=e.trim();if(yd(l))return!1;if(!r&&sa(l,a))return!0;return(t||i&&s)&&n&&!o&&Nb(l,n)}function Nb(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Cd(e.slice(n.length+1),t)})}function Lb(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Q.posix.normalize(`/${t[1]??""}`)==="/"}function yd(e){return e.split(/[\\/]+/).includes("..")}function Wb(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=er(o.trim(),t);if(!Q.isAbsolute(i))return[];try{let s=D(i,n,r);if(tr(s,D(t,n,r)))return[];return[Ae(s)]}catch{return[]}})}function Fb(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(yd(r))return!1;let o=n?r:er(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Q.isAbsolute(o)?o:i?Q.resolve(i,o):null;if(!s)return!1;try{let a=Ae(D(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Q.sep)?l:`${l}${Q.sep}`))}catch{return!1}}function Gb(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Cd(e,t=!1){return e.includes("$")||e.includes("`")||zb(e)||t&&Hb(e)}function zb(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function Hb(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&Bb(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function Bb(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function Ub(e,t,n,r){try{return Ae(D(e,n,r))===Ae(D(t,n,r))}catch{try{return Ae(e)===Ae(t)}catch{return!1}}}function $b(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return Ae(D(Q.resolve(t,e),n,r))===Ae(D(t,n,r))}catch{try{return Ae(Q.resolve(t,e))===Ae(t)}catch{return!1}}}function jb(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return aa(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return aa(Q.resolve(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return aa(Q.resolve(a,e),t,i,s)}catch{return!1}}function aa(e,t,n,r){try{return bd(D(e,n,r),D(t,n,r))}catch{return!1}}function Vb(e,t,n,r){if(!t)return!1;try{return bd(D(t,n,r),D(e,n,r))}catch{return!0}}function bd(e,t){let n=Ae(e),r=Ae(t);return n.startsWith(`${r}${Q.sep}`)||n===r}var Kb=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Sd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",qb="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",vd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Ed="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",Yb="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",Zb="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",Xb={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Ed},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Be},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:vd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:Yb},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Sd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:qb},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Sd}};function Rd(e,t,n,r=Qt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return Jb(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function Jb(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=eS(o),s=o[i];if(!s||!Kb.has(cS(s.text)))return null;let a=Qb(o.slice(i+1));if(a.whatIfProtected)return null;if(fe(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return S("powershell.remove-item-pipeline-dynamic-target",Zb);for(let l of a.targets)if(!_t(l.text)&&la(ua(l.text)))return S(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Ed);for(let l of a.targets)if(n.resolvedCwd&&Xt(ua(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return S("powershell.remove-item-git-metadata",Be);if(!a.recursive||!a.force)return null;if(fe(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return S("powershell.remove-item-recursive-force-dynamic-target",vd);for(let l of a.targets){let c=Er(Je(ua(l.text),n),n,r,Xb);if(c)return c}return null}function Qb(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(tS(l))continue;if(s){t.push(ca(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=rS(l.text);if(!c){t.push(ca(l)),i=i||l.dynamic;continue}if(oS(c.name)){let d=c.value?nS(c.value,l):e[++a];if(d?.kind==="word"){t.push(ca(d)),i=i||d.dynamic;continue}i=!0;continue}if(iS(c.name)){n=!0;continue}if(sS(c.name)){r=!0;continue}if(aS(c.name))o=lS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function eS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function ca(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function tS(e){return e.kind==="word"&&e.text===","}function ua(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function nS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function rS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function oS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function iS(e){return"recurse".startsWith(e)}function sS(e){return e.length>=2&&"force".startsWith(e)}function aS(e){return e==="wi"||"whatif".startsWith(e)}function lS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function cS(e){return e.toLowerCase()}var In="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Zo="Unsupported heredoc syntax",xd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var Mr=require("node:path");var uS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),dS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),mS=new Set(["-o","--output","--query","--subscription"]),fS=new Set;function _d(e){if(e==="aws")return uS;if(e==="gcloud")return dS;if(e==="az")return mS;return fS}var pS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),gS=new Set;function wd(e){if(e==="git")return Oe;if(e==="docker")return pS;return gS}function ht(e,t){if(e.length===0||t.length===0)return null;let n=L(e[0]??""),r=Re(e);for(let o of t){if(!CS(n,o.command))continue;if(o.match){if(hS(n,e,o.match))return Ad(o);continue}if(!bS(n,e,o.subcommand))continue;if(vS(e,new Set(o.block_args),r))return Ad(o)}return null}function Ad(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function hS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return yS(r,n.command_path,_d(e))}function yS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function CS(e,t){return e===L(t)}function bS(e,t,n){if(!n)return!0;return Pd(t,1,n,wd(e))}function Pd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&SS(e,i,n,r))return!0;continue}return s===n}return!1}function SS(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Pd(e,t+2,n,r)}function vS(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var ES=new Set(["-e","--source"]),RS=new Set(["-F","-v","--assign","--field-separator"]),Td=new Set(["-f","--file"]),xS=new Set(["print","printf","return"]),Id=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],_S="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function kd(e,t,n){let r=!1;for(let o of wS(e)){let i=AS(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?S("awk.system-dynamic",_S):null}function ma(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&ES.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(RS.has(a)||Td.has(a))){let l=e[s+1];if(i&&=l!==void 0,Td.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function _r(e){return ma(e).sources}function wS(e){return _r(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function AS(e,t){Le(t,e);let n=e.includes("system")?fa(e,t):null,r=PS(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function fa(e,t){Le(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Jo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Od(e,i+1);continue}if(s==="/"&&Md(e,i)){i=Dd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,xr(e[a-1])||xr(e[i]))continue;let l=Xo(e,i);if(e[l]!=="(")continue;l=Xo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=Jo(e,l,c);if(!d){r=!0,o=!0;continue}if(l=Xo(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function PS(e,t){Le(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let f=Jo(e,i,d);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(d==="#"){i=Od(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&Md(e,i)){let f=Dd(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(da(e,i,"print")||da(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,u=Xo(e,m);if(da(e,u,"getline")){o=!0;let f=kS(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(MS(s,a)){o=!0;let f=IS(e,u);if(!f){r=!0,c=m,i=m;continue}if(!TS(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function xr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Xo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function TS(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Jo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=OS(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function IS(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Jo(e,t,n)}function kS(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function OS(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function da(e,t,n){return e.startsWith(n,t)&&!xr(e[t-1])&&!xr(e[t+n.length])}function MS(e,t){return t!==null&&t>=e}function Od(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Md(e,t){let n=DS(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(xr(e[r-1]))r--;return xS.has(e.slice(r,n+1))}function DS(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Dd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var NS=new Set(["sudo","env","command","builtin"]);function Qo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=LS(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function LS(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&WS(a,r);if(l)i.push(s);if(!l&&oo.has(L(a)))break;if(o)break}return i}function WS(e,t){let n=k(e),r=L(e);return r==="git"||n==="busybox"||en(e)||ss.has(n)||t.transparentWrappers.includes(n)||ie.has(r)||e==="$SHELL"||Ve(r)||ze.has(r)||t.rules.some((o)=>o.command===n)}function en(e){return NS.has(e.toLowerCase())}function tn(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Qe(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return ei([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*ei(e,t,n,r,o,i,s,a,l){let c=zo(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:d,cwd:m}=c;if(c.envSplitValues){let f=Go(c.envSplitValues,d);if(!f)throw new O("derivedCommandShape");pa(a),yield*ei(f,t,m,r,o,i,s,a,l);return}if(en(d[0]??""))throw new O("wrapperPeelIterations");let u=Qo(d,s);if(u){for(let f of[u.childIndex,...u.alternativeChildIndices])pa(a),yield*ei(f===u.childIndex?u.tokens:[...d.slice(f)],t,m,r,new Map(o),new Map(i),s,a,!0);return}if(GS(d)){pa(a),yield*ei([...d.slice(1)],t,m,r,o,i,s,a,l);return}yield FS(d,m,r,o,i,l)}function FS(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function pa(e){if(e.iterations>=Z.wrapperPeelIterations.cap)throw new O("wrapperPeelIterations");e.iterations++}function GS(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ga(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function et(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||ha(r,"recursive")){t=!0;continue}if(r==="-f"||ha(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Nd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>ha(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function ha(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var zS="find -delete permanently removes files. Use -print first to preview.",HS="find -exec rm -rf is dangerous. Use explicit file list instead.",BS=new Set(["-exec","-execdir","-ok","-okdir"]),US=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Ld(e,t){let n=e.map(w),r=$S(e,n,t);if(r)return r;if(ni(n,1)&&!VS(e,n,t)){let s=P(S("find.delete",zS),t.policy);if(s)return s}let o=t.budget??de(),i=0;while(i<n.length){let s=n[i],a=Lt(s??"");if(a>0){i+=a+1;continue}if(!yt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=wr(n,i);i=l.nextIndex;let c=qS(l.tokens,t.environment);if(c){let f=P(c,t.policy);if(f)return f}let d=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,d?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:d?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=m?.id.startsWith("custom.")?m:P(m,t.policy);if(u)return u}return null}function $S(e,t,n){if(!ni(t,1)&&!ya(t,n.environment))return null;let o=ti(e)??X(["."]),i=Qt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=Rr(s);for(let l of a.expandedTargets??[w(s)]){let c=Je(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return S("find.delete-git-metadata",Be)}}if(jS(t)&&i.resolvedCwd&&cd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return S("find.delete-git-metadata",Be);return null}function ya(e,t){let n=0;while(n<e.length){if(!yt(e[n])){n++;continue}let r=wr(e,n),o=Yt([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function jS(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function VS(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=ti(e);if(!r)return!1;let o=n.envAssignments??new Map,i=ia(o,n.environment),s=n.trustedTmpdirValue??Jt(o,n.environment),a=n.allowTmpdirVar??!vr(o,n.environment),l=Qt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??Nt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let d=Rr(c);if(d.unsafeBraceExpansion)return!1;return(d.expandedTargets??[w(c)]).every((m)=>hd(m,l,{containmentTarget:KS(m,i),targetIsLiteral:d.expandedTargets!==void 0||d.targetIsLiteral,tmpdirWordSplittingProtected:d.tmpdirWordSplittingProtected}))})}function KS(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function ti(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function qS(e,t){let n=Mt([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&et(n))return S("find.exec-rm-recursive-force",HS);return null}function wr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function ni(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(yt(r)){n=wr(e,n).nextIndex;continue}let o=Lt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function Lt(e){return US.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function yt(e){return e!==void 0&&BS.has(e)}function Ar(e){let t=Ke(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var YS=5,Ca="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function Se(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Fd(e,t,n){let r=ri(e,t,n),o=ZS(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<YS;a++){let{subcommand:l,rest:c}=tt(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(d),u=tv(m);if(u===null||u.length===0)return{blockedReason:Ca,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:Ca,expanded:!0,tokens:i}}function Gd(e,t,n){return ri(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function tt(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Oe.has(o)?2:1}return{subcommand:null,rest:[]}}function ZS(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function ri(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=JS(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...XS(e,t,n)]}}function XS(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=ba(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=ba(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Wd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Wd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Oe.has(i)){o+=2;continue}o++}return r}function JS(e,t){let n=QS(e,t),r=ev(e,t);return{blockedReason:n===null||r===null?Ca:null,entries:[...n??[],...r??[]]}}function QS(e,t){let n=pt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=Ar(n);if(!o)return null;for(let i of o){let s=ba(i);if(!s)return null;r.push(s)}return r}function ev(e,t){let n=zu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=pt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=pt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function ba(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Wd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:pt(e.slice(r+1),t,n)}}function tv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return Ar(t)}var nv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",rv="git checkout --force discards uncommitted changes. Use 'git stash' first.",ov="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",iv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",sv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",av="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",lv="git switch --force discards uncommitted changes. Use 'git stash' first.",cv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",uv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",dv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",mv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",fv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",pv="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",gv="git push --force destroys remote history. Use --force-with-lease for safer force push.",hv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",yv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Cv="git branch -D force-deletes without merge check. Use -d for safe delete.",bv="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",Sv="git merge --abort discards merge conflict resolutions. Use 'git status' first.",vv="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Ev="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Rv="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",xv="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",_v="git worktree remove --force can delete uncommitted changes. Remove --force flag.",wv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Av=new Set(["--recurse-submodules","--track","-t"]),Sa=new Set(["-b","-B","-U"]),va=new Set(["-c","-C"]),Pv=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var kn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Hd(e){let{subcommand:t,rest:n}=tt(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return Wt(Tv(n));case"switch":return Wt(Iv(n));case"restore":return Wt(Ov(n));case"reset":return Dv(n);case"clean":return Wt(Lv(n));case"rm":return Wt(Wv(n));case"push":return nn(Fv(n));case"branch":return nn(Hv(n));case"stash":return nn(Vv(n));case"worktree":return nn(Kv(n));case"rebase":return Wt(Bv(n));case"merge":return Wt(Uv(n));case"tag":return nn($v(n));case"reflog":return nn(jv(n));default:return null}}function Wt(e){return e?{...e,localDiscard:!0}:null}function nn(e){return e?{...e,localDiscard:!1}:null}function Tv(e){let{index:t,before:n}=Se(e),r=Re(n,{shortOptsWithValue:Sa});if(n.some((i)=>M(i,"--force"))||r.has("-f"))return S("git.checkout-force",rv);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(M(i,"--pathspec-from-file"))return S("git.checkout-pathspec-from-file",iv)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return S("git.checkout-ref-path",ov);return S("git.checkout-double-dash",nv)}if(kv(e).length>=2)return S("git.checkout-ambiguous",sv);return null}function Iv(e){let{before:t}=Se(e);if(t.some((r)=>M(r,"--discard-changes")))return S("git.switch-discard-changes",av);let n=Re(t,{shortOptsWithValue:va});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return S("git.switch-force",lv);return null}function kv(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(wv.has(r)){n+=2;continue}if(Av.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function Ov(e){let t=Mv(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?S("git.restore-worktree",uv):S("git.restore-unstaged",cv)}function Mv(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(Pv.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function Dv(e){let t=null;for(let n of e){if(M(n,"--hard")){t=S("git.reset-hard",dv);break}if(M(n,"--merge")){t=S("git.reset-merge",mv);break}}if(!t)return null;return Nv(e)?nn(t):Wt(t)}function Nv(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function Lv(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=Re(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return S("git.clean-force",fv);return null}function Wv(e){let t=!1,n=!1,r=!1;for(let o of Se(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=Re([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?S("git.rm-force",pv):null}function Fv(e){let{before:t,after:n}=Se(e),r=Re(t);if(t.some((s)=>M(s,"--mirror")))return S("git.push-mirror",yv);if(t.some((s)=>M(s,"--force"))||r.has("-f")||zd(t,n).some(Gv))return S("git.push-force",gv);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||zd(t,n).some(zv))return S("git.push-delete",hv);return null}function zd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function Gv(e){return e.startsWith("+")||e.includes(":+")}function zv(e){return e.length>1&&e.startsWith(":")}function Hv(e){let{before:t}=Se(e),n=Re(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return S("git.branch-force-delete",Cv);return null}function Bv(e){let{before:t}=Se(e);return t.some((n)=>M(n,"--abort"))?S("git.rebase-abort",bv):null}function Uv(e){let{before:t}=Se(e);return t.some((n)=>M(n,"--abort"))?S("git.merge-abort",Sv):null}function $v(e){let{before:t}=Se(e);return Re(t).has("-d")||t.some((r)=>M(r,"--delete"))?S("git.tag-delete",vv):null}function jv(e){return e[0]==="delete"?S("git.reflog-delete",Ev):null}function Vv(e){for(let t of e){if(t==="drop")return S("git.stash-drop",Rv);if(t==="clear")return S("git.stash-clear",xv)}return null}function Kv(e){let{before:t}=Se(e);if(!t.includes("remove"))return null;let r=Re(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return S("git.worktree-remove-force",_v);return null}var Ud=require("node:path");function $d(e,t){return Zs.some((n)=>t?.has(n)||e.has(n))}function jd(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(Ud.resolve(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=Bd(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=Bd(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Oe.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function Bd(e,t,n){try{let r=Ot(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Vd(e,t,n){if(!t.localDiscard||!n.worktreeMode||$d(n.environment.env,n.envAssignments))return null;let r=jd(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(qv(e,n,o))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function qv(e,t,n){let{subcommand:r,rest:o}=tt(e),i=r?.toLowerCase();if(t.dynamicArguments||Yv(o)||eE(e,t.environment.env,t.envAssignments,n)||Jv(o)||Zv(i,o))return!0;return i==="clean"&&Qv(o)>1}function Yv(e){return e.some((t)=>/[$*?[]/.test(t))}function Zv(e,t){if(e==="checkout"){let{before:n}=Se(t),r=Re(n,{shortOptsWithValue:Sa}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=Se(t),r=Re(n,{shortOptsWithValue:va}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||Xv(s))||r.has("-C");return o&&i}return!1}function Xv(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function Jv(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function Qv(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function eE(e,t,n,r){if(pt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=ri(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>nE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||tE(s.value);if(Bu(n))return!0;return r.recursiveSubmodules}function tE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function nE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}var rE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",oE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function oi(e,t){return Kd(e.map(w),t)}function Kd(e,t,n){let r=Fd(e,t.environment.env,t.envAssignments),o=r.blockedReason?P(S("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((Hu(t.envAssignments)||Gd(e,t.environment.env,t.envAssignments))&&iE(i))return S("git.ssh-env",rE);let s=Hd(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=Vd(e,s,t);if(!a)return s;return n?.(a),null}function qd(e,t){let n=null;return{match:Kd(e.map(w),t,(o)=>{n=o}),relaxation:n}}function iE(e){let{subcommand:t,rest:n}=tt(e),r=t?.toLowerCase();if(!r)return!1;if(oE.has(r))return!0;if(r==="archive")return Se(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&sE(n)}function sE(e){return e.find((t)=>!aE(t))?.toLowerCase()==="update"}function aE(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}var Em=require("node:path");function Yd(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function ii(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Zd="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",lE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",cE="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Jd="rm -rf targeting root or home directory is extremely dangerous and always blocked.",uE="rm -rf in home directory is dangerous. Change to a project directory first.",Xd={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Jd},git_metadata_target:{id:"rm.git-metadata",reason:Be},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:cE},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:uE},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Zd},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:lE},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Zd}};function si(e,t){let n=Qt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=et(r),i=Nd(r),s=mE(e);for(let a of s){let l=Rr(a.word);if(o&&l.unsafeBraceExpansion){let c=P(Er({kind:"outside_anchored_cwd"},n,t.policy,Xd),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let d=ke(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Xt(d,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return S("rm.git-metadata",Be);if(i&&!o){let u=Je(d,n,m);if(u.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home",Jd);if(u.kind==="git_metadata_target")return S("rm.git-metadata",Be);continue}if(!o)continue;for(let u of dE(d,n,m)){let f=Er(u,n,t.policy,Xd),p=P(f,t.policy);if(p)return p}}}return null}function dE(e,t,n){let r=Je(e,t,n);if(r.kind==="cwd_self_target")return[r,Je(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Je(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Je(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function mE(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ft={kind:"none"},rn={kind:"dynamic"},fE=new Set(["<","<<","<<-","<<<","<&","<>"]),em=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,pE=/^(?:[0-9]+|[@*])$/,gE=It.maxWords,hE=It.maxInputLength;function tm(e){if(!e||k(L(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=$s(e,m+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(m,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=h;continue}let f=Oo(e,m,n,r,o,i);if(f){let p=gu(f,l,c);if(m=p.next,u||=p.limited,a=lr(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=Cu(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function Oo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=$s(e,t+u,n,m),f=d===-1?n:d,p=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:By(e,t+u,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],S=!1,T=t+u;while(T<f){let R=Oo(e,T,f,r,o,i+1);if(!R){T++;continue}if(v.push(...R.program.nodes),E.push(...R.program.issues),S||=R.program.status==="limited",T=R.next,S)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:xe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:ko(E,S),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=Po(e,t+u,f,r,o,i+1),g=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&cr(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:xe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:ko([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function xy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?Oo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function gu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function $s(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
+`?a+2:a+1,m=zs(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=hu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=_y(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=Gs(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function _y(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=hu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function hu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!jy(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function To(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function wy(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function Io(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function yu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Ay(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Py(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Py(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return wo(e,t+1,n,16,2,t+1);if(r==="u")return wo(e,t+1,n,16,4,t+1);if(r==="U")return wo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return wo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function wo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function ko(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function Cu(e,t,n,r,o){let i=yu(e,t,n);return{text:r+e.slice(t,i),provenance:lr(o,"variable"),next:i}}function Ty(e,t,n){let r=_o(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,p=c?"))":d?"`":")",h=$s(e,a+f,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let f=yu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function lr(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function Iy(e,t,n){return t+1>=n||Io(e[t+1]??"")||To(e,t+1)!==null}var ky=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Oy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function My(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Dy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Dy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Ny(e,t);if(n==="env")return Ly(e,t);if(n==="sudo")return Wy(e,t);return}function Ny(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Ly(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(ky.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function Wy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Oy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function bu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=Su(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>vu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function Fy(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=Su(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>vu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>En(e,t.span.start,t.span.end,a,"literal",!1))}}function Su(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>du(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=du(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...Gy(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function du(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Hy(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:zy(e,r)}}function Gy(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function zy(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Hy(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function vu(e,t){let n=`x${e}`,r=Us(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function By(e,t,n,r){return xe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function Rn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ao(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Hs(e){return e.used++,e.used<=e.max}function Uy(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function cr(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>cr(n.nodes));return(t.kind==="group"||t.kind==="function")&&cr(t.body.nodes)})}function $y(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function Eu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function mu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!fu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Bs(e,t){if(!Eu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function jy(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var xu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Vy=new Set(["gc","cat","type","cp","mv","rm"]),_u=["-rec","-for","-path","-literalpath","-whatif"],Ky=/^\$env:\w/i,qy=/^(?:\$\{?\w+\}?|~)\\./;function wu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...xu].some((o)=>n.includes(o))&&!(n.includes("rm")&&_u.some((o)=>n.includes(o)))&&!n.includes("<#")&&!Yy(n))return!1;let r=qs(e,t);if(Au(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ks(r).some(Zy)}function Au(e){return e.nodes.some((t)=>{if(t.kind==="group")return Au(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function Yy(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Zy(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&xu.has(n))return!0;let r=e.slice(t+1);if(n&&Vy.has(n)&&r.some(Xy))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return _u.some((s)=>i.startsWith(s))})}function Xy(e){return Ky.test(e)||qy.test(e)}function qs(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return xe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ys(e,0,e.length,t,0);return xe({kind:"program",dialect:"powershell",source:e,span:n,status:nC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ys(e,t,n,r,o,i=!1){let s=[],a=[],l=Ro(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};xo(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=tC(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`){m();let y=f==="\r"&&e[d+1]===`
+`?d+2:d+1;s.push(js(e,d,y)),d=y;continue}d++;continue}let h=Iu(e,d);if(h){m(),s.push(js(e,d,d+h.length)),d+=h.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Tu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ys(e,d+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=xe({kind:"program",dialect:"powershell",source:e.slice(d+1,v),span:{start:d+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(js(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?Ru(e,v,n,r,o):void 0,S=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:S}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=S,d=S;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Fs({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let g=Ru(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,u||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next>d?g.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function Ru(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(p)=>{let h=Jy(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),u+=Vs(h.program),m||=h.program.status==="limited",s="command-substitution",h.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||Iu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[f+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=h,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(p==="'"){a=!0,f++;let h=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){h=!0,f++;break}i+=e[f]??"",f++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let h=!1;while(f<n){let g=e[f];if(g==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(g==='"'){h=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=g??"",f++}if(!h)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:En(e,t,f,i,s,a,s==="literal"?void 0:Qy(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function Jy(e,t,n,r,o){let i=Pu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:xe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Tu(r.maxDepth)],nodes:[]}),next:a};let l=Ys(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:xe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Pu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Vs(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Vs(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Vs(r)}}return t}function Qy(e,t,n){let r=_o(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Pu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=eC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function eC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Tu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ks(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ks(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ks)]})}function Iu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function tC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function nC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function js(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function qe(e,t="auto",n=kt){if(t==="powershell"||t==="auto"&&wu(e.slice(0,n.maxInputLength),n))return qs(e,n);return pu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function xn(e,t){return e==="posix"?t:J(t.map((n)=>n.text))}function Mo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function J(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Zs(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function te(e){return e.value.length}function ur(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Le(e,t){ur(e,t)}function qt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function q(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Xs(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function Y(e,t,n){if(t+n.length>te(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function dt(e,t,n){return!qt(C(e,t-1))&&Y(e,t,n)&&!qt(C(e,t+n.length))}function mt(e,t){return qt(C(e,t-1))!==qt(C(e,t))}function pe(e){return e===`
+`||e===";"||e==="&"||e==="|"}function _n(e){return e==="|"||e===";"}function Do(e,t,n){let r=Zs(e,n);if(t==="rm")return rC(r);if(t==="dd")return iC(r);return Lu(r,!0)}function No(e,t,n){let r=Zs(e,n);if(t==="rm")return sC(r);if(t==="reset-hard")return Du(r,"--ha","rd");if(t==="reset-merge")return Du(r,"--me","rge");if(t==="clean")return uC(r);if(t==="checkout")return mC(r);if(t==="push-force")return fC(r);if(t==="push-refspec")return pC(r);if(t==="push-delete")return gC(r);if(t==="branch")return hC(r);if(t==="tag")return bC(r);if(t==="restore")return SC(r);return Lu(r,!1)}function rC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=te(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(dt(e,i,"rm")&&q(l)&&l!==`
+`)t=!0,i++;continue}let a=oC(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===te(e)){if(o>=0){let l=ku(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(q(s)){if(o<0)continue;if(Y(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=ku(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function oC(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(Y(e,t,String.raw`\n`))return t+2;if(Y(e,t,String.raw`\x0a`)||Y(e,t,String.raw`\x0A`))return t+5;if(Y(e,t,String.raw`\u000a`)||Y(e,t,String.raw`\u000A`))return t+7;return Y(e,t,String.raw`\012`)?t+4:-1}function ku(e,t,n){if(Ou(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Ou(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Ou(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!Y(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function iC(e){let t=!1;for(let n=0;n<te(e);n++){if(pe(C(e,n))){t=!1;continue}if(dt(e,n,"dd")){t=!0,n++;continue}if(!t||!dt(e,n,"of")||!Y(e,n,"of=/dev/"))continue;let r=n+8;if(r<te(e)&&!q(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function sC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=te(e);){let i=C(e,o);if(o===te(e)||pe(i)){t=!1,n=!1,r=!1,o++;continue}let s=lC(e,o);if(s>=0){if(aC(e,s))return!0;let a=s,l=!1;while(q(C(e,a)))l||=C(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(Y(e,o,"--")&&(o===0||q(C(e,o-1)))&&(!C(e,o+2)||q(C(e,o+2))||pe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=Y(e,o,"--recursive")&&mt(e,o+11)||Js(e,o,"recursive"),r||=Y(e,o,"--force")&&mt(e,o+7)||Js(e,o,"force"),n&&r)return!0;o++}return!1}function Js(e,t,n){if(!Y(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||q(o)||pe(o))break;if(o!==n[r])return!1;r++}return r>0&&mt(e,t+r+2)}function aC(e,t){let n=t,r=!1,o=!1;while(n<te(e)){while(q(C(e,n)))n++;let i=n;while(n<te(e)&&!q(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&Y(e,i,"--"))return!1;let s=Mu(e,i,"recursive"),a=Mu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=cC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Mu(e,t,n){return Y(e,t,`--${n}`)&&mt(e,t+n.length+2)||Js(e,t,n)}function lC(e,t){if(t>0&&qt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!q(C(e,n+1)))return-1;return n+1}function cC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=C(e,c)??"",m=(u==="r"||u==="f")&&mt(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Du(e,t,n){return mr(e,"reset",_n,!0,(r)=>C(e,r)==="-"&&wn(e,r,t,n)?!0:r)}function uC(e){return mr(e,"clean",_n,!0,(t)=>{if(C(e,t)!=="-")return t;if(wn(e,t,"--fo","rce"))return!0;let n=dr(e,t,_n);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function Lo(e,t,n){if(!dt(e,t,"git"))return null;let r=t+3;if(!q(C(e,r)))return{commandEnd:-1,next:r};while(q(C(e,r)))r++;while(r<te(e)){if(pe(C(e,r)))return{commandEnd:-1,next:r};let o=dr(e,r,pe);if(dt(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&Y(e,r,"--"),s=dC(e,r,o);r=o;while(q(C(e,r)))r++;if(i)return{commandEnd:dt(e,r,n)?r+n.length:-1,next:dr(e,r,pe)};if(!s)continue;if(r>=te(e)||pe(C(e,r)))return{commandEnd:-1,next:r};r=dr(e,r,pe);while(q(C(e,r)))r++}return{commandEnd:-1,next:r}}function dC(e,t,n){for(let r of Oe)if(n-t===r.length&&Y(e,t,r))return!0;return!1}function mC(e){return Nu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function fC(e){return mr(e,"push",_n,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!qt(C(e,t+2))&&!Y(e,t+2,"-with-lease"))return!0;let n=Wu(e,t,"--fo","rce");if(n>=0&&!Y(e,n,"-with-lease"))return!0;return t})}function pC(e){return mr(e,"push",pe,!1,(t)=>{if(q(C(e,t))&&C(e,t+1)==="+"&&t+2<te(e)&&!pe(C(e,t+2))&&!q(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function gC(e){return mr(e,"push",pe,!1,(t)=>{if(C(e,t)==="-"&&wn(e,t,"--de","lete"))return!0;if(q(C(e,t))&&C(e,t+1)===":"&&t+2<te(e)&&!q(C(e,t+2))&&!pe(C(e,t+2)))return!0;return t})}function hC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=te(e);o++){if(o===te(e)||pe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Lo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=dr(e,o,pe),s=yC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function yC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(wn(e,i,"--de","lete"))r=!0;if(wn(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&CC(C(e,s))){let u=C(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!mt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function CC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function bC(e){return Nu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Nu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<te(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(q(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Lo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&q(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(wn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&mt(e,r+1))return!0;if(_n(o))i.outerActive=!1}return!1}function mr(e,t,n,r,o){let i=!1;for(let s=0;s<te(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=Lo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||q(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(C(e,u)))i=!1;s=c}if(l)i=!1}return!1}function SC(e){let t=!1;for(let n=0;n<te(e);n++){if(Xs(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Lo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(Y(e,n+2,"staged")||Y(e,n+2,"help")))t=!1}return t}function Lu(e,t){let n=!1;for(let r=0;r<te(e);r++){let o=C(e,r),i=t?Xs(o):pe(o);if(n&&q(o)&&C(e,r+1)==="-"&&dt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(dt(e,r,"find"))n=!0,r+=3}return!1}function dr(e,t,n){let r=t;while(r<te(e)&&!q(C(e,r))&&!n(C(e,r)))r++;return r}function Wu(e,t,n,r){if(!Y(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return mt(e,o)?o:-1}function wn(e,t,n,r){return Wu(e,t,n,r)>=0}function ft(e,t){ur(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Le(t,a);if((s.regex?.test(a)??!1)||s.scan&&No(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var vC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Gu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;ur(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return zu(t.nodes,r,i)}function zu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return zu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return EC(r,t,n)})}function EC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!vC.test(o.text));return e.words.every((o,i)=>o===t||Fu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Fu(o.target.raw,n.anchored,!0)))}function Fu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var fr=require("node:path");function pr(e,t,n,r){let o=fr.isAbsolute(e)?fr.resolve(e):t?fr.resolve(t,e):void 0;if(!o)return;try{return D(o,n,r)}catch{return o}}function Hu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var An="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",gr="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Qs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),RC=new Set(["-p","--print"]),xC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),_C=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),wC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),AC=new Map([["python",new Set(["m"])]]),PC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),TC=new Set(["always","default","never"]),IC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),kC=/\\\r?\n/g,OC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Uu(e){return Fo(e).code}function Wo(e){return Fo(e).sources}function $u(e){return OC.get(ta(e))??[]}function Fo(e){let t=ta(e[0]??"");if(!Qs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ye(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ye(t,n,r,o,i,s);if(t==="node"&&RC.has(s)){let m=e[i+1];if(m===void 0)return Ye(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(DC(t,s)){let m=e[i+1];if(m===void 0)return Ye(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ye(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(NC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=MC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Ye(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ye(t,n,r,o);if(PC.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&IC.has(s))||t==="python"&&!TC.has(m))return Ye(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(AC.get(t)?.has(d)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Ye(t,n,r,o)}if(xC.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(_C.get(t)?.has(d)){if(m+1===s.length)i++;break}if(wC.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ye(t,n,r,o);if(c)i++}return Ye(t,n,r,o,void 0,void 0,!0)}function Ye(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function MC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function ea(e,t){return ta(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function ta(e){let t=k(e).toLowerCase();return so.test(t)?"python":t}function DC(e,t){return Qs.get(e)?.has(t)??!1}function NC(e){return Qs.get(e)?.has("--eval")??!1}function hr(e,t){let n=FC(e,t);if(!Bu(n,t))return!1;Le(t,n);let r=WC(n);if(Bu(r,t))return!0;return Le(t,r),LC.test(r)}var LC=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function WC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Bu(e,t){if(Do(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Le(t,e),r.test(e))return!0;if(Do(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Le(t,e),r.test(e))return!0;if(Do(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Le(t,e),n.some((o)=>No(o,r))))}function FC(e,t){return Le(t,e),e.replace(kC,"")}var In=require("node:path");var Cr=require("node:path");var Ot=require("node:path");function Mt(e,t,n){if(wt(t))throw Error("Unsupported Windows namespace path");let r=Ot.isAbsolute(t)?Ot.parse(t).root:"",o=r||e;for(let i of zC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=Ot.dirname(o);continue}let s=GC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function GC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${Ot.sep}${t}`}function zC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var na=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],HC=new Set(na),BC=1024,ju=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Vu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),UC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Go(e){return HC.has(e)}function ra(e){return Go(e)||ju.has(e)||Vu.has(e)||Xn(e)}function pt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Ku(e,t){let n=pt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=BC?{state:"valid",count:r}:{state:"invalid"}}function zo(e,t,n){let o=e.match(UC)?.[1];if(!o||!ra(o))return null;let i=e.indexOf("=");return{name:o,value:`${pt(o,t,n)??""}${e.slice(i+1)}`}}function qu(e){return Zu(e,Vu)}function Yu(e){return Zu(e,ju)}function Zu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Ju=/^[A-Za-z_][A-Za-z0-9_]*=/;function Be(e){if(!Ju.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Ho(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Be(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Qu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Yt(e,t,n,r){if(!Qu(Pn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<X.wrapperPeelIterations.cap;m++){let d=Xu(i),f=Ho(i);for(let[h,g]of f.envAssignments)s.set(h,g),a.set(h,g);if(i=f.words,i.length===0)break;while(i.length>0&&Pn(i).includes("=")&&!jC(i)){let h=VC(Pn(i),a,t.env)??zo(Pn(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=Pn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=qC(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=XC(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=JC(i);if(p==="builtin")i=i.slice(Ze(i,1)==="--"?2:1);if(Xu(i)===d)break}let u=Ho(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:$C(u.words,o)}}function $C(e,t){return e.some((n)=>!t.has(n))}function Xu(e){return e.map(w).join(" ")}function Pn(e){let t=e[0];return t?w(t):""}function Ze(e,t){let n=e[t];return n?w(n):void 0}function jC(e){return Ju.test(Pn(e))}function VC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var KC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function qC(e,t,n){let r=1,o=n;while(r<e.length){let i=Ze(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Ze(e,r+1);o=s?yr(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=yr(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=yr(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(KC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var YC=new Set(["-i","-0","--null"]),ZC=new Set(["-u","--unset","-C","--chdir","-P"]);function XC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Ze(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(YC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Ze(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:Ze(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(ZC.has(c)){if(c==="-C"||c==="--chdir"){let m=Ze(e,a+1);s=m?yr(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=yr(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Be(c))break;while(a<e.length){let m=Be(Ze(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Ze(e,a)==="--")a++;return l(a)}return l(a)}function yr(e,t,n){if(t==="")return null;if(!e&&!Cr.isAbsolute(t))return null;let r=Cr.isAbsolute(t)?Cr.parse(t).root:n.realpath(e??"/");if(r===null)return null;try{return Mt(r,t,n)}catch{return null}}function JC(e){if(Ze(e,1)==="-v")return[...J(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Ze(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var QC=/['"\\$`{}#]/;function Bo(e,t){if(e.some((r)=>QC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function Dt(e,t,n){return Uo(e,t,n).tokens}function eb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Zt(e,t,n,r=0){let o=Uo(e,t,n),i=(o.envSplitValues??[]).flatMap(eb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Zt(s,t,n,r+1)}function Uo(e,t,n,r){if(!Qu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Yt(J(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var aa=Symbol("adopt-as-operand"),tb=new Set(["env","sudo","command","builtin"]),nb=new Set(["&&","||","|&","|","&",";"]),rb=new Set(["<<","<<<",">|"]),ob=new Set(["|","|&"]),ib=/[*@#?$!_-]/,sb=/^\w+(?::\w+)*/,ab=Object.freeze([]),br=Object.freeze({kind:"scope",edge:"enter"}),Sr=Object.freeze({kind:"scope",edge:"exit"}),lb=Object.freeze([]),cb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),vr=new Set(["bash","sh","zsh","dash","ksh"]),ub=256,od=new WeakMap;function id(e,t){let n=t.status==="complete"?new Set(sa(t)):new Set,r=fb(e,n);if(lo(r))return $o("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Xt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return $o("structural-limit",r,t);if(o.invalid)return $o("invalid",r,t);let s=$o("complete",r,t,o.assignmentFallbacks);return od.set(s,Object.freeze(i)),s}function Vo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of sd(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=db(a,s,n,r),c=a.length>0&&ob.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===aa){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function Ko(e){return sd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function _e(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:_e(i,t);return a?_e(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function Er(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function db(e,t,n,r){let o=Er(e)?new Map([...t.variables,...mb(e,t.variables)]):t.variables,i=Dt([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:he(_e(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function mb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],_e(o,t)]]:[]})}function sd(e){return od.get(e)??ab}function fb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function $o(e,t,n,r=lb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Xt(e,t){return e.nodes.flatMap((n,r)=>pb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function pb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Xe(bb(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Xe(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[jo("{"),...Xt(e.body,a),...s?[jo("}")]:[]]:[br,Xe("("),...Xt(e.body,a),...s?[Xe(")")]:[],Sr]}]}let o=Rb(e,r.functions);if(o){if(r.depth>=kt.maxDepth||++r.flags.expansions>ub)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...ed(e,r),jo(";"),...Xt(o,{...r,depth:r.depth+1}),jo(";")]},...td(e,t,n,r)]}return[{start:e.span.start,events:ed(e,r)},...td(e,t,n,r)]}function ed(e,t){return[...e.words.map((n)=>({start:n.span.start,events:ld(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:gb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function gb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?ld(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[la(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:Sb(r),targetOrder:rb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:ud(t)}:{}}),...s===void 0?o:o.slice(1)]}function td(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[la(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Xe(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...ad(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?hb(t,n,r):[]]}function hb(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:ad(n.source.slice(r.span.end,e.span.end),n)}]}function ad(e,t){if(t.depth>=kt.maxDepth)return t.flags.limited=!0,[];let n=qe(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Xt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function ld(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Xe("glob"):s!==""||e.quoted&&o.length===0?la(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of oa(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Xe(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=oa(f,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=u?Xt(u,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(br,...p,Sr);continue}let m=u?Xt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(br,...m,Sr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Xe("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),br,...m,...c.raw.endsWith(")")?[Xe(")")]:[],Sr);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>Xe("(")),...d===1?[br]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>Xe(")")):[],...d===1?[Sr]:[])}return l(),o}function oa(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=nd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=nd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function nd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=Cb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return yb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&ib.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?sb:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function yb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=oa(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function Cb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function bb(e){return/^[\r\n]+$/.test(e)?";":e}function Xe(e){return Object.freeze({kind:"operator",operator:e,boundary:nb.has(e)})}function jo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function la(e){return Object.freeze({kind:"word",text:e})}function Sb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function Rr(e){return cb.has(e)||/^python\d/.test(e)}var vb=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function cd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=vb.get(e)?.has(n)??!1;return cd(e,t.slice(r?2:1))}function ia(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return ia(e.slice(1));if(!tb.has(t))return[...e];return ia(cd(t,e.slice(1)))}function ud(e){let t=ar(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return ia(n<0?[]:e.words.slice(n).map((r)=>r.text))}function Eb(e){let t=ud(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return Rr(n)&&!vr.has(n)}function sa(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return sa(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>sa(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(Eb(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!_b(t))return r;return[...r,...o]})}function Rb(e,t){let n=ar(e);return n===void 0?void 0:t.get(n)}function Nt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function xb(e){if(Nt(e.words[0],"git"))return Nt(e.words[1],"commit");if(!Nt(e.words[0],"gh")||!Nt(e.words[2],"create"))return!1;return Nt(e.words[1],"pr")||Nt(e.words[1],"issue")}function _b(e){return(Nt(e.words[0],"cat")||Nt(e.words[0],"tee")||xb(e))&&!e.words.some(rd)&&!e.redirections.some((n)=>rd(n.target))}function rd(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var dd=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),md=new Set([...dd,"glob"]),wb=new Set([...md,"pattern"]);class Je extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function xr(e){let t=Ab(),n=At(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:Pb(e),store:t}}function we(e,t){return e.commands.find((n)=>n.usages.includes(t))}function gt(e,t){if(!e.includes("$"))return e;return ji(e,t)}function Ab(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=qe(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=id(i,a);return e.set(i,c),c},getCommandProgram:r}}function Pb(e){let t=e.route.kind==="grep"?md:e.route.kind==="glob"?wb:dd;return[...Zr(e.input,t),...e.route.kind==="patch"?Xr(e.input):[]]}var Tb=new Set(["-S","--suffix"]);function Tn(e,t,n,r,o){if(e.status==="structural-limit")throw new Je;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Vo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(_e(i.target,s.variables),s)?i.target:null})}function qo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Tb.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Ue="Git metadata and hooks are protected. Ask the user before modifying them.";function gd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Yr(e.invocation.toolName))return null;let a=e.paths.find((l)=>fd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=we(e,"input-candidate");if(!i)return null;let s=Tn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>Mb(a,l,t,n,r),isRedirectionTarget:(a,l)=>fd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Jt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Zo(he(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(ca(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?Yo(m,l):Ib(m,l);if(n.markerFiles.some(u))return!0;return r&&pd(n).some(u)}if(ca(a,n))return!0;return r&&pd(n).some((c)=>Yo(c,a))}function Ib(e,t){let n=In.relative(t,e);if(n===""||n.startsWith("..")||In.isAbsolute(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function kb(e,t,n,r,o){return Jt(e,t,n,!0,r,o)}function Ob(e,t,n,r,o){if(!n)return!1;return ca(Zo(he(e,t,r,o)),n)}function fd(e,t,n,r,o,i){let s=Zo(he(e,t,r,o));return i.includes(s)||yd(s,n)}function hd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Yo(i,Zo(he(s,t,r,o)))))}function ca(e,t){return t.entries.includes(e)||t.directories.includes(e)||yd(e,t)}function yd(e,t){return t.hooksDirectories.some((n)=>Yo(e,n))}function pd(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Yo(e,t){let n=In.relative(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!In.isAbsolute(n)}function Zo(e){return process.platform==="win32"?e.toLowerCase():e}function Mb(e,t,n,r,o){if(Er(e))return null;let i=Zt([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=qo(i.slice(1)),a=s.sources.find((l)=>kb(_e(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&Ob(_e(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}var Z=require("node:path");var We=require("node:path"),Db=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Nb=` 	
+`;function _r(e,t){if(Lt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!ua(e.get("TMPDIR")??"",t)}function Qt(e,t){if(e.has("TMPDIR"))return ua(e.get("TMPDIR")??"",t);let n=da(e,t);if(n===void 0)return!0;return ua(n,t)}function da(e,t){return Sd(e,t,"TMPDIR")}function ua(e,t){if(!e)return!1;if(Wb(e))return!1;return kn(e,t)}function Lt(e,t){let n=Sd(e,t,"IFS");return n!==void 0&&n!==""&&n!==Nb}function kn(e,t){let n=Xo(e,t.paths);if(n===null)return!1;return bd(t).some((r)=>ei(n,r))}function Qo(e,t){let n=Xo(e,t.paths);if(n===null)return!1;return bd(t).some((r)=>Jo(r)===Jo(n))}var Cd=new WeakMap;function bd(e){let t=Cd.get(e);if(t)return t;let n=Lb(e);return Cd.set(e,n),n}function Lb(e){let t=Db.map((r)=>Xo(r,e.paths)??We.normalize(r)),n=Xo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&Fb(n))return[...t,n];return t}function Wb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Sd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function Fb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Xo(e,t){try{let n=We.normalize(e);if(!We.isAbsolute(n))return n;let r=We.parse(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=We.join(i,o[s]??"");if(t.entryKind(a)==="missing")return We.join(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function ei(e,t){let n=Jo(e),r=Jo(t);if(n===r)return!0;let o=r.endsWith(We.sep)?r:`${r}${We.sep}`;return n.startsWith(o)}function Jo(e){return process.platform==="win32"?e.toLowerCase():e}var Gb=process.platform==="win32",vd=64,zb=16384;function wr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!fe(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!fe(n,o.id,t.paranoid))return null;return b(o.id,o.reason)}function Ar(e){let t=bu(e,vd,vd,zb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:Hb(e)}}function Hb(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>Bb(e.raw,n.span.start-e.span.start))}function Bb(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function en(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??de();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:qb(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Qe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&Zb(e))return{kind:"outside_anchored_cwd"};let o=!r&&Rd(e,t.posixShell);if(wt(e))return{kind:"outside_anchored_cwd"};if(fa(e,r))return{kind:"root_or_home_target"};if($b(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Jt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(jb(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(Yb(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&eS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>tS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(nS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(Ub(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function Ub(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Z.isAbsolute(r)||r.startsWith("~"))return!1;if(pa(r))return!1;if(xd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return kn(Z.resolve(t.resolvedCwd,r),t.environment)}function Ed(e,t,n={}){let{containmentTarget:r,...o}=n;if(Qe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(Kb(i))return!1;if(Qo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>xd(r??i,s,t.environment.paths,t.budget))}function fa(e,t=!1){let n=e.trim(),r=Z.posix.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function $b(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Z.isAbsolute(o)?o:t.resolvedCwd?Z.resolve(t.resolvedCwd,o):null;if(!i)return!1;let s=Ae(D(i,t.environment.paths,t.budget));if(s===Z.parse(s).root)return!0;return s===Ae(D(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function Ae(e){let t=Z.normalize(e);if(Gb){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function jb(e,t,n,r,o,i,s,a){let l=e.trim();if(pa(l))return!1;if(!r&&kn(l,a))return!0;return(t||i&&s)&&n&&!o&&Vb(l,n)}function Vb(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Rd(e.slice(n.length+1),t)})}function Kb(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Z.posix.normalize(`/${t[1]??""}`)==="/"}function pa(e){return e.split(/[\\/]+/).includes("..")}function qb(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=or(o.trim(),t);if(!Z.isAbsolute(i))return[];try{let s=D(i,n,r);if(ir(s,D(t,n,r)))return[];return[Ae(s)]}catch{return[]}})}function Yb(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(pa(r))return!1;let o=n?r:or(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Z.isAbsolute(o)?o:i?Z.resolve(i,o):null;if(!s)return!1;try{let a=Ae(D(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Z.sep)?l:`${l}${Z.sep}`))}catch{return!1}}function Zb(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Rd(e,t=!1){return e.includes("$")||e.includes("`")||Xb(e)||t&&Jb(e)}function Xb(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function Jb(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&Qb(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function Qb(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function eS(e,t,n,r){try{return Ae(D(e,n,r))===Ae(D(t,n,r))}catch{try{return Ae(e)===Ae(t)}catch{return!1}}}function tS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return Ae(D(Z.resolve(t,e),n,r))===Ae(D(o,n,r))}catch{try{return Ae(Z.resolve(t,e))===Ae(o)}catch{return!1}}}function nS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ma(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ma(Z.resolve(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ma(Z.resolve(a,e),t,i,s)}catch{return!1}}function ma(e,t,n,r){try{return _d(D(e,n,r),D(t,n,r))}catch{return!1}}function xd(e,t,n,r){if(!t)return!1;try{return _d(D(t,n,r),D(e,n,r))}catch{return!0}}function _d(e,t){let n=Ae(e),r=Ae(t);return n.startsWith(`${r}${Z.sep}`)||n===r}var rS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),wd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",oS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Ad="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Pd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",iS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",sS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",aS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Pd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Ue},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Ad},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:iS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:wd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:oS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:wd}};function Td(e,t,n,r=en({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return lS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function lS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=uS(o),s=o[i];if(!s||!rS.has(bS(s.text)))return null;let a=cS(o.slice(i+1));if(a.whatIfProtected)return null;if(fe(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",sS);for(let l of a.targets)if(!wt(l.text)&&fa(ha(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Pd);for(let l of a.targets)if(n.resolvedCwd&&Jt(ha(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return b("powershell.remove-item-git-metadata",Ue);if(!a.recursive||!a.force)return null;if(fe(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",Ad);for(let l of a.targets){let c=wr(Qe(ha(l.text),n),n,r,aS);if(c)return c}return null}function cS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(dS(l))continue;if(s){t.push(ga(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=fS(l.text);if(!c){t.push(ga(l)),i=i||l.dynamic;continue}if(pS(c.name)){let u=c.value?mS(c.value,l):e[++a];if(u?.kind==="word"){t.push(ga(u)),i=i||u.dynamic;continue}i=!0;continue}if(gS(c.name)){n=!0;continue}if(hS(c.name)){r=!0;continue}if(yS(c.name))o=CS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function uS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function ga(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function dS(e){return e.kind==="word"&&e.text===","}function ha(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function mS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function fS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function pS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function gS(e){return"recurse".startsWith(e)}function hS(e){return e.length>=2&&"force".startsWith(e)}function yS(e){return e==="wi"||"whatif".startsWith(e)}function CS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function bS(e){return e.toLowerCase()}var On="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",ti="Unsupported heredoc syntax",Id="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var SS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),vS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),ES=new Set(["-o","--output","--query","--subscription"]),RS=new Set;function kd(e){if(e==="aws")return SS;if(e==="gcloud")return vS;if(e==="az")return ES;return RS}var xS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),_S=new Set;function Od(e){if(e==="git")return Oe;if(e==="docker")return xS;return _S}function ht(e,t){if(e.length===0||t.length===0)return null;let n=L(e[0]??""),r=Re(e);for(let o of t){if(!PS(n,o.command))continue;if(o.match){if(wS(n,e,o.match))return Md(o);continue}if(!TS(n,e,o.subcommand))continue;if(kS(e,new Set(o.block_args),r))return Md(o)}return null}function Md(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function wS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return AS(r,n.command_path,kd(e))}function AS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function PS(e,t){return e===L(t)}function TS(e,t,n){if(!n)return!0;return Dd(t,1,n,Od(e))}function Dd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&IS(e,i,n,r))return!0;continue}return s===n}return!1}function IS(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Dd(e,t+2,n,r)}function kS(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var OS=new Set(["-e","--source"]),MS=new Set(["-F","-v","--assign","--field-separator"]),Nd=new Set(["-f","--file"]),DS=new Set(["print","printf","return"]),Ld=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],NS="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Wd(e,t,n){let r=!1;for(let o of LS(e)){let i=WS(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",NS):null}function Ca(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&OS.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(MS.has(a)||Nd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Nd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function Tr(e){return Ca(e).sources}function LS(e){return Tr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function WS(e,t){Le(t,e);let n=e.includes("system")?ba(e,t):null,r=FS(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ba(e,t){Le(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=ri(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Fd(e,i+1);continue}if(s==="/"&&Gd(e,i)){i=zd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,Pr(e[a-1])||Pr(e[i]))continue;let l=ni(e,i);if(e[l]!=="(")continue;l=ni(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=ri(e,l,c);if(!u){r=!0,o=!0;continue}if(l=ni(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function FS(e,t){Le(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=ri(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=Fd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Gd(e,i)){let f=zd(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ya(e,i,"print")||ya(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=ni(e,m);if(ya(e,d,"getline")){o=!0;let f=HS(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(US(s,a)){o=!0;let f=zS(e,d);if(!f){r=!0,c=m,i=m;continue}if(!GS(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function Pr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function ni(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function GS(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function ri(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=BS(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function zS(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return ri(e,t,n)}function HS(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function BS(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ya(e,t,n){return e.startsWith(n,t)&&!Pr(e[t-1])&&!Pr(e[t+n.length])}function US(e,t){return t!==null&&t>=e}function Fd(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Gd(e,t){let n=$S(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(Pr(e[r-1]))r--;return DS.has(e.slice(r,n+1))}function $S(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function zd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var jS=new Set(["sudo","env","command","builtin"]);function oi(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=VS(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function VS(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&KS(a,r);if(l)i.push(s);if(!l&&ao.has(L(a)))break;if(o)break}return i}function KS(e,t){let n=k(e),r=L(e);return r==="git"||n==="busybox"||tn(e)||ms.has(n)||t.transparentWrappers.includes(n)||ie.has(r)||e==="$SHELL"||Ke(r)||He.has(r)||t.rules.some((o)=>o.command===n)}function tn(e){return jS.has(e.toLowerCase())}function nn(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function et(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return ii([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*ii(e,t,n,r,o,i,s,a,l){let c=Uo(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=Bo(c.envSplitValues,u);if(!f)throw new M("derivedCommandShape");Sa(a),yield*ii(f,t,m,r,o,i,s,a,l);return}if(tn(u[0]??""))throw new M("wrapperPeelIterations");let d=oi(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])Sa(a),yield*ii(f===d.childIndex?d.tokens:[...u.slice(f)],t,m,r,new Map(o),new Map(i),s,a,!0);return}if(YS(u)){Sa(a),yield*ii([...u.slice(1)],t,m,r,o,i,s,a,l);return}yield qS(u,m,r,o,i,l)}function qS(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Sa(e){if(e.iterations>=X.wrapperPeelIterations.cap)throw new M("wrapperPeelIterations");e.iterations++}function YS(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function va(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function tt(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||Ea(r,"recursive")){t=!0;continue}if(r==="-f"||Ea(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Hd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>Ea(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function Ea(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var ZS="find -delete permanently removes files. Use -print first to preview.",XS="find -exec rm -rf is dangerous. Use explicit file list instead.",JS=new Set(["-exec","-execdir","-ok","-okdir"]),QS=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Bd(e,t){let n=e.map(w),r=ev(e,n,t);if(r)return r;if(ai(n,1)&&!nv(e,n,t)){let s=P(b("find.delete",ZS),t.policy);if(s)return s}let o=t.budget??de(),i=0;while(i<n.length){let s=n[i],a=Wt(s??"");if(a>0){i+=a+1;continue}if(!yt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=Ir(n,i);i=l.nextIndex;let c=ov(l.tokens,t.environment);if(c){let f=P(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=m?.id.startsWith("custom.")?m:P(m,t.policy);if(d)return d}return null}function ev(e,t,n){if(!ai(t,1)&&!Ra(t,n.environment))return null;let o=si(e)??J(["."]),i=en({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=Ar(s);for(let l of a.expandedTargets??[w(s)]){let c=Qe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Ue)}}if(tv(t)&&i.resolvedCwd&&hd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return b("find.delete-git-metadata",Ue);return null}function Ra(e,t){let n=0;while(n<e.length){if(!yt(e[n])){n++;continue}let r=Ir(e,n),o=Zt([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function tv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function nv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=si(e);if(!r)return!1;let o=n.envAssignments??new Map,i=da(o,n.environment),s=n.trustedTmpdirValue??Qt(o,n.environment),a=n.allowTmpdirVar??!_r(o,n.environment),l=en({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??Lt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=Ar(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((m)=>Ed(m,l,{containmentTarget:rv(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function rv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function si(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function ov(e,t){let n=Dt([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&tt(n))return b("find.exec-rm-recursive-force",XS);return null}function Ir(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function ai(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(yt(r)){n=Ir(e,n).nextIndex;continue}let o=Wt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function Wt(e){return QS.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function yt(e){return e!==void 0&&JS.has(e)}var dm=require("node:path");function kr(e){let t=qe(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var iv=5,xa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ge(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function $d(e,t,n){let r=li(e,t,n),o=sv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<iv;a++){let{subcommand:l,rest:c}=Fe(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=dv(m);if(d===null||d.length===0)return{blockedReason:xa,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:xa,expanded:!0,tokens:i}}function jd(e,t,n){return li(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Fe(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Oe.has(o)?2:1}return{subcommand:null,rest:[]}}function sv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function li(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=lv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...av(e,t,n)]}}function av(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=_a(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=_a(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Ud(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Ud(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Oe.has(i)){o+=2;continue}o++}return r}function lv(e,t){let n=cv(e,t),r=uv(e,t);return{blockedReason:n===null||r===null?xa:null,entries:[...n??[],...r??[]]}}function cv(e,t){let n=pt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=kr(n);if(!o)return null;for(let i of o){let s=_a(i);if(!s)return null;r.push(s)}return r}function uv(e,t){let n=Ku(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=pt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=pt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function _a(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Ud(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:pt(e.slice(r+1),t,n)}}function dv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return kr(t)}var mv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",fv="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",pv="git checkout --force discards uncommitted changes. Use 'git stash' first.",gv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",hv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",yv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",Cv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",bv="git switch --force discards uncommitted changes. Use 'git stash' first.",Sv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",vv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Ev="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Rv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",xv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",_v="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",wv="git push --force destroys remote history. Use --force-with-lease for safer force push.",Av="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",Pv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Tv="git branch -D force-deletes without merge check. Use -d for safe delete.",Iv="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",kv="git merge --abort discards merge conflict resolutions. Use 'git status' first.",Ov="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Mv="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Dv="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",Nv="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Lv="git worktree remove --force can delete uncommitted changes. Remove --force flag.",Wv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Fv=new Set(["--recurse-submodules","--track","-t"]),wa=new Set(["-b","-B","-U"]),Aa=new Set(["-c","-C"]),Gv=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var Mn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Kd(e,t){let{subcommand:n,rest:r}=Fe(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return Ft(zv(r,t));case"switch":return Ft(Bv(r));case"restore":return Ft($v(r));case"reset":return Vv(r);case"clean":return Ft(qv(r));case"rm":return Ft(Yv(r));case"push":return rn(Zv(r));case"branch":return rn(Qv(r));case"stash":return rn(oE(r));case"worktree":return rn(iE(r));case"rebase":return Ft(eE(r));case"merge":return Ft(tE(r));case"tag":return rn(nE(r));case"reflog":return rn(rE(r));default:return null}}function Ft(e){return e?{...e,localDiscard:!0}:null}function rn(e){return e?{...e,localDiscard:!1}:null}function zv(e,t){let{index:n,before:r}=ge(e),o=Re(r,{shortOptsWithValue:wa});if(r.some((a)=>O(a,"--force"))||o.has("-f"))return b("git.checkout-force",pv);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(O(a,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",hv)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return b("git.checkout-ref-path",gv);return b("git.checkout-double-dash",mv)}let i=Uv(e);if(i.length>=2)return b("git.checkout-ambiguous",yv);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>O(a,"--detach")||O(a,"--track")))return null;if(Hv(s)||t(s))return b("git.checkout-double-dash",fv);return null}function Hv(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function Bv(e){let{before:t}=ge(e);if(t.some((r)=>O(r,"--discard-changes")))return b("git.switch-discard-changes",Cv);let n=Re(t,{shortOptsWithValue:Aa});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return b("git.switch-force",bv);return null}function Uv(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(Wv.has(r)){n+=2;continue}if(Fv.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function $v(e){let t=jv(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",vv):b("git.restore-unstaged",Sv)}function jv(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(Gv.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function Vv(e){let t=null;for(let n of e){if(O(n,"--hard")){t=b("git.reset-hard",Ev);break}if(O(n,"--merge")){t=b("git.reset-merge",Rv);break}}if(!t)return null;return Kv(e)?rn(t):Ft(t)}function Kv(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function qv(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=Re(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return b("git.clean-force",xv);return null}function Yv(e){let t=!1,n=!1,r=!1;for(let o of ge(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=Re([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",_v):null}function Zv(e){let{before:t,after:n}=ge(e),r=Re(t);if(t.some((s)=>O(s,"--mirror")))return b("git.push-mirror",Pv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||Vd(t,n).some(Xv))return b("git.push-force",wv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||Vd(t,n).some(Jv))return b("git.push-delete",Av);return null}function Vd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function Xv(e){return e.startsWith("+")||e.includes(":+")}function Jv(e){return e.length>1&&e.startsWith(":")}function Qv(e){let{before:t}=ge(e),n=Re(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return b("git.branch-force-delete",Tv);return null}function eE(e){let{before:t}=ge(e);return t.some((n)=>O(n,"--abort"))?b("git.rebase-abort",Iv):null}function tE(e){let{before:t}=ge(e);return t.some((n)=>O(n,"--abort"))?b("git.merge-abort",kv):null}function nE(e){let{before:t}=ge(e);return Re(t).has("-d")||t.some((r)=>O(r,"--delete"))?b("git.tag-delete",Ov):null}function rE(e){return e[0]==="delete"?b("git.reflog-delete",Mv):null}function oE(e){for(let t of e){if(t==="drop")return b("git.stash-drop",Dv);if(t==="clear")return b("git.stash-clear",Nv)}return null}function iE(e){let{before:t}=ge(e);if(!t.includes("remove"))return null;let r=Re(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",Lv);return null}var Ct=require("node:path");var Ta="TMPDIR",Ia="IFS",Yd=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Zd=/^[A-Za-z_][A-Za-z0-9_]*$/,Xd=new Set(["export","typeset","declare","readonly"]),sE=new Set(["builtin","command","time"]),Jd=new Set(["do","then","else"]),aE=new Set(["do","then","case"]),qd=new Set(["done","fi","esac"]),lE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Qd(e,t){return e.map((n)=>n.provenance==="variable"&&im(n.text)?Or(n.text,t.shellAssignments):w(n))}function Or(e,t){return e.replace(lE,(n,r,o)=>t.get(r??o??"")??n)}function em(e,t){return{env:e,effectiveEnvAssignments:mE(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function tm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function ka(e,t){let n=rm(e,t),r=e[0]??"";if(aE.has(r))t.bodyDepth+=1;if(r==="elif"||qd.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(qd.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);Oa(t,a)});let o=n.commandIndex;if(o!==-1&&Xd.has(e[o]??""))e.filter((a)=>Zd.test(a)&&Pa(a)).forEach((a)=>{fE(t,a)});let i=o===-1?-1:om(e,o);if(i===-1||e[i]!=="unset")return;let s=gE(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(Jd.has(r)){t.shellAssignments.set(a,"");return}pE(t,a)})}function nm(e,t){let n=rm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function rm(e,t){let n=Jd.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!im(a)),o=r!==-1&&Xd.has(e[om(e,r)]??""),i=dE(t);return{assignments:e.flatMap((a,l)=>{let c=cE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!Go(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function om(e,t){let n=t;while(sE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function im(e){return Be(e)!==null||Yd.test(e)}function cE(e,t,n){return Be(e)??uE(e,t,n)}function uE(e,t,n){let r=zo(e,n,t);if(r)return r;let o=e.match(Yd)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Pa(e){return e===Ta||e===Ia||ra(e)}function dE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function mE(e,t){let n=[Ta,Ia].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Oa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function fE(e,t){Oa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function pE(e,t){if(!Pa(t)&&!Zd.test(t))return;if(e.shellAssignments.set(t,""),Go(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Pa(t)||t===Ta||t===Ia||Xn(t)){Oa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function gE(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var am=require("node:path");function ci(e,t){return na.some((n)=>t?.has(n)||e.has(n))}function Dn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(am.resolve(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=sm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=sm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Oe.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function sm(e,t,n){try{let r=Mt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function lm(e,t,n){if(!t.localDiscard||!n.worktreeMode||ci(n.environment.env,n.envAssignments))return null;let r=Dn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Ma(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Ma(e,t,n){let{subcommand:r,rest:o}=Fe(e),i=r?.toLowerCase();if(t.dynamicArguments||hE(o)||vE(e,t.environment.env,t.envAssignments,n)||bE(o)||yE(i,o))return!0;return i==="clean"&&SE(o)>1}function hE(e){return e.some((t)=>/[$*?[]/.test(t))}function yE(e,t){if(e==="checkout"){let{before:n}=ge(t),r=Re(n,{shortOptsWithValue:wa}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ge(t),r=Re(n,{shortOptsWithValue:Aa}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||CE(s))||r.has("-C");return o&&i}return!1}function CE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function bE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function SE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function vE(e,t,n,r){if(pt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=li(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>RE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||EE(s.value);if(Yu(n))return!0;return r.recursiveSubmodules}function EE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function RE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function cm(e,t,n){let r=e.map(w),o=n.environment.paths,i=Dn(r,n.cwd,o),s=n.originalCwd?o.realpath(Ct.resolve(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||ci(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?_E(e,n.shellAssignments,o):um(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!xE(a,r,t,n)||!kn(a,n.environment)||Qo(a,n.environment)||ei(s,a)||ei(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function xE(e,t,n,r){let o=r.environment.paths,i=Ct.join(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!Ma(t,r,s)}function _E(e,t,n){let r=Fe(e.map(w)).rest,{before:o,after:i}=ge(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?Or(a,t??new Map):a;if(!Ct.isAbsolute(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function um(e,t){if(t.entryKind(Ct.join(e,".git"))!=="missing")return e;let n=Ct.dirname(e);return n===e?null:um(n,t)}var wE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",AE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function ui(e,t){return mm(e,t)}function mm(e,t,n){let r=e.map(w),o=$d(r,t.environment.env,t.envAssignments),i=o.blockedReason?P(b("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((qu(t.envAssignments)||jd(r,t.environment.env,t.envAssignments))&&PE(s))return b("git.ssh-env",wE);let a=Kd(s,(c)=>{let u=Dn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(dm.resolve(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=lm(r,a,t)??cm(e,a,t);if(!l)return a;return n?.(l),null}function fm(e,t){let n=null;return{match:mm(e,t,(o)=>{n=o}),relaxation:n}}function PE(e){let{subcommand:t,rest:n}=Fe(e),r=t?.toLowerCase();if(!r)return!1;if(AE.has(r))return!0;if(r==="archive")return ge(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&TE(n)}function TE(e){return e.find((t)=>!IE(t))?.toLowerCase()==="update"}function IE(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}var Hm=require("node:path");function pm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function di(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var gm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",kE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",OE="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",ym="rm -rf targeting root or home directory is extremely dangerous and always blocked.",ME="rm -rf in home directory is dangerous. Change to a project directory first.",hm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:ym},git_metadata_target:{id:"rm.git-metadata",reason:Ue},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:OE},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:ME},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:gm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:kE},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:gm}};function mi(e,t){let n=en({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=tt(r),i=Hd(r),s=NE(e);for(let a of s){let l=Ar(a.word);if(o&&l.unsafeBraceExpansion){let c=P(wr({kind:"outside_anchored_cwd"},n,t.policy,hm),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=ke(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Jt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return b("rm.git-metadata",Ue);if(i&&!o){let d=Qe(u,n,m);if(d.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",ym);if(d.kind==="git_metadata_target")return b("rm.git-metadata",Ue);continue}if(!o)continue;for(let d of DE(u,n,m)){let f=wr(d,n,t.policy,hm),p=P(f,t.policy);if(p)return p}}}return null}function DE(e,t,n){let r=Qe(e,t,n);if(r.kind==="cwd_self_target")return[r,Qe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Qe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Qe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function NE(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Gt={kind:"none"},on={kind:"dynamic"},LE=new Set(["<","<<","<<-","<<<","<&","<>"]),bm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,WE=/^(?:[0-9]+|[@*])$/,FE=kt.maxWords,GE=kt.maxInputLength;function Sm(e){if(!e||k(L(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function ai(e){let t=Pr(e[1])==="--"?2:1;if(e.length<=t)return Ft;let n=e.slice(t);if(!n.every(ci))return rn;return{kind:"literal",source:n.map(w).join(" ")}}function nm(e){let t=Pr(e[1])==="--"?2:1,n=e[t],r=Pr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ft;if(!ci(n))return rn;return{kind:"literal",source:r}}function li(e,t){let n=CE(e);if(n===-1)return Ft;let r=bE(t);if(!r)return Ft;let o=[],i=r.command?.length??0;for(let s of r.references){let a=vE(s,e,n,r.ifs);if(!a)return rn;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>gE||i>hE)return rn;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(RE)].filter((s)=>s!==null).join(" ")}}function rm(e,t,n,r){if(!Me(e.map(w)).readsStdinAsCommands)return Ft;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&fE.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ft;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return rn;return{kind:"literal",source:o.target.text}}if(!n)return Ft;return r===void 0?rn:{kind:"literal",source:r}}function Ct(e){let t=Me(e.map(w)).scriptIndex;if(t===null)return Ft;let n=e[t],r=Pr(n);return Io(n,r)?{kind:"literal",source:r}:rn}var yE=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function _a(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||He(s)!==null)return!1;let a=k(L(s));return!yE.has(a)&&!ie.has(a)&&!en(a)}function CE(e){return Me(e.map(w)).commandIndex??-1}function bE(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(SE);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function SE(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function vE(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ea(o):EE(o,r);if(e.parameter==="*"){let a=Ea(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Ra(l,r)}let i=t[n+1+e.parameter];if(i&&!ci(i))return;let s=Pr(i);return e.quoted?[s]:Ra(s,r)}function Ea(e){return e.every(ci)?e.map(w):void 0}function EE(e,t){let n=Ea(e);if(!n)return;let r=n.map((o)=>Ra(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ra(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function fi(e){let t=Mr(e[1])==="--"?2:1;if(e.length<=t)return Gt;let n=e.slice(t);if(!n.every(gi))return on;return{kind:"literal",source:n.map(w).join(" ")}}function vm(e){let t=Mr(e[1])==="--"?2:1,n=e[t],r=Mr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Gt;if(!gi(n))return on;return{kind:"literal",source:r}}function pi(e,t){let n=HE(e);if(n===-1)return Gt;let r=BE(t);if(!r)return Gt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=$E(s,e,n,r.ifs);if(!a)return on;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>FE||i>GE)return on;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(VE)].filter((s)=>s!==null).join(" ")}}function Em(e,t,n,r){if(!Me(e.map(w)).readsStdinAsCommands)return Gt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&LE.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Gt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return on;return{kind:"literal",source:o.target.text}}if(!n)return Gt;return r===void 0?on:{kind:"literal",source:r}}function bt(e){let t=Me(e.map(w)).scriptIndex;if(t===null)return Gt;let n=e[t],r=Mr(n);return Mo(n,r)?{kind:"literal",source:r}:on}var zE=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Wa(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Be(s)!==null)return!1;let a=k(L(s));return!zE.has(a)&&!ie.has(a)&&!tn(a)}function HE(e){return Me(e.map(w)).commandIndex??-1}function BE(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(UE);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function UE(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function $E(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Da(o):jE(o,r);if(e.parameter==="*"){let a=Da(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Na(l,r)}let i=t[n+1+e.parameter];if(i&&!gi(i))return;let s=Mr(i);return e.quoted?[s]:Na(s,r)}function Da(e){return e.every(gi)?e.map(w):void 0}function jE(e,t){let n=Da(e);if(!n)return;let r=n.map((o)=>Na(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Na(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function ci(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function Pr(e){return e?w(e):""}function RE(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function wa(e,t){return xa(Ke(e,"posix"),t)}function Ir(e){return wa(e,new Set(Array.from(e.matchAll(em)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function xa(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(xa(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>xa(o,n))||om(r.words,n))return!0;PE(r,n)}return!1}function om(e,t){let n=e.findIndex((s)=>He(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Tr(r,t))return!0;let o=L(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Qd(e[s],t)}if(ie.has(o)){let s=e.slice(n),a=Me(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Qd(s[l],t)}let i=xE(e,n,t);if(i===null)return!1;if(i===-1)return!0;return om(e.slice(i),t)}function xE(e,t,n){let r=L(e[t]?.text??"");if(r==="command")return _E(e,t+1);if(r==="exec")return wE(e,t+1);if(r==="env")return AE(e,t+1,n);return null}function _E(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function wE(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function AE(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Tr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Tr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(He(i))continue;return r}return null}function PE(e,t){if(!e.words.every((n)=>He(n.text)!==null))return;for(let n of e.words){let r=He(n.text);if(!r)continue;if(Tr(n,t))t.add(r.name)}}function Tr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(em)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(pE.test(o)||t.has(o))}))}function Qd(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Tr(e,t))}var TE=["--init-file","--rcfile"],IE=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function bt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return im(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=im(e,t,!1);if(r!==null)return r}}return null}function St(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Me(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function im(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function sm(e){let t=k(e[0]??"").toLowerCase(),n=kE(e,t),r=IE.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function kE(e,t){let n=Me(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?TE.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&os.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=is(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var Aa="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Pa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",OE="__CC_SAFETY_NET_XARGS_INPUT__",ui="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",di="rm",ME=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,DE=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,NE=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,LE=/^(?:[0-9]+|[@*])$/;function cm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=on(n),i=n.slice(r),s=S("xargs.shell-dynamic",Pa);if(FE(i,o,t)&&P(s,t.policy))return P(s,t.policy);for(let a of Qe(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?P(s,t.policy):null;if(c)return c;let d=pm(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&mm(l,o),u=t.analyzeChild(l,{...tn(a,t),dynamicInput:d,dynamicSourceInput:m||dm(l,a.head,o,a.wrapperEnvAssignments,d,t.environment),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:S("xargs.rm-recursive-force-dynamic",Aa)});if(u)return u;let f=WE(l,o,t.policy?.rules??[],P(s,t.policy));if(f)return f;if(a.head==="git"){let g=o===null?[...l,OE]:l,h=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(g,{...tn(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=ht(l,t.policy?.rules??[]);if(p)return p}return null}function WE(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=ht([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=L(e[0]??"");if(!n.some((i)=>L(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function um(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Yd(e,r,t.length,n);return o===null?[]:[o]}function dm(e,t,n,r,o,i){if(ie.has(t)){if(St(e))return!1;if(n!==null&&GE(e,n))return!0;let s=bt(e);if(!s){let a=Ct(X(e));if(a.kind==="literal")return n!==null&&a.source.includes(n);return a.kind==="none"&&o}if(n!==null&&s.includes(n))return!0;if(ft(s))return!0;return zE(s,n,r)}if(Ve(t))return am(e,n,No,Wu(t));if(ze.has(t))return am(e,n,ma,Id);if(t==="eval"){let s=ai(X(e));if(s.kind==="dynamic")return!0;if(n!==null)return s.kind==="literal"&&s.source.includes(n);return o}if(t==="find")return HE(e,n,i);if(t==="git"){let s=tt(e);return n===null?s.subcommand===null:(s.subcommand?.includes(n)??!1)||s.subcommand!==null&&kn.has(s.subcommand.toLowerCase())&&fm(s.rest,n).some((a)=>a.includes(n))}return!1}function am(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,ui]).sources.some((a)=>a.value===ui);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${ui}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${ui}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>um(l,t,a))));return ii(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function FE(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Qe(e,n),(i)=>i.head)),o=t===null?[...e,di]:e.map((i,s)=>s===0?i:i.replaceAll(t,di));return Array.from(Qe(o,n)).some((i)=>i.head===di&&!r.has(di))}function mm(e,t){return fm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function fm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function pm(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function GE(e,t){let n=Me(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return um(i,t,o).some((l)=>{let c=e.map((m,u)=>u===s?m.replaceAll(t,l):m),d=Me(c);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(n.commandIndex===null&&d.commandIndex!==null)return!0;if(n.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(c[d.commandIndex]??"").includes(l))return!0;return d.scriptIndex!==null&&(c[d.scriptIndex]??"").includes(l)})}))}function zE(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(ME))if(lm(o,r))return!0;for(let o of e.matchAll(DE))for(let i of(o[1]??"").matchAll(NE))if(lm(i,r))return!0;return wa(e,r)}function lm(e,t){let n=e[1]??e[2];return n!==void 0&&(LE.test(n)||t.has(n))}function HE(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(yt(s)){let l=wr(e,i);i=l.nextIndex-1;for(let c of Qe(l.tokens,{environment:n,cwd:void 0})){let d=pm(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&mm(c.tokens,t)||dm(c.tokens,c.head,t,c.wrapperEnvAssignments,d,n))return!0}continue}let a=Lt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function on(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var kr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Or="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",BE="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",UE="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",fi=/\{[^{}\s]*\}/g,gm=/\{\}|\{-?\d+\}/g,$E=["e","f","source","file","-e","-f","--source","--file"],jE=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],VE=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),KE=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),hm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),qE=new Set(["--workdir","--wd"]),ym="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ue(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Rm(e){return Ue([...e],(t)=>ft(t))}function xm(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=On(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Mm(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:m}=o;if(c){let p=On(t);if(p)return p;let g=Rm(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=eR(t);if(p)return p}if(d!==void 0&&a){let p=On(t);if(p)return p}let u=tR(d,t.cwd,t.environment.paths);if(u===null){let p=On(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(m){if([...Qe(i,f)].flatMap((g)=>[...g.envAssignments.values()]).some(ka)){let g=On(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=Pm(f.envAssignments,f.cwd,a);return Ue(p,(h)=>t.analyzeNested(h,g))}return Ue(Qe(i,f),(p)=>YE(p,o,t,f))}function YE(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(km)){let h=On(n);if(h)return h}let d=Rm(c);if(d)return d;let m=c.some(B),u=i||m,f=a&&u,p=Pm(e.envAssignments,e.wrapperCwd,s||f);if(ie.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ue(o,(E)=>n.analyzeChild(mi(l,E,n.budget),tn(e,r)))};if(St(l))return h();let y=bt(l);if(y){if(Om(y)){let R=Gt(n);if(R)return R;if(o.length===0)return null;return Ue(o,(A)=>n.analyzeNested(Sm(y,A,n.budget),p))}if(B(y)){if(o.length>0)return Ue(o,(J)=>n.analyzeNested(Sm(y,J,n.budget),p));let R=Ar(y);if(R?.[0]&&L(R[0])==="rm"&&et(R)){let J=bm(n);if(J)return J}let A=R?n.analyzeChild(R,{...tn(e,r),dynamicInput:a,shellDynamicMatch:S("parallel.shell-dynamic",Or),rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",kr)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((R)=>li(X(R===void 0?l:i?l.map((A)=>Tm(A,R)):[...l,...R]),y)):[];if(E.some((R)=>R.kind==="dynamic")){let R=Gt(n);if(R)return R}let b=E.flatMap((R)=>R.kind==="literal"?[R.source]:[]);if(b.length>0)return n.budget.charge("derivedTokens",b.length),Ue(b,(R)=>n.analyzeNested(R,p));if(Ir(y)){let R=Gt(n);if(R)return R}let T=n.analyzeNested(y,p);if(T)return T;if(u)return Gt(n);return null}let v=Ct(X(l));if(v.kind==="dynamic"||v.kind==="literal"&&B(v.source))return Gt(n)??h();if(v.kind==="literal")return h();if(o.length>0){let E=Gt(n);if(E)return E;let b=h();if(b)return b;if(i)return null;let T=o.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return n.budget.charge("derivedTokens",T.length),Ue(T,(R)=>n.analyzeNested(R,p))}if(u||a)return Gt(n)??h();return null}if(e.head==="rm"&&et(l)){if(i&&o.length>0)return Ue(o,(y)=>Ta(mi(l,y,n.budget,gm),e.cwd,r));if(o.length>0)return Ue(o,(y)=>Ta(vm(l,y,n.budget),e.cwd,r));let h=Ta(l.flatMap((y,v)=>{if(v===0||!B(y))return[y];return y.startsWith("-")?[y.replace(gm,"")]:[]}),e.cwd,r);if(h)return h;return bm(n)}let g=o.length>0?o:[void 0];return Ue(g,(h)=>{let y=h===void 0?l:i?mi(l,h,n.budget):vm(l,h,n.budget),v=S("parallel.shell-dynamic",Or),E=a&&e.head==="find"?QE(y,r):null,b=wm(y,a,n)??E?.customResult??null,T=L(e.head),R=a&&(T==="rm"&&Ia(y)||T==="xargs"&&Am(y)||E?.rmOptions===!0),A=a&&(R||E?.executedSource===!0||E===null&&_m(y,T)),J=n.analyzeChild(y,{...tn(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:R,dynamicSourceInput:b!==null||A,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",kr)});if(A){let re=P(v,n.policy);if(re)return re}return J??b??ht(y,n.policy?.rules??[])})}function _m(e,t){if(B(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(ie.has(t))return JE(e);if(t==="git")return ZE(e);if(t==="find")return!0;if(ze.has(t))return Cm(e,$E,_r);if(Ve(t))return Cm(e,jE,Do);return!1}function Ia(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(B))return t===-1;return n.some((o)=>B(o)&&(o.startsWith("-")||Om(o)))}function ZE(e){if(XE(e))return!0;let t=tt(e);if(t.subcommand===null||B(t.subcommand))return!0;if(!kn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(B))return n===-1;return r.some(B)}function XE(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(B(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(B(n))return!0;continue}if(B(n))return!0}return!1}function JE(e){if(St(e))return!1;let t=bt(e);if(t!==null)return B(t);let n=Ct(X(e));if(n.kind==="literal")return B(n.source);if(n.kind==="dynamic")return!0;return!e.some(B)}function Cm(e,t,n){let r=n(e);if(r.some((o)=>B(o.value)))return!0;if(!e.some(B))return n([...e,ym]).some((o)=>o.value===ym);return ii(r,t,(o)=>n(e.map((i)=>Tm(i,[o]))))}function wm(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>L(i.command)===L(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(B))return Gt(n);return Ue(o,(i)=>ht([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function QE(e,t){let n={customResult:null,executedSource:!e.some(B),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(B))return;for(let a of Qe(i,t))n.executedSource||=_m(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ia(a.tokens)||a.head==="xargs"&&Am(a.tokens),n.customResult??=wm(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=B(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(yt(a)){i=[],n.executedSource||=B(a);continue}let l=Lt(a);if(l>0){o=l,n.executedSource||=B(a);continue}n.executedSource||=B(a)}return s(),n}function Am(e){let t=e.slice(on(e).childStart);return L(t[0]??"")==="rm"&&Ia(t)}function pi(e,t){return(n)=>P(S(e,t),n.policy)}var Gt=pi("parallel.shell-dynamic",Or),eR=pi("parallel.command-stream-dynamic",BE),On=pi("parallel.command-stream-dynamic",UE),bm=pi("parallel.rm-recursive-force-dynamic",kr);function Ta(e,t,n){return P(si(X(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Nt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Jt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Pm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Tm(e,t){return e.replace(fi,(n)=>Im(n,t))}function mi(e,t,n,r=fi){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Im(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Sm(e,t,n){return mi([e],t,n)[0]??""}function vm(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Im(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function B(e){return e.search(fi)!==-1}function km(e){if(ka(e))return!0;for(let t of e.matchAll(fi))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function ka(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Om(e){return/^\{[^{}\s]*\}$/.test(e)}function tR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Em.isAbsolute(e))return null;try{return Ot(t??e,e,n)}catch{return null}}function Mm(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ga(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ga(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let g=e[t+1],h=p.indexOf("="),y=h===-1?p:p.slice(0,h),v=h===-1?void 0:p.slice(h+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||KE.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(hm.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=hm.has(p)?2:1;continue}if(qE.has(y)){c=!0;let E=v??g;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(VE.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?ka:km);let d=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let h=e[g];if(h===":::"){d.push(p),p=[];continue}if(h!==void 0)p.push(h)}d.push(p)}c||=d.length>1;let m=nR(d),u=n.some(B),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function nR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>Z.derivedTokens.cap)throw new O("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>Z.derivedTokens.cap)throw new O("derivedTokens");o.push([...i,s])}t=o}return t}function Dm(e){return Mm(e).childStart}var rR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",gi="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ma(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Oa(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Lm(e,t,n,r,o=!1,i){let a=(nr(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&fe(i,"shell.dynamic-executable",o)?S("shell.dynamic-executable",rR):null;return P(a,i)??Wm(e,t,n,o,i)}function Wm(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ma(a)?[l]:[]);if(i.length===0)return null;let s=L(t[0]?.text??"");if(s==="git"){let a=Rn(e,t),l=iR(a);if(fe(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return P(S("shell.dynamic-structure",gi),o);if(P(oi(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((m,u)=>u>l&&w(m)==="--");if(fe(o,"shell.dynamic-structure",r)&&c&&kn.has(c)&&i.some((m)=>m>l&&(d===-1||m<d)))return P(S("shell.dynamic-structure",gi),o);return null}if(s==="find")return fe(o,"shell.dynamic-structure",r)&&sR(t)?P(S("shell.dynamic-structure",gi),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&w(c)==="--"),l=et(t.map(w));return fe(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?P(S("shell.dynamic-structure",gi),o):null}if(s==="xargs")return Nm(e,t.slice(on(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return Nm(e,t.slice(Dm(t.map(w))),"parallel",n,r,o);return null}function Nm(e,t,n,r,o,i){if(t.length===0)return null;let s=oR(t,r);if(nr(e,s)){let l=P(S(`${n}.shell-dynamic`,n==="xargs"?Pa:Or),i);if(l)return l}let a=Wm(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ma(l)&&Oa(l)))return P(S(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Aa:kr),i);return null}function oR(e,t){let n=qt(e,t),r=n.rewritten?X(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function iR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(Oe.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function sR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ma(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Oa(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Oa(s)))return!0;continue}if(t=!0,a)return!0;let l=Lt(s.text);if(l>0){n=l;continue}if(yt(s.text))o=!0,r=!0}return!1}function Da(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!Io(t[n.tokenIndex],n.value)})}var aR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",lR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",cR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Fm(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return S("dd.device-write",aR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return S("mkfs.device",lR);if(e==="shred"&&n.length>0)return S("shred.target",cR);return null}var zm=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>si(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Nt(e.envAssignments,e.options.environment),trustedTmpdirValue:Jt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>oi(e.words,Na(e))},{heads:new Set(["find"]),analyze:(e)=>Ld(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Nt(e.envAssignments,e.options.environment),trustedTmpdirValue:Jt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>sn(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>cm(e.words,{...Gm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>sn(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>xm(e.words,{...Gm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>sn(e.options.analyzeNested(t,n))})}];function Gm(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function sn(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Na(e){return{environment:e.options.environment,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var $m="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function jm(e){return zm.find((t)=>t.heads.has(e))?.analyze}function Dn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,u=Fo(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let f=qt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let x=[...p,...i(f.words)].join(" "),I=ft(x);if(I)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:I.reason}),ve(I);if(n.strict)return Pe(r);let G=Go(p,i(f.words));if(G){n.budget.charge("derivedTokens",G.length);let ue=n.analyzeNested(G.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments])});if(ue)return ue}}let g=f.rewritten?X(i(f.words)):Rn(o,f.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>g.length){let x=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-g.length),output:h})}let v=new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments]),E=h[0];if(!E)return null;if(en(E))throw new O("wrapperPeelIterations");let b=L(E),T=f.cwd===null?void 0:f.cwd??d,R=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,J=s?s.allowTmpdirVar:!vr(v,n.environment),re=Lm(o,f.words,n.environment,t===0,n.strict,n.policy);if(re)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:re.reason}),ve(re);let ce=Qo(h,n.policy);if(ce){for(let x of[ce.childIndex,...ce.alternativeChildIndices]){Hm(y.wrapperNormalizationBudget);let I=g.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:ce.wrapper,output:i(I)});let G=Dn(I,t,{...y,effectiveCwd:A,envAssignments:v});if(G)return G}return null}let oe=l?void 0:b==="eval"?ai(g):b==="trap"&&!a?nm(g):void 0;if(a&&s&&b==="eval"){if(oe?.kind==="dynamic")return Mn(s,n.policy);if(oe?.kind==="literal"){let x=n.analyzeNested(oe.source,{effectiveCwd:A,envAssignments:v});if(x)return x}return Nn(s,n.policy)}if(oe?.kind==="dynamic"&&(n.strict||!n.commandView||!_a(n.commandView)))return Pe(r);if(oe?.kind==="literal"){r?.recordSegment({type:"recurse",reason:b==="eval"?"shell-eval":"shell-trap",innerCommand:oe.source,depth:t+1});let x=n.analyzeNested(oe.source,{effectiveCwd:A,envAssignments:v,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?ie.has(b):Km(E,b)){if(St(h))return null;if(a&&s){let x=bt(h);if(x){if(s.dynamicSourceInput??s.dynamicInput){let G=Mn(s,n.policy);if(G)return G}if(Ir(x)){let G=Mn(s,n.policy);if(G)return G}return n.analyzeNested(x,{effectiveCwd:A,envAssignments:v})}let I=Ct(g);if(I.kind==="dynamic")return Mn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?Mn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?Mn(s,n.policy):null}if(l){let x=bt(h),I=x?n.analyzeNested(x,{effectiveCwd:A,envAssignments:v}):Ct(g).kind==="dynamic"?Pe(r):null;if(I)return I}if(s===void 0){let x=fR(h,v,A,n,r,t);if(x)return x;let I=bt(h);if(I){let mn=li(g,I);if(mn.kind==="dynamic")return Pe(r);let Oi=mn.kind==="literal"?mn.source:I,ml=pR(Oi);r?.recordSegment({type:"shell-wrapper",wrapper:b,innerCommand:ml}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:ml,depth:t+1});let fl=n.analyzeNested(Oi,{effectiveCwd:A,envAssignments:v});if(fl)return fl;return Ir(Oi)?Pe(r):null}let G=Ct(g);if(G.kind==="dynamic")return Pe(r);if(G.kind==="literal")return hi(G.source,A,v,n,r,t);let ue=rm(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(ue.kind==="dynamic")return Pe(r);if(ue.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:ue.source,depth:t+1}),n.analyzeNested(ue.source,{effectiveCwd:A,envAssignments:v})}}if(!s&&(b==="source"||b===".")){let x=h[1]==="-p"?2:null;if(x!==null){let mn=n.commandView?g[x]:void 0;if(!mn)return null;if(mn.provenance!=="literal")return Pe(r)}let I=x===null?1:3,G=h[I]==="--"?I+1:I,ue=n.commandView?g[G]:void 0;if(!ue)return null;if(ue.provenance==="literal")return hi(ue.text,A,v,n,r,t);if(n.strict||!n.commandView||!_a(n.commandView))return Pe(r)}if(ze.has(b)&&!l){if(!s&&n.strict&&Da(_r(h),g))return Pe(r);let x=kd(h,(G)=>sn(n.analyzeNested(G,{effectiveCwd:A,envAssignments:v}))),I=P(x,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),ve(I)}if(Ve(b)&&!l){if(!s&&n.strict&&Da(Do(h),g))return Pe(r);let x=Lu(h);if(a&&s)return dR(b,x,A,v,n,s);if(x){let I=fe(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:b,codeArg:x,paranoidBlocked:I}),I){let ue=P(S("interpreter.one-liner-paranoid",dr),n.policy);if(ue)return ve(ue)}if(qs(b,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let G=n.analyzeNested(x,{effectiveCwd:A,envAssignments:v});if(G&&!Vm(G,x))return G;if(mr(x)){let ue=P(S("interpreter.dangerous-command",wn),n.policy);if(ue)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:wn}),ve(ue)}r=void 0}}if(b==="busybox"&&h.length>1)return Hm(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),Dn(g.slice(1),t,{...y,effectiveCwd:A,envAssignments:v});let F=s?null:P(Fm(b,h),n.policy);if(F)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:F.reason}),ve(F);let Ce=r===y.trace?y:{...y,trace:r},Ge={words:g,head:b,cwd:T,originalCwd:R,envAssignments:v,allowTmpdirVar:J,dynamicArguments:f.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:Ce,analyzeChildTokens:(x,I)=>a&&s?La(x,t,Ce,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):sn(Dn(X(x),t+1,{...Ce,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:v}))??ht(x,Ce.policy.rules),analyzeChild:(x,I)=>La(x,t,Ce,I)},lt=s&&(b==="xargs"||b==="parallel")?void 0:jm(b);if(b==="rm"||b==="xargs"||b==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:J});let $e=r&&b==="git"?qd(Ge.words,Na(Ge)):void 0,Ii=Bm($e?$e.match:lt?.(Ge)??null,n.policy);if(r)gR(Ge,Ii,$e?.relaxation??null);if(Ii)return ve(Ii);if(a&&s&&(b==="rm"||b==="rmdir")){if(!(b==="rm"&&(et(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Nn(s,n.policy):null)??mR(s,n.policy)}let ul=lt!==void 0,dl=!s&&!ul&&!oo.has(b),ki=r&&dl?[]:void 0;if(dl)for(let x=1;x<h.length;x++){let I=h[x];if(!I)continue;ki?.push(I);let G=Bm(uR(h,x,t,Ce,T,R,A,v),n.policy);if(G)return r?.recordSegment({type:"fallback-scan",tokensScanned:ki??[],embeddedCommandFound:L(I)}),ve(G)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:ki??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&ul)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let Br=ht(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Br,reason:Br?.reason}),Br)return ve(Br);return a&&s?Nn(s,n.policy):null}function La(e,t,n,r){return sn(Dn(X(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function uR(e,t,n,r,o,i,s,a){for(let l of Qe(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=L(c);if(Km(c,d)||jm(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=La(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!vr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function dR(e,t,n,r,o,i){if(!t)return Nn(i,o.policy);if(fe(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=P(S("interpreter.one-liner-paranoid",dr),o.policy);if(a)return ve(a)}if(qs(e,t))return Nn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!Vm(s,t))return s;if(mr(t)){let a=P(S("interpreter.dangerous-command",wn),o.policy);if(a)return ve(a)}return Nn(i,o.policy)}function Vm(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Zo)||e.reason===In)&&!io(t)}function Mn(e,t){let n=e.shellDynamicMatch?P(e.shellDynamicMatch,t):null;return n?ve(n):null}function Nn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?P(e.dynamicSourceMatch,t):null;return n?ve(n):null}function mR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?P(e.rmDynamicMatch,t):null;return n?ve(n):null}function fR(e,t,n,r,o,i){let s=sm(e);if(s.argvSource?.kind==="absent")return Pe(o);if(s.argvSourceApplies&&s.argvSource){let l=hi(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return hi(a,n,t,r,o,i,!0)}function hi(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return Pe(o);let a=ur(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?Pe(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function pR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function gR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function Hm(e){if(e.iterations>=Z.wrapperPeelIterations.cap)throw new O("wrapperPeelIterations");e.iterations++}function ve(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function Pe(e){return e?.recordSegment({type:"error",message:$m}),ve(hR())}function hR(){return{id:"",reason:$m,intent:"stop_and_explain"}}function Km(e,t){return ie.has(t)||e==="$SHELL"||e==="${SHELL}"||ie.has(k(t))}function Bm(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:P(e,t)}var yR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,CR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function bR(e,t){let n=Zm(e,t);if(n.length===0)return!1;let r=n[Ym(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return yR.test(e.join(" "))}function qm(e,t,n,r){if(e.dialect==="powershell"){let a=SR(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return Um(xR(a.target),t,n.paths)}let o=e.words.map(w);if(!bR(o,n))return;if(!t)return null;let i=Zm(o,n,t),s=Ym(i);if(s===-1||i[s]!=="cd")return null;return Um(i[s+1],t,n.paths)}function Um(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return _R(Ot(t,e,n),t,n)?t:null}catch{return null}}function SR(e,t){let n=vR(e[0])?1:0,r=e[n];if(!ER(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!CR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return RR(e.slice(n+1),t)}function vR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function ER(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function RR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function xR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Ym(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Zm(e,t,n){let r=wR(e);return Mt([...r],t,n)}function _R(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return Mr.normalize(e)===Mr.normalize(t);return Mr.normalize(r)===Mr.normalize(o)}function wR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var Fa="TMPDIR",Ga="IFS",Xm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Jm=/^[A-Za-z_][A-Za-z0-9_]*$/,Qm=new Set(["export","typeset","declare","readonly"]),AR=new Set(["builtin","command","time"]);function ef(e,t){return{env:e,effectiveEnvAssignments:OR(e,t),shellAssignments:new Map}}function tf(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function za(e,t){let n=rf(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),Ha(t,s)});let r=n.commandIndex;if(r!==-1&&Qm.has(e[r]??""))e.filter((s)=>Jm.test(s)&&Wa(s)).forEach((s)=>{MR(t,s)});let o=r===-1?-1:of(e,r);if(o===-1||e[o]!=="unset")return;let i=NR(e,o);if(i===null)return;e.slice(i).forEach((s)=>{DR(t,s)})}function nf(e,t){let n=rf(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function rf(e,t){let n=e.findIndex((s)=>!PR(s)),r=n!==-1&&Qm.has(e[of(e,n)]??""),o=kR(t);return{assignments:e.flatMap((s,a)=>{let l=TR(s,o,t.env);if(!l)return[];if(n!==-1&&a>n&&!r&&!Lo(l.name))return[];return o.set(l.name,l.value),[{...l,persists:n===-1||r}]}),commandIndex:n}}function of(e,t){let n=t;while(AR.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function PR(e){return He(e)!==null||Xm.test(e)}function TR(e,t,n){return He(e)??IR(e,t,n)}function IR(e,t,n){let r=Wo(e,n,t);if(r)return r;let o=e.match(Xm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Wa(e){return e===Fa||e===Ga||Xs(e)}function kR(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function OR(e,t){let n=[Fa,Ga].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Ha(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function MR(e,t){Ha(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function DR(e,t){if(!Wa(t)&&!Jm.test(t))return;if(e.shellAssignments.set(t,""),Lo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Wa(t)||t===Fa||t===Ga||Kn(t)){Ha(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function NR(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var LR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",an="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Va(e,t,n,r){if(t>=Z.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:rt}),{reason:rt,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Ke(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:rt}),{reason:rt,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return ja(e,n);let d=`${Zo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,intent:"stop_and_explain"}}return df(e,n),{reason:In,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return df(e,n),{reason:In,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return ja(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=ef(n.environment.env,n.envAssignments);return bi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function bi(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let d=e.nodes[l+1],m=d?.kind==="connector"?d.operator:void 0,u=WR(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,g=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,h=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=f||Wn(m);if(c.kind==="function"){let re=g.flatMap((oe)=>{let K=Dr(oe);return K.functionDefinitions.set(c.name,c.body),Ba(oe,[K],u,m==="&",Wn(m))}),ce=Ua(re,[],h,y,a,m);i=ce.states,s=ce.conditionalStates,a=void 0;continue}if(c.kind==="group"){let re=[],ce=[];for(let K of g){let F=bi(c.body,t,n,r,[Dr(K)]);if(F.result)return F;if(re.push(...Ba(K,F.states,u,m==="&",Wn(m))),v)ce.push(K,...u?F.states.map((Ce)=>yi(K,Ce)):F.states)}let oe=Ua(re,ce,h,y,a,m);i=oe.states,s=oe.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),b=e.nodes[l-2],T=Si(a)&&b?.kind==="command"?tm(b)??GR(b):void 0,R=[],A=[];for(let re of g){let ce=zR(c,t,n,r,[Dr(re)]);if(ce.result)return{result:ce.result,states:i};let oe=e.dialect==="powershell"?ce.states:ce.states.map((K)=>yi(re,K));for(let K of oe){let F=Dr(K),Ce=UR(c,t,n.trace?{...n,trace:mf(n.trace,E)}:n,r,F,Si(a),T);if(Ce)return{result:Ce,states:i};let Ge=nx(c,F.functionDefinitions);if(Ge)n.budget.charge("derivedTokens",vi(Ge));let lt=Ge?t+1>=Z.recursionDepth.cap?$a(c.displayText,n,[F]):bi(Ge,t+1,n,r,[F]):{result:null,states:[F]};if(lt.result)return lt;if(R.push(...Ba(re,lt.states,u,m==="&",Wn(m))),v)A.push(re),A.push(...lt.states.map(($e)=>u?yi(re,$e):$e))}}let J=Ua(R,A,h,y,a,m);i=J.states,s=J.conditionalStates,a=void 0}return{result:null,states:i}}function WR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(Si(r)||Si(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&FR(e,t)}function Ba(e,t,n,r,o){let i=n?t.map((a)=>yi(e,a)):[...t],s=o?i.flatMap((a)=>Ln(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function yi(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function FR(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(HR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Si(e){return e==="|"||e==="|&"}function GR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Wn(e){return e==="&&"||e==="||"}function Ua(e,t,n,r,o,i){let s={success:Ci([...n,...e]),failure:Ci([...r,...t])},a=Wn(i)?s:void 0;return{states:Wn(o)||a?Ci([...s.success,...s.failure]):s.success,conditionalStates:a}}function mf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function zR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=BR(e);if(s){if(t+1>=Z.recursionDepth.cap)return $a(s,n,o);let a=Ke(s,"powershell");if(a.status==="limited")return $a(s,n,o);if(a.status!=="complete")return sf(i,n,r,o);n.budget.charge("derivedTokens",vi(a)),i.push({program:a,depth:t+1})}}return sf(i,n,r,o)}function HR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function sf(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=bi(i.program,i.depth,t,n,[Dr(a)]);if(l.result)return l;s.push(...l.states)}o=Ci(s)}return{result:null,states:o}}function BR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function vi(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+vi(o),0):n.kind==="group"||n.kind==="function"?vi(n.body):0),0)}function $a(e,t,n){return t.trace?.recordSegment({type:"error",message:rt}),{result:{reason:rt,segment:e,intent:"stop_and_explain"},states:[...n]}}function UR(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=ZR(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};ff(e,o,"before-consumer",a.environment.paths,a.budget);let c=Rn(e.dialect,e.words).map(w),d=e.displayText,m=nf(c,o.shellGitContextState);if(e.dialect==="powershell"){let p=P(Rd(e,i,ox(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!p,reason:p?.reason}),p)return rx(d,p)}if(c.length===1&&c[0]?.includes(" ")&&!nr(e.dialect,e.words)){let p=P(ft(c[0]),a.policy),g=p!==null&&!a.strict&&Ou(e,a.rootProgram);if(p&&!g)return a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!0,reason:p.reason}),{reason:p.reason,segment:d,ruleId:p.id,intent:p.intent};a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!1});let h=af(e,l,o,m,s,a);if(h)return h;return za(c,o.shellGitContextState),null}let u=Dn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(p,g)=>{let h=g&&Object.hasOwn(g,"effectiveCwd")?g.effectiveCwd:o.effectiveCwd,y=Va(p,t+1,{...a,effectiveCwd:h,envAssignments:g?.envAssignments??m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:g?.functionDefinitions,worktreeMode:g?.worktreeMode??a.worktreeMode,trace:a.trace?mf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(u)return{...u,segment:d};let f=af(e,l,o,m,s,a);if(f)return f;return za(c,o.shellGitContextState),null}function af(e,t,n,r,o,i){let s=XR(e,t,n,r??new Map,i);if(s)return s;return ff(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),VR(e,t,n,i.environment.paths,i.budget),ex(e,n,o,i.environment,i.trace),null}var $R=new Set([">>","<>"]);function ff(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?jR(s):$R.has(s.operator)))continue;lf(s.target,t,r,o)}if(n!=="before-consumer"||!Fe(e.words[0],"tee"))return;let i=pf(e.words.slice(1));if(!i)return;for(let s of i.operands)lf(s,t,r,o)}function jR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function lf(e,t,n,r){let o=e?.provenance==="literal"?ur(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function VR(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!Ei(i))return;for(let s of KR(e)){let a=ur(s.text,n.effectiveCwd,r,o);if(!a||!Du(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=Z.trackedHeredocFiles.cap)throw new O("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function KR(e){let t=YR(e.redirections)?.target,n=cf(t)?[t]:[];if(Fe(e.words[0],"cat"))return qR(e.words)?n:[];if(!Fe(e.words[0],"tee"))return[];let r=pf(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(cf))return[];return[...r.operands,...n]}function qR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function YR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function pf(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&Fe(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function cf(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function Fe(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Ei(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function ZR(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return an;let n=t[0];if(!n?.heredoc)return an;if(!Ei(n.heredoc))return LR;if(n.fd!==void 0&&n.fd!==0)return an;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return an;let r=e.redirections.some((s)=>s!==n&&uf(s.target));if(Fe(e.words[0],"cat"))return r?an:void 0;if(Fe(e.words[0],"tee"))return r||e.words.slice(1).some(uf)?an:void 0;let o=e.words[0],i=e.words[1];if(Fe(o,"git")&&(Fe(i,"apply")||Fe(i,"commit")))return;if(Fe(o,"gh")&&(Fe(i,"pr")||Fe(i,"issue"))&&Fe(e.words[2],"create"))return;return an}function uf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function XR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(QR(e,i,n,r,o))return null;let a=JR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=ja(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function JR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Ei(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Ve(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=fe(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=P(S("interpreter.one-liner-paranoid",dr),n.policy);if(c)return c}if(!mr(s))return null;let l=P(S("interpreter.dangerous-command",wn),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function QR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Ei(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=qt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=L(a[0]??"");if((s.envSplitValues?.length??0)>0||!ie.has(l)&&!ie.has(k(l)))return!1;return St(a)}function ex(e,t,n,r,o){let i=qm(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function Dr(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:tf(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function Ci(e){let t=[];for(let n of e){if(!t.some((r)=>tx(r,n)))t.push(n);if(t.length>Z.controlFlowStates.cap)throw new O("controlFlowStates")}return t}function tx(e,t){return e.effectiveCwd===t.effectiveCwd&&Ln(e.shellGitContextState.env,t.shellGitContextState.env)&&Ln(e.literalHeredocFiles,t.literalHeredocFiles)&&Ln(e.functionDefinitions,t.functionDefinitions)&&Ln(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Ln(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function Ln(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function nx(e,t){let n=rr(e);return n===void 0?void 0:t.get(n)}function rx(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function ox(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function ja(e,t){let n=P(ft(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function df(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:In},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var ix=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function gf(e,t,n,r){let o=Va(e,0,{...t,...eu(t),budget:t.budget??de(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function hf(e,t,n){try{return{decision:e()}}catch(r){let o=sx(r,t,n);if(!o)throw r;return o}}function sx(e,t,n){if(!(e instanceof O)||!ix.has(e.kind))return null;let r=Z[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var ax=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),qa=new Set(["cc-safety-net","ccsn"]),lx=new Set(["bunx","npx","pnpx"]),cx=new Set(["pnpm","yarn"]),ux=new Set(["npm","pnpm","yarn"]),dx=new Set(["bun","node"]);function xi(e,t,n={}){if(qa.has(e))return 0;if(lx.has(e)){if(n.broad)return Ka(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return Ri(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&ux.has(e)&&n.broad&&t[r]==="exec"){let o=Ka(t.slice(r+1));return o===null?null:r+1+o}if(cx.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&Ri(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ka(t.slice(r+1));return o===null?null:r+1+o}if(dx.has(e)){let o=n.broad&&r!==-1?r:0;if(yf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&yf(t[o+1]))return o+2}return null}function Ka(e){let t=e.findIndex((r)=>Ri(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!Ri(r))break;n++}return n}function Ri(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return qa.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return qa.has(e.slice(0,t))}function yf(e){let t=e?.replaceAll("\\","/");return[...ax].some((n)=>t===n||t?.endsWith(`/${n}`))}var Cf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function bf(e,t,n){let r=we(e,"input-candidate");if(!r)return null;let o=Pn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>mx(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function mx(e,t){let n=Mt([...e],t),r=n.slice(1),o=xi(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}var Nr=require("node:path");var Rf="This path contains the protected policy config and you must not modify or delete it.",fx=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function xf(e,t,n){let r=bx(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Sf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=we(e,"input-candidate");if(e.invocation.route.kind==="command")return o?vf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=vf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Sf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Vr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Sf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>Lr(a,n,r,o,i));return s?{target:s}:null}function vf(e,t,n,r,o){let i=Pn(e,t,r,o,{findSegmentTarget:(s,a)=>px(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>Lr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>Cx(s,t,n,r,o)?.target??null});return i?{target:i}:null}function px(e,t,n,r,o){if(Cr(e))return null;let i=Yt([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&gx(a)){let l=hx(a).find((c)=>Ef(_e(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(ni(i,1)||ya(i,r)){let c=(ti(X(i))??X(["."])).find((d)=>{let m=_e(d.text,t.variables);return Lr(m,t.cwd,n,r,o)||Ef(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=jo(a).sources.find((c)=>Sx(_e(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(yx(i,s))return null;for(let l of[...e,...i])for(let c of _f(l))if(Lr(_e(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function gx(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function hx(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function yx(e,t){if(!fx.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function Cx(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of _f(i))if(Lr(s,t,n,r,o))return{target:s};return null}function _f(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function bx(e,t,n){let r=(a)=>Wr(ge(a,e.executionCwd,t,n)),o=r(yn(t)),i=[r(Zn(e.executionCwd)),r(Zn(e.configCwd))],s=new Set(i.map((a)=>Nr.dirname(a)));for(let a=Nr.dirname(o);;a=Nr.dirname(a))if(s.add(a),Nr.dirname(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function Lr(e,t,n,r,o){let i=Cl(e,t,r,o,(s)=>Wr(s)===no);return i!==null&&n.files.has(Wr(i))}function Ef(e,t,n,r,o){return n.directoriesAndAncestors.has(Wr(ge(e,t,r,o)))}function Sx(e,t,n,r,o){let i=Wr(ge(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Wr(e){return process.platform==="win32"?e.toLowerCase():e}var Te=require("node:path"),Nf=require("node:url");var Lf="Access to a sensitive path is not allowed.",Wf=new Set(["echo","printf"]),vx=new Set(["find"]),Ex=new Set(["-exec","-execdir"]),Rx=new Set([";","+"]),xx=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),_x=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Ff=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),wx=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),Ax=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Gf=new Set(["-c","-e","-r","-E","--eval","--exec"]),Px=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),Tx=new Set(["grep","rg"]),wf=new Set(["jq","gojq","jaq"]),Af="f",Pf="file",Ix="files",kx=new Set(["e","f"]),Ox=new Set(["regexp","file"]),Mx=new Set(["e","f","A","B","C","m"]),Dx=new Set(["regexp","file","after-context","before-context","context","max-count"]),Ya="__CC_SAFETY_NET_PIPE_INPUT__",Xa=/[\w./~@+-]*[./~][\w./~@+-]*/g,Nx=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,Lx=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,Wx=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Fx=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Gx=/\b(?:system|exec)\s*$/,zx=/\b(?:eval|exec)\s*\(/g,Hx=/\b(?:eval|exec)\s*$/,Bx=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Tf(e,t,n,r,o,i){for(let s of e){let a=s.target;if(z_(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=F_(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&H_(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function zf(e,t,n,r,o={}){let i=If(e,n,r),s=Tf(i,t,e.invocation.context.configCwd,n,r);if(s===null)return null;let a=s.ruleId!=="secret.deny-path"&&o.strict===!1?If(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:Tf(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&Ux(e,n))return null;return l}function Ux(e,t){let n=we(e,"input-candidate")??we(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of $o(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(gt(a.text,t))}let o=zt(r);if(o.length===0)return!1;let i=Rt(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>xx.has(a))}function If(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=we(e,"input-candidate");return[...s?Fn(s.shell,e.store,r,t,o,n,$x(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function $x(e){return e.program.dialect==="powershell"}function Fn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Xe;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...S_(gt(e.source,r),t,n,r,o,i)],l=(c)=>gt(t_(c,s),r);return Uo(e,o,r,i,{word:l,segment:(c,d,m,u,f)=>{if(c.length===0)return null;if(a.push(...wi(c,t,n,r,d.cwd,i,f)),m!==null)a.push(...Vx(m,c,t,n,r,d.cwd,i));return null},redirection:(c,d)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Hf(c.consumer,[c.body],t,n,r,d.cwd,i,(m)=>Kx(c.consumer??[],m,t,n,r,d.cwd,i)));if(c.targetOrder==="legacy-segment")return ta;return a.push({target:l(c.target),cwd:d.cwd}),null}}),a}function Ja(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Xe;return s.status==="complete"?Fn(s,t,n,r,o,i):null}function wi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((g,h)=>!s.has(h));if(wf.has(Rt(zt(p)[0]??"").toLowerCase()))return[...e.filter((g,h)=>s.has(h)).map(a),...wi(p,t,n,r,o,i)]}let l=e_(e).map(a),c=zt(e);if(c.length===0)return l;let d=c[0]??"",m=Rt(d).toLowerCase(),u=c.slice(1),f=jx(d,m,u);if(f)return[...l,...f.map(a)];if(Wf.has(m))return n.capturedOutput===!0?[...l,...Bf(e).map(a)]:l;if(m==="eval")return[...l,...Ja(u.join(" "),t,n,r,o,i)??u.map(a)];if(m==="export")return[...l,...u.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:Et(m,p)).map(a)];if(m==="git")return[...l,...r_(u).map(a)];if(wf.has(m))return[...l,...n_(u).map(a)];if(Tx.has(m))return[...l,...P_(u).map(a)];if(vx.has(m))return[...l,...a_(u,t,n,r,o,i).map(a)];if(ze.has(m))return[...l,...u.flatMap((p)=>Et("awk",p)).map(a),...u.flatMap((p)=>c_(p,t,n,r,o,i)),...u.flatMap(u_).map(a)];if(m==="curl")return[...l,...u.flatMap((p)=>Et(m,p)).map(a),...o_(u).map(a)];if(br(m)){let p=yr.has(m)?Me([m,...u]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let g=t.getShellSyntax(p.command);if(g.status==="structural-limit")throw new Xe;if(g.status==="complete")return[...l,...Fn(g,t,n,r,o,i),...u.slice(p.commandIndex).filter((h)=>!h.startsWith("-")).map(a)]}return[...l,...l_(m,u,t,n,r,o,i)]}return[...l,...u.flatMap((p)=>Et(m,p)).map(a)]}function jx(e,t,n){let r=xi(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function Vx(e,t,n,r,o,i,s){if(Xx(t,n,r,o,i,s))return Bf(e).map((a)=>({target:a,cwd:i}));return Hf(t,qx(e),n,r,o,i,s,()=>[])}function Kx(e,t,n,r,o,i,s){let a=zt(e);if(!br(Rt(a[0]??"").toLowerCase()))return[];return Ja(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Hf(e,t,n,r,o,i,s,a){let l=Jx(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>yr.has(l)?Fn(n.getShellSyntax(c),n,r,o,i,s):_i(l,c,n,r,o,i,s))}function Bf(e){let t=zt(e);if(t.length===0)return[];let n=Rt(t[0]??"").toLowerCase();if(!Wf.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Qa(r.replaceAll("%%","%"))];return t.slice(1)}function qx(e){let t=zt(e);if(t.length===0)return[];let n=Rt(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return Yx(r);return[]}function Yx(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Qa(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>Zx(t,r.slice(i*n,(i+1)*n)))}function Zx(e,t){let n=0;return Qa(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Qa(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Xx(e,t,n,r,o,i){let s=zt(e);if(s.length===0||Rt(s[0]??"").toLowerCase()!=="xargs")return!1;let a=on(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,Ya]:l.map((m)=>m.split(c).join(Ya));return wi(d,t,n,r,o,i).some((m)=>m.target.includes(Ya))}function Jx(e){let t=zt(e);if(t.length===0)return null;let n=Rt(t[0]??"").toLowerCase();if(!br(n))return null;return Qx(n,t.slice(1))?n:null}function Qx(e,t){let n=el(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Gf.has(o)||Uf(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(Bx.get(n)?.has(o))r++;continue}return!1}return!0}function el(e){return/^python\d/.test(e)?"python":e}function e_(e){let t=[];for(let n of e){if(jf(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var kf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function t_(e,t){if(!t||!kf.test(e))return e;return`~${e.replace(kf,"").replace(/\\/g,"/")}`}function Et(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function n_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Et("jq",i))}return e.flatMap((r,o)=>o===t?[]:Et("jq",r))}function r_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>Et("git",i))];if(t.push(...Et("git",r)),!Oe.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Et("git",o)),n++}return t}function o_(e){return e.flatMap((t,n)=>{let r=s_(t);if(r!==null)return Of(r.flag,r.value);let o=i_(e[n-1]);return o===null?[]:Of(o,t)})}function Of(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Za(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Za(t.slice(n+1))}return t.startsWith("@")?Za(t.slice(1)):[]}function i_(e){if(e===void 0)return null;if(Ff.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function s_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Ff.has(r)?{flag:r,value:e.slice(n+1)}:null}function Za(e){return e===""||e==="-"?[]:[e]}function a_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!Ex.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((f)=>Rx.has(f)),m=d===-1?c:c.slice(0,d),u=wi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...u.filter((f)=>f!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,g)=>{if(!_x.has(f))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function l_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Gf.has(c)||Uf(e,c)){let m=t[l+1];if(m!==void 0)a.push(..._i(e,m,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(..._i(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Uf(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return Px.get(t[t.length-1]??"")?.has(el(e))??!1}function c_(e,t,n,r,o,i){if(!e.includes("system"))return[];return fa(e)?.commands.flatMap((s)=>Fn(t.getShellSyntax(s),t,n,r,o,i))??[]}function u_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function d_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(tl),...e.match(Xa)??[]]}function _i(e,t,n,r,o,i,s){let a=(f)=>({target:f,cwd:i}),l=f_(t,m_(e));if(l===null)return d_(t).map(a);let c=l.masked.match(Fx)!==null||l.literals.some((f)=>Gx.test(l.masked.slice(0,f.start))),d=l.masked.match(zx)!==null||l.literals.some((f)=>Hx.test(l.masked.slice(0,f.start))),m=r.refineInlineData===!0&&!yr.has(e),u=m&&!(y_(l.masked)||c||d)?[]:l.literals;return[...u.map((f)=>f.text).filter((f)=>f!=="").map(a),...u.flatMap((f)=>tl(f.text)).map(a),...m?[]:l.literals.flatMap((f)=>f.text.match(Xa)??[]).map(a),...c?l.literals.flatMap((f)=>Ja(f.text,n,r,o,i,s)??[a(f.text)]):[],...d?l.literals.flatMap((f)=>_i(e,f.text.replace(/\\(.)/g,(p,g)=>g==="n"?`
-`:g),n,r,o,i,s)):[],...(l.masked.match(Xa)??[]).map(a)]}function m_(e){let t=el(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function f_(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(Lx.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&h_(e,o))return null;let a=t==="python"?p_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,d=g_(e,c,l);if(d===null)return null;let m=e.slice(c,d);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&Wx.test(m))return null;r.push({start:c,text:m});for(let u=o;u<d+l.length;u++)n[u]=" ";o=d+l.length-1}return{masked:n.join(""),literals:r}}function p_(e,t){return Nx.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function g_(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function h_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function y_(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(wx.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>Ax.has(i)))continue;if(o.length>1)return!0;if(C_(e,r)===".")return!0;if(b_(e,r+n.length)==="(")return!0}return!1}function C_(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function b_(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function S_(e,t,n,r,o,i){return __(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Fn(a,t,{...n,capturedOutput:!0},r,o,i),...v_(a,r)?E_(a,r).map((l)=>({target:l,cwd:o})):[]]})}function v_(e,t){let n=$o(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||Rt(gt(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=gt(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function E_(e,t){return $o(e).flatMap((n)=>n.kind==="word"?[gt(n.text,t)]:n.kind==="redirection"&&n.target?[gt(n.target,t)]:[]).flatMap(tl)}function tl(e){let t=x_(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||R_(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function R_(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function x_(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function __(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Xn(o,n))continue;if($f(e,r,n)){let i=w_(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=A_(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function w_(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Xn(i,n))continue;if($f(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function A_(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function $f(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function P_(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let m=d[1]??"",u=d[2];if(m===Ix)o=!0;if(Ox.has(m))r=!0;if(u!==void 0){if(m===Pf)t.push(u);continue}if(Dx.has(m)){let f=e[l+1];if(m===Pf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),u="",f="";for(let g=0;g<m.length;g++){let h=m[g]??"";if(kx.has(h))r=!0;if(Mx.has(h)){u=h,f=m.slice(g+1);break}}if(u==="")continue;if(f.length>0){if(u===Af)t.push(f);continue}let p=e[l+1];if(u===Af&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function zt(e){let t=e.findIndex((n)=>!jf(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function jf(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var T_=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),I_=".env.",k_=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),O_=[".env.example.",".env.sample."];function M_(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function D_(e){return e.length>0&&!/\s/.test(e)}function N_(e,t,n,r){try{let o=zr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof O)throw o;return!1}}var L_=new Set(["node_modules","__pycache__"]),W_=[["vendor","bundle"],["vendor","cache"]];function F_(e,t,n,r,o){if(M_(e))return null;let i=st(e,t,r,o);if(!i)return null;let s=V(i.split("/").pop()??""),a=V(i),l=()=>D_(s)||N_(e,t,r,o);if(k_.has(s)||O_.some((u)=>s.startsWith(u)))return null;let c=V($_(e,t,r,o));for(let u of ps){let f=`~/${u.suffixParts.join("/")}`;if((Df(a,f)||Df(c,f))&&vt(u.id,n))return u.id}let d=G_(i,t,n,r,o);if(d)return d;if(T_.has(s))return null;for(let u of fs)if(s===u.basename&&vt(u.id,n))return u.id;if(s.startsWith(I_)&&vt(lo.id,n)&&l())return lo.id;for(let u of gs)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let f=s.slice(u.prefix.length)[0];if((f==="-"||f==="_")&&vt(u.id,n)&&l())return u.id}for(let u of hs)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&vt(u.id,n))return u.id}if(B_(a))return null;if(!s.includes(".")&&Qn.pattern.test(s)&&vt(Qn.id,n))return Qn.id;let m=U_(s,n);if(m)return m;return null}function G_(e,t,n,r,o){return co.find((i)=>{if(!vt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return H(e,j(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=V(e).split("/");return H(e,j(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Gr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return H(e,st("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=j(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return H(e,s,["auth.json",".credentials.json"])||Fr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=j(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=V(e).split("/").at(-1)??"";return H(e,s,["config.toml"])||a.endsWith(".config.toml")&&H(e,s,[a])}case"secret.cli.gemini":return H(e,ye(j(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=V(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ye(j(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return H(e,ye(j(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Gr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>H(e,st(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=j(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return H(e,s,["config.json"])||Fr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return H(e,j(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=j(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=j(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return H(e,s,["server.token"])||Fr(e,s,["credentials"])||Fr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=V(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||H(e,j(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||H(e,j(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ye(j(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=V(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return H(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&H(e,s,[a])||c.some((d)=>Gr(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?j(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ye(j(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ye(j(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(V(e).split("/").at(-1)??"")||H(e,s,l)||(c?.trim()?Gr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>H(e,st(d,t,r,o),l))}case"secret.cli.pi":return H(e,j(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return H(e,j(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=st("~",t,r,o);return[ye(j(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ye(s,".local","share","amp")].some((l)=>H(e,l,["secrets.json"]))||Fr(e,ye(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ye(j(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ye(st("~",t,r,o),".config","amp")],l=V(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>H(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Gr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ye(j(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ye(j(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return H(e,st("~/.cursor",t,r,o),["auth.json"])||H(e,s,["auth.json"])||V(e).split("/").at(-1)==="mcp-auth.json"&&ln(V(e),V(a))}case"secret.cli.cursor.config":{let s=V(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return H(e,j(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=V(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||H(e,j(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||H(e,st("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Mf=new WeakMap;function j(e,t,n,r,o){let i=Mf.get(o)??new Map;Mf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=st(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function H(e,t,n){return n.some((r)=>Vf(e,ye(t,r)))}function Fr(e,t,n){return n.some((r)=>ln(V(e),V(ye(t,r))))}function Gr(e,t,n,r,o){return Vf(e,st(t,n,r,o))}function Vf(e,t){return V(e)===V(t)}function ye(e,...t){return nt([e,...t].filter(Boolean).join("/"))}function z_(e,t,n,r,o,i){if(n.length===0)return!1;let s=V(zr(e,t,o,i));return n.some((a)=>ln(s,V(zr(a,r,o,i))))}function H_(e,t,n,r,o,i){if(n.length===0)return!1;let s=V(zr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?nt(D(ke(a),o.paths,i)):"",c=V(l),d=o.env.get("CC_SAFETY_NET_HOME"),m=V(d?nt(D(Te.resolve(ke(d)),o.paths,i)):l&&nt(D(`${l}/.cc-safety-net`,o.paths,i)));if(m&&ln(s,m))return!1;return n.some((u)=>{let f=V(zr(u,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return ln(s,f)})}function B_(e){let t=e.split("/");return t.some((n)=>L_.has(n))||W_.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function U_(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ys)if(r===o.extension&&vt(o.id,t))return o.id;for(let o of Cs)if(o.pattern.test(r)&&vt(o.id,t))return o.id;return null}function V(e){return e.toLowerCase()}function vt(e,t){return!t?.disabledRules?.includes(e)}function st(e,t,n,r){let{home:o,normalized:i}=nl(e,n,r);if(!i)return"";if(!o)return i;let s=rl(i,o),a=Te.isAbsolute(s)?s:nt(Te.resolve(t,s)),l=nt(D(a,n.paths,r));if(!ln(l,o)){if(Te.isAbsolute(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Df(e,t){return e===t||e.startsWith(`${t}/`)}function $_(e,t,n,r){let{home:o,normalized:i}=nl(e,n,r);if(!i||!o)return"";let s=rl(i,o),a=Te.posix.normalize(Te.isAbsolute(s)?s:nt(Te.resolve(t,s))),l=nt(ke(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&ln(c(a),c(u)));if(d===void 0)return"";let m=a.slice(d.length);return m?`~${m}`:"~"}function zr(e,t,n,r){let{home:o,normalized:i}=nl(e,n,r);if(!i)return"";let s=o?rl(i,o):i;return nt(D(Te.isAbsolute(s)?s:Te.resolve(t,s),n.paths,r))}function nl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?nt(D(ke(r),t.paths,n)):"",i=nt(ke(j_(gt(e,t))));return{home:o,normalized:i}}function j_(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return Nf.fileURLToPath(e)}catch{return e}}function rl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ye(t,e.slice(2));return e}function V_(e){if(process.platform==="win32")return!0;return Te.win32.parse(e).root.length>1}function nt(e){let t=e.trim(),n=(t.includes("\\")&&V_(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function ln(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function Rt(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class cn extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var K_={findPolicyMutation:xf,findGitMetadataMutation:ld,resolveGitMetadata:q_,loadPolicySnapshot:Qc,findSensitiveTarget:zf,analyzeCommand:gf,getModes:Yi};function Kf(e,t){let n={...K_,...t.dependencies},r=X_(e),o=Hr(e)?e.command:r,i=Ht("policy-protection",o,()=>Sr(e)),s=we(i,"input-candidate"),a=we(i,"declared-command");if(Hr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:rt,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:xd,intent:"stop_and_explain"}};let l=de(),c=Ht("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),d=Ht("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Rf,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let m=Ht("policy-protection",o,()=>bf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Cf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let u=Ht("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Be,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let f=Ht("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...Y_(f)},y=p.secretProtection.enabled===!1?null:Ht("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:Hr(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:Lf,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!Hr(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...ol("command-validation",o),...h};let v=Ht("command-analysis",o,()=>hf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Z_(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...h,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function q_(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Y_(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Z_(e){return we(e,"declared-command")?.program}function X_(e){try{return wt(e.input)}catch(t){let n=Hr(e)?e.command:void 0;throw new cn("policy-protection",ol("policy-protection",t instanceof be?void 0:n,t),t)}}function Ht(e,t,n){try{return n()}catch(r){throw new cn(e,ol(e,r instanceof be?void 0:t,r),r)}}function ol(e,t,n){let r=n instanceof O||n instanceof Xe;return{stage:e,decision:{kind:"deny",reason:r?Di:$n,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Hr(e){return e.route.kind==="command"}var Pi=require("node:fs"),zn=require("node:path");var le=require("node:fs"),Gn=require("node:path");function qf(e,t={}){return Co(yn(e,t),e.home).policy.audit.retention_days}var sl=86400000,J_=".last-prune",Q_=/^\d{4}-\d{2}$/,ew=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Yf=(e)=>Math.floor(e/sl);function Xf(e,t,n=()=>new Date){try{let r=n().getTime();if(!le.statSync(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Gn.join(t,J_),i=le.statSync(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Yf(i)===Yf(r))return;let s=r-qf(e)*sl,a=new Date(r).toISOString().slice(0,7);for(let l of il(t)){if(l.isDirectory()){tw(Gn.join(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))nw(Gn.join(t,l.name),s)}le.writeFileSync(o,"",{mode:384}),le.utimesSync(o,r/1000,r/1000)}catch{}}function tw(e,t,n){for(let r of il(e)){if(!r.isDirectory()||!Q_.test(r.name))continue;let o=Gn.join(e,r.name);for(let i of il(o)){if(!i.isFile())continue;let s=ew.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+sl;if(!Number.isFinite(a)||a>=t)continue;Jf(Gn.join(o,i.name))}if(r.name!==n)Zf(o)}Zf(e)}function nw(e,t){try{let n=le.lstatSync(e);if(n.mtimeMs>=t)return;let r=le.readFileSync(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(rw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(le.lstatSync(e).mtimeMs!==n.mtimeMs)return;Jf(e)}catch{}}function rw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function il(e){try{return le.readdirSync(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Jf(e){try{le.unlinkSync(e)}catch{}}function Zf(e){try{le.rmdirSync(e)}catch{}}var ow="2.4.3",iw=1e4,sw=2000,aw=256,lw=32768;function cw(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function uw(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function al(e,t,n,r,o,i,s={}){let a=cw(t);if(!a)return;let l=mw(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=Ai(xt(n),s.failureStage?Number.POSITIVE_INFINITY:iw),m=Ai(xt(r),sw),u=s.toolName?Ai(xt(s.toolName),aw):void 0,f=i===null?void 0:Ai(xt(i),lw),p=zn.join(l,uw(f?.value??null),c.slice(0,7));Pi.mkdirSync(p,{recursive:!0,mode:448});let g=zn.join(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Xi)(),v:ow,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:m.value,...d.truncated||m.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Pi.appendFileSync(g,`${JSON.stringify(h)}
-`,{encoding:"utf-8",mode:384}),Xf(e,l,s.now)}catch{}}function Ai(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function dw(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&zn.isAbsolute(n)?n:null}function mw(e){let t=dw(e);return t?zn.join(t,".cc-safety-net","logs"):null}function ep(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Qf(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Qf(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Qf(e){return"command"in e?e.command??"":""}function tp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;al(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function np(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;al(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function op(e,t,n){try{let r=Kf(t,{environment:e,...n.guard});return rp(e,t,r,n),r}catch(r){if(!(r instanceof cn))throw r;throw rp(e,t,r.evaluation,n,!(r.cause instanceof be),{stage:r.stage,errorCode:fw(r.cause)}),r}}function rp(e,t,n,r,o=!0,i){tp(e,ep(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function fw(e){if(e instanceof O)return Z[e.kind].errorCode;if(e instanceof be)return"tool-input-limit";if(e instanceof Xe)return"structural-shell-syntax-limit";return"unexpected-error"}var at=(e,t,n,r,o)=>Ll(e.cwd,t,n,r,o.paths,process.cwd());function pw(e,t){console.log(JSON.stringify(e(pl(t))))}async function gw(e){let t;try{t=(await Nl(process.stdin)).trim()}catch{e({reason:"Failed to parse hook input JSON."});return}if(!t){e({reason:"Missing hook input JSON."});return}return Yr(t,e,"Failed to parse hook input JSON.")}async function hw(e){let t=Vl(),n=await gw(e.outputDeny);if(n===void 0)return;if(!n||typeof n!=="object"||Array.isArray(n)){ee(e.outputDeny);return}if(!e.isSupported(n))return;let r=e.getAgent?.(n,t)??e.agent,o=e.agent===r?void 0:e.agent,i=Sw(n),s=(p,g)=>{np(t,p,()=>e.getSessionId(n),{agent:r,shape:o,toolName:g,cwd:i}),e.outputDeny(p)},a=e.getToolName(n);if(typeof a!=="string"||a.trim()===""){ee((p)=>s(p),bw(n));return}let l=a,c=(p)=>s(p,l),d;try{d=e.getToolInput(n,l,c,t)}catch(p){if(!(p instanceof be))throw p;ee(c,void 0,l);return}if(!d.ok)return;let m=e.getContext(n,d.input,l,c,t);if(!m)return;let u;try{u=wt(d.input)}catch(p){if(!(p instanceof be))throw p;ee(c,void 0,l);return}let f=qn(l,d.input,d.route,m,u??null);try{let p=op(t,f,{guard:{auditAllowed:Kl(t.env),dependencies:e.guardDependencies},audit:{agent:r,shape:o,getSessionId:()=>e.getSessionId(n)}}),g=Ni(p,{includeEvidence:!0,toolName:p.stage==="command-analysis"?void 0:l});if(g){e.outputDeny(g);return}e.outputAllow?.()}catch(p){if(!(p instanceof cn))throw p;yw(p,t.env);let g=Ni(p.evaluation,{includeEvidence:!0,toolName:p.evaluation.stage==="command-analysis"?void 0:l});if(g)e.outputDeny(g);return}}function yw(e,t){if(!Ut(ae.debug,t))return;console.error(`CC Safety Net debug: ${Cw(e.stage)}: ${gl(e.cause)}`)}function Cw(e){if(e==="policy-protection")return"hook policy protection failed";if(e==="config-load")return"hook config loading failed";if(e==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function bw(e){if(!e||typeof e!=="object"||Array.isArray(e))return;if(Object.hasOwn(e,"tool_input"))return e.tool_input;let t=e.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function Sw(e){if(!e||typeof e!=="object"||Array.isArray(e))return null;let t=e.cwd;if(typeof t==="string")return t;let n=e.toolCall;if(!n||typeof n!=="object"||Array.isArray(n))return null;let r=n.args;if(!r||typeof r!=="object"||Array.isArray(r))return null;let o=r.Cwd;return typeof o==="string"?o:null}async function Ie(e){let t=(o)=>pw(e.createDenyOutput,o),n=e.createAllowOutput,r=n?()=>console.log(JSON.stringify(n())):void 0;try{await hw({...e,outputDeny:t,outputAllow:r})}catch(o){console.error("CC Safety Net error:",o),t(fn())}}var vw=new Map([["run_command","auto"]]),Ew=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function ip(e){return se(e,vw)}async function sp(){await Ie({agent:"antigravity-cli",createDenyOutput:(e)=>({decision:"deny",reason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolCall?.name,getToolInput:(e,t)=>({ok:!0,input:Aw(e.toolCall?.args,t),route:ip(t)}),getContext:Rw,getSessionId:(e)=>e.conversationId})}function Rw(e,t,n,r,o){let s=ww(e,o.paths).flatMap((d)=>{let m=it([d],o.paths);return m?[m]:[]});if(!s[0])return un(r,t,n),null;if(n!=="run_command"){let d;try{d=xw(t,n,s,o.paths)}catch(m){if(m instanceof be)return un(r,void 0,n),null;if(!(m instanceof O))throw m;return un(r,t,n),null}if(!d)return un(r,t,n),null;return{configCwd:d,executionCwd:d}}let a=e.toolCall?.args;if(!a||!Object.hasOwn(a,"Cwd"))return{configCwd:s[0],executionCwd:s[0]};let l=a.Cwd;if(typeof l!=="string"||l.trim()==="")return un(r,t,n),null;let c=ut(l,s,o.paths);if(c){let d=ap(c,s);if(!d)return un(r,t,n,l),null;return{configCwd:d,executionCwd:c}}return un(r,t,n,l),null}function xw(e,t,n,r){let o=ip(t),i=[...Kr(e,Ew),...o.kind==="patch"?qr(e):[]].filter(Hn.isAbsolute),s=de(),a=new Set(i.flatMap((l)=>{let c=ap(D(l,r,s),n);return c?[c]:[]}));if(a.size>1)return null;return[...a][0]??n[0]??null}function ap(e,t){return t.filter((n)=>_w(e,n)).reduce((n,r)=>r.length>n.length?r:n,"")||null}function _w(e,t){let n=Hn.relative(t,e);return n===""||!n.startsWith("..")&&!Hn.isAbsolute(n)}function un(e,t,n,r){let o=t&&typeof t==="object"?t.command:void 0;e(fn({command:typeof o==="string"?o:void 0,segment:r,toolName:n}))}function ww(e,t){if(e.workspacePaths===void 0)return[process.cwd()];let n=Array.isArray(e.workspacePaths)?e.workspacePaths.filter((r)=>typeof r==="string"&&r.trim()!==""):[];return it(n,t)?n:[]}function Aw(e,t){if(!e)return;if(t!=="run_command")return e;return{...e,command:typeof e.CommandLine==="string"&&e.CommandLine!==""?e.CommandLine:void 0}}var Ti=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,runtime:{order:3,flags:["-cx","--codex"],description:"Run as a Codex PreToolUse hook",legacyTopLevelFlags:[]},install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:7,runtime:{order:6,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:7,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:6,runtime:{order:5,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:6,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:8,runtime:{order:7,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:9,runtime:{order:8,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:10,runtime:{order:9,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:10,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:11,install:{order:11,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:12,install:{order:12,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:13,install:{order:13,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:4,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],cN=Ti.slice().sort((e,t)=>e.doctorOrder-t.doctorOrder).map((e)=>e.id),lp=Ti.filter((e)=>("runtime"in e)).slice().sort((e,t)=>e.runtime.order-t.runtime.order).map((e)=>({id:e.id,displayName:"displayName"in e.runtime?e.runtime.displayName:e.displayName,flags:e.runtime.flags,legacyFlags:"legacyFlags"in e.runtime?e.runtime.legacyFlags:[],description:e.runtime.description,legacyTopLevelFlags:e.runtime.legacyTopLevelFlags})),uN=Ti.slice().sort((e,t)=>e.install.order-t.install.order).map((e)=>({id:e.id,...e.install})).map(({order:e,...t})=>t),dN=Object.fromEntries(Ti.map((e)=>[e.id,e.displayName]));var dn=require("node:path");function cp(e,t){if(e!==void 0&&e!==null&&typeof e!=="string")return"unknown";if(typeof e==="string"&&!dn.isAbsolute(e))return"unknown";try{let n=de(),r=typeof e==="string"&&e?D(e,t.paths,n):void 0,o=t.home,i=[["codex",t.env.get("CODEX_HOME")||dn.join(o,".codex")],["copilot-cli",t.env.get("COPILOT_HOME")||dn.join(o,".copilot")],["claude-code",t.env.get("CLAUDE_CONFIG_DIR")||dn.join(o,".claude")]],s=r?i.flatMap(([a,l])=>{if(!dn.isAbsolute(l))return[];return $i(r,D(l,t.paths,n))?[a]:[]}):[];if(s.length===1)return s[0]??"unknown";if(s.length>1)return"unknown"}catch{return"unknown"}if(t.env.get("CLAUDECODE")==="1"||Boolean(t.env.get("CLAUDE_CODE_ENTRYPOINT")))return"claude-code";return"unknown"}var ll="PreToolUse",up="BeforeTool",dp="pre_tool_call";async function Bn(e){await Ie({agent:e.agent,...e.getAgent?{getAgent:e.getAgent}:{},createDenyOutput:(t)=>({hookSpecificOutput:{hookEventName:ll,permissionDecision:"deny",permissionDecisionReason:t}}),isSupported:(t)=>t.hook_event_name===ll,getToolName:(t)=>t.tool_name,getToolInput:(t,n)=>({ok:!0,input:t.tool_input,route:e.getToolRoute(n)}),getContext:e.getContext??at,getSessionId:(t)=>t.session_id})}var Pw=new Map([["Bash","posix"],["PowerShell","powershell"]]);function Tw(e){return se(e,Pw)}async function mp(){await Bn({agent:"claude-code",getAgent:(e,t)=>cp(e.transcript_path,t),getToolRoute:Tw})}var Iw=new Map([["Bash","auto"]]);async function fp(){await Bn({agent:"codex",getToolRoute:(e)=>se(e,Iw)})}var kw=new Map([["bash","auto"],["Bash","auto"],["powershell","powershell"],["PowerShell","powershell"]]);function Ow(e){return se(e,kw)}async function pp(){await Ie({agent:"copilot-cli",createDenyOutput:(e)=>({permissionDecision:"deny",permissionDecisionReason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(typeof e.toolArgs!=="string")return n({reason:"Failed to parse toolArgs JSON."}),{ok:!1};let r=Yr(e.toolArgs,n,"Failed to parse toolArgs JSON.");if(r===void 0)return{ok:!1};return{ok:!0,input:r,route:Ow(t)}},getContext:at,getSessionId:(e)=>typeof e.sessionId==="string"&&e.sessionId.trim()?e.sessionId:void 0})}var Mw=new Map([["Shell","auto"]]);function Dw(e){return se(e,Mw)}async function gp(){await Ie({agent:"cursor",createDenyOutput:(e)=>({permission:"deny",user_message:e,agent_message:e}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Dw(t)}),getContext:Nw,getSessionId:(e)=>e.conversation_id})}function Nw(e,t,n,r,o){let i=Lw(e,o.paths);if(!i[0])return ee(r,t,n),null;let s=ut(Fw(e.cwd),i,o.paths);if(!s)return ee(r,t,n,typeof e.cwd==="string"?e.cwd:void 0),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:s,executionCwd:s};if(!Object.hasOwn(t,"working_directory"))return{configCwd:s,executionCwd:s};let a=t.working_directory;if(typeof a!=="string"||a.trim()==="")return ee(r,t,n),null;let l=ut(a,i,o.paths);if(!l)return ee(r,t,n,a),null;return{configCwd:s,executionCwd:l}}function Lw(e,t){return Ww(e).flatMap((n)=>{let r=it([n],t);return r?[r]:[]})}function Ww(e){if(e.workspace_roots===void 0)return typeof e.cwd==="string"&&e.cwd.trim()!==""?[e.cwd]:[];if(!Array.isArray(e.workspace_roots))return[];return e.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="")}function Fw(e){return typeof e==="string"&&e.trim()!==""?e:"."}var Gw=new Map([["run_shell_command","auto"]]);function zw(e){return se(e,Gw)}async function hp(){await Ie({agent:"gemini-cli",createDenyOutput:(e)=>({decision:"deny",reason:e,systemMessage:e}),isSupported:(e)=>e.hook_event_name===up,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:zw(t)}),getContext:at,getSessionId:(e)=>e.session_id})}var Hw=new Map([["run_terminal_command","auto"]]);function Bw(e){return se(e,Hw)}async function yp(){await Ie({agent:"grok-build",createDenyOutput:(e)=>({decision:"deny",reason:e}),createAllowOutput:()=>({decision:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(e.toolInputTruncated===!0)return ee(n,e.toolInput,t),{ok:!1};return{ok:!0,input:e.toolInput,route:Bw(t)}},getContext:Uw,getSessionId:(e)=>e.sessionId})}function Uw(e,t,n,r,o){let i=it($w(e),o.paths);if(!i)return ee(r,t,n),null;let s=ut(jw(e.cwd),[i],o.paths);if(!s)return ee(r,t,n,typeof e.cwd==="string"?e.cwd:void 0),null;return{configCwd:s,executionCwd:s}}function $w(e){let t=e.workspaceRoot===void 0?e.cwd:e.workspaceRoot;return typeof t==="string"&&t.trim()!==""?[t]:[]}function jw(e){return typeof e==="string"&&e.trim()!==""?e:"."}var Cp=require("node:path");var Vw=new Map([["terminal","posix"]]);async function bp(){await Ie({agent:"hermes-agent",createDenyOutput:(e)=>({action:"block",message:e}),isSupported:(e)=>e.hook_event_name===dp,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:se(t,Vw)}),getContext:Kw,getSessionId:(e)=>e.session_id})}function Kw(e,t,n,r,o){let i=at(e,t,n,r,o);if(!i)return null;if(!t||typeof t!=="object"||Array.isArray(t))return i;if(!Object.hasOwn(t,"workdir"))return i;let s=t.workdir;if(typeof s!=="string"||s.trim()==="")return ee(r,t,n),null;let a=it([Cp.resolve(i.configCwd,s)],o.paths);if(!a)return ee(r,t,n,s),null;return{...i,executionCwd:a}}var Sp=new Map([["Bash","posix"]]);function qw(e){return se(e,Sp)}async function vp(){await Bn({agent:"kimi-code",getToolRoute:qw,getContext:(e,t,n,r,o)=>{let i=at(e,t,n,r,o);if(!i)return null;let s=e.tool_input;if(!Sp.has(n)||!s||!Object.hasOwn(s,"cwd"))return i;let a=s.cwd;if(typeof a!=="string"||a.trim()==="")return ee(r,t,n),null;let l=ut(a,[i.configCwd],o.paths);if(!l)return ee(r,t,n,a),null;return{configCwd:i.configCwd,executionCwd:l}}})}var Yw={"antigravity-cli":sp,"claude-code":mp,codex:fp,"copilot-cli":pp,cursor:gp,"gemini-cli":hp,"grok-build":yp,"hermes-agent":bp,"kimi-code":vp},cl=lp.map((e)=>({...e,run:Yw[e.id]}));function Ep(e){let t=Ur({label:"hook",booleans:Object.fromEntries(cl.map((r)=>[r.id,[...r.flags,...r.legacyFlags]]))},e);if(t.errors.length>0)return;let n=cl.filter((r)=>t.flags[r.id]);return n.length===1?n[0]:void 0}function Rp(e){return cl.find((t)=>t.legacyTopLevelFlags.some((n)=>n===e))}async function Zw(){let e=process.argv.slice(2),t=e[0],n=Ur({label:"cc-safety-net",booleans:{version:["-V","--version"]},positionals:"list"},e);if(!n.help&&!n.flags.version){if(t?.toLowerCase()==="hook"){let i=Ep(e.slice(1));if(i){await i.run();return}}let o=Rp(t);if(o){await o.run();return}}let r=await import("../cli.js");await r.runCli(e)}Zw().catch((e)=>{console.error("CC Safety Net error:",e),process.exit(1)});
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function gi(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function Mr(e){return e?w(e):""}function VE(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Fa(e,t){return La(qe(e,"posix"),t)}function Nr(e){return Fa(e,new Set(Array.from(e.matchAll(bm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function La(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(La(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>La(o,n))||Rm(r.words,n))return!0;XE(r,n)}return!1}function Rm(e,t){let n=e.findIndex((s)=>Be(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Dr(r,t))return!0;let o=L(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Cm(e[s],t)}if(ie.has(o)){let s=e.slice(n),a=Me(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Cm(s[l],t)}let i=KE(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Rm(e.slice(i),t)}function KE(e,t,n){let r=L(e[t]?.text??"");if(r==="command")return qE(e,t+1);if(r==="exec")return YE(e,t+1);if(r==="env")return ZE(e,t+1,n);return null}function qE(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function YE(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function ZE(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Dr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Dr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Be(i))continue;return r}return null}function XE(e,t){if(!e.words.every((n)=>Be(n.text)!==null))return;for(let n of e.words){let r=Be(n.text);if(!r)continue;if(Dr(n,t))t.add(r.name)}}function Dr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(bm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(WE.test(o)||t.has(o))}))}function Cm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Dr(e,t))}var JE=["--init-file","--rcfile"],QE=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function St(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return xm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=xm(e,t,!1);if(r!==null)return r}}return null}function vt(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Me(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function xm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function _m(e){let t=k(e[0]??"").toLowerCase(),n=eR(e,t),r=QE.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function eR(e,t){let n=Me(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?JE.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&us.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=ds(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var Ga="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",za="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",tR="__CC_SAFETY_NET_XARGS_INPUT__",hi="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",yi="rm",nR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,rR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,oR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,iR=/^(?:[0-9]+|[@*])$/;function Pm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=sn(n),i=n.slice(r),s=b("xargs.shell-dynamic",za);if(aR(i,o,t)&&P(s,t.policy))return P(s,t.policy);for(let a of et(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?P(s,t.policy):null;if(c)return c;let u=Mm(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&km(l,o),d=t.analyzeChild(l,{...nn(a,t),dynamicInput:u,dynamicSourceInput:m||Im(l,a.head,o,a.wrapperEnvAssignments,u,t.environment),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",Ga)});if(d)return d;let f=sR(l,o,t.policy?.rules??[],P(s,t.policy));if(f)return f;if(a.head==="git"){let h=o===null?[...l,tR]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...nn(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=ht(l,t.policy?.rules??[]);if(p)return p}return null}function sR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=ht([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=L(e[0]??"");if(!n.some((i)=>L(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Tm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=pm(e,r,t.length,n);return o===null?[]:[o]}function Im(e,t,n,r,o,i){if(ie.has(t)){if(vt(e))return!1;if(n!==null&&lR(e,n))return!0;let s=St(e);if(!s){let a=bt(J(e));if(a.kind==="literal")return n!==null&&a.source.includes(n);return a.kind==="none"&&o}if(n!==null&&s.includes(n))return!0;if(ft(s))return!0;return cR(s,n,r)}if(Ke(t))return wm(e,n,Fo,$u(t));if(He.has(t))return wm(e,n,Ca,Ld);if(t==="eval"){let s=fi(J(e));if(s.kind==="dynamic")return!0;if(n!==null)return s.kind==="literal"&&s.source.includes(n);return o}if(t==="find")return uR(e,n,i);if(t==="git"){let s=Fe(e);return n===null?s.subcommand===null:(s.subcommand?.includes(n)??!1)||s.subcommand!==null&&Mn.has(s.subcommand.toLowerCase())&&Om(s.rest,n).some((a)=>a.includes(n))}return!1}function wm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,hi]).sources.some((a)=>a.value===hi);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${hi}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${hi}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Tm(l,t,a))));return di(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function aR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(et(e,n),(i)=>i.head)),o=t===null?[...e,yi]:e.map((i,s)=>s===0?i:i.replaceAll(t,yi));return Array.from(et(o,n)).some((i)=>i.head===yi&&!r.has(yi))}function km(e,t){return Om(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Om(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Mm(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function lR(e,t){let n=Me(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return Tm(i,t,o).some((l)=>{let c=e.map((m,d)=>d===s?m.replaceAll(t,l):m),u=Me(c);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(n.commandIndex===null&&u.commandIndex!==null)return!0;if(n.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(c[u.commandIndex]??"").includes(l))return!0;return u.scriptIndex!==null&&(c[u.scriptIndex]??"").includes(l)})}))}function cR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(nR))if(Am(o,r))return!0;for(let o of e.matchAll(rR))for(let i of(o[1]??"").matchAll(oR))if(Am(i,r))return!0;return Fa(e,r)}function Am(e,t){let n=e[1]??e[2];return n!==void 0&&(iR.test(n)||t.has(n))}function uR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(yt(s)){let l=Ir(e,i);i=l.nextIndex-1;for(let c of et(l.tokens,{environment:n,cwd:void 0})){let u=Mm(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&km(c.tokens,t)||Im(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=Wt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function sn(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var Lr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Wr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",dR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",mR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",bi=/\{[^{}\s]*\}/g,Dm=/\{\}|\{-?\d+\}/g,fR=["e","f","source","file","-e","-f","--source","--file"],pR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],gR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),hR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Nm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),yR=new Set(["--workdir","--wd"]),Lm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function $e(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Bm(e){return $e([...e],(t)=>ft(t))}function Um(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=Nn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Jm(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=Nn(t);if(p)return p;let h=Bm(t.envAssignments?.values()??[]);if(h)return h}if(l){let p=RR(t);if(p)return p}if(u!==void 0&&a){let p=Nn(t);if(p)return p}let d=xR(u,t.cwd,t.environment.paths);if(d===null){let p=Nn(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...et(i,f)].flatMap((h)=>[...h.envAssignments.values()]).some(Ua)){let h=Nn(t);if(h)return h}return null}if(i.length===0){let p=s.map((g)=>g[0]??"");t.budget.charge("derivedTokens",p.length);let h=Km(f.envAssignments,f.cwd,a);return $e(p,(g)=>t.analyzeNested(g,h))}return $e(et(i,f),(p)=>CR(p,o,t,f))}function CR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(Zm)){let g=Nn(n);if(g)return g}let u=Bm(c);if(u)return u;let m=c.some(B),d=i||m,f=a&&d,p=Km(e.envAssignments,e.wrapperCwd,s||f);if(ie.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return $e(o,(E)=>n.analyzeChild(Ci(l,E,n.budget),nn(e,r)))};if(vt(l))return g();let y=St(l);if(y){if(Xm(y)){let R=zt(n);if(R)return R;if(o.length===0)return null;return $e(o,(A)=>n.analyzeNested(Gm(y,A,n.budget),p))}if(B(y)){if(o.length>0)return $e(o,(Q)=>n.analyzeNested(Gm(y,Q,n.budget),p));let R=kr(y);if(R?.[0]&&L(R[0])==="rm"&&tt(R)){let Q=Fm(n);if(Q)return Q}let A=R?n.analyzeChild(R,{...nn(e,r),dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",Wr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",Lr)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((R)=>pi(J(R===void 0?l:i?l.map((A)=>qm(A,R)):[...l,...R]),y)):[];if(E.some((R)=>R.kind==="dynamic")){let R=zt(n);if(R)return R}let S=E.flatMap((R)=>R.kind==="literal"?[R.source]:[]);if(S.length>0)return n.budget.charge("derivedTokens",S.length),$e(S,(R)=>n.analyzeNested(R,p));if(Nr(y)){let R=zt(n);if(R)return R}let T=n.analyzeNested(y,p);if(T)return T;if(d)return zt(n);return null}let v=bt(J(l));if(v.kind==="dynamic"||v.kind==="literal"&&B(v.source))return zt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=zt(n);if(E)return E;let S=g();if(S)return S;if(i)return null;let T=o.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return n.budget.charge("derivedTokens",T.length),$e(T,(R)=>n.analyzeNested(R,p))}if(d||a)return zt(n)??g();return null}if(e.head==="rm"&&tt(l)){if(i&&o.length>0)return $e(o,(y)=>Ha(Ci(l,y,n.budget,Dm),e.cwd,r));if(o.length>0)return $e(o,(y)=>Ha(zm(l,y,n.budget),e.cwd,r));let g=Ha(l.flatMap((y,v)=>{if(v===0||!B(y))return[y];return y.startsWith("-")?[y.replace(Dm,"")]:[]}),e.cwd,r);if(g)return g;return Fm(n)}let h=o.length>0?o:[void 0];return $e(h,(g)=>{let y=g===void 0?l:i?Ci(l,g,n.budget):zm(l,g,n.budget),v=b("parallel.shell-dynamic",Wr),E=a&&e.head==="find"?ER(y,r):null,S=jm(y,a,n)??E?.customResult??null,T=L(e.head),R=a&&(T==="rm"&&Ba(y)||T==="xargs"&&Vm(y)||E?.rmOptions===!0),A=a&&(R||E?.executedSource===!0||E===null&&$m(y,T)),Q=n.analyzeChild(y,{...nn(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:R,dynamicSourceInput:S!==null||A,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",Lr)});if(A){let re=P(v,n.policy);if(re)return re}return Q??S??ht(y,n.policy?.rules??[])})}function $m(e,t){if(B(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(ie.has(t))return vR(e);if(t==="git")return bR(e);if(t==="find")return!0;if(He.has(t))return Wm(e,fR,Tr);if(Ke(t))return Wm(e,pR,Wo);return!1}function Ba(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(B))return t===-1;return n.some((o)=>B(o)&&(o.startsWith("-")||Xm(o)))}function bR(e){if(SR(e))return!0;let t=Fe(e);if(t.subcommand===null||B(t.subcommand))return!0;if(!Mn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(B))return n===-1;return r.some(B)}function SR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(B(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(B(n))return!0;continue}if(B(n))return!0}return!1}function vR(e){if(vt(e))return!1;let t=St(e);if(t!==null)return B(t);let n=bt(J(e));if(n.kind==="literal")return B(n.source);if(n.kind==="dynamic")return!0;return!e.some(B)}function Wm(e,t,n){let r=n(e);if(r.some((o)=>B(o.value)))return!0;if(!e.some(B))return n([...e,Lm]).some((o)=>o.value===Lm);return di(r,t,(o)=>n(e.map((i)=>qm(i,[o]))))}function jm(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>L(i.command)===L(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(B))return zt(n);return $e(o,(i)=>ht([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function ER(e,t){let n={customResult:null,executedSource:!e.some(B),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(B))return;for(let a of et(i,t))n.executedSource||=$m(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ba(a.tokens)||a.head==="xargs"&&Vm(a.tokens),n.customResult??=jm(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=B(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(yt(a)){i=[],n.executedSource||=B(a);continue}let l=Wt(a);if(l>0){o=l,n.executedSource||=B(a);continue}n.executedSource||=B(a)}return s(),n}function Vm(e){let t=e.slice(sn(e).childStart);return L(t[0]??"")==="rm"&&Ba(t)}function Si(e,t){return(n)=>P(b(e,t),n.policy)}var zt=Si("parallel.shell-dynamic",Wr),RR=Si("parallel.command-stream-dynamic",dR),Nn=Si("parallel.command-stream-dynamic",mR),Fm=Si("parallel.rm-recursive-force-dynamic",Lr);function Ha(e,t,n){return P(mi(J(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Lt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Qt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Km(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function qm(e,t){return e.replace(bi,(n)=>Ym(n,t))}function Ci(e,t,n,r=bi){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Ym(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Gm(e,t,n){return Ci([e],t,n)[0]??""}function zm(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Ym(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function B(e){return e.search(bi)!==-1}function Zm(e){if(Ua(e))return!0;for(let t of e.matchAll(bi))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Ua(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Xm(e){return/^\{[^{}\s]*\}$/.test(e)}function xR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Hm.isAbsolute(e))return null;try{return Mt(t??e,e,n)}catch{return null}}function Jm(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=va(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=va(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||hR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(Nm.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=Nm.has(p)?2:1;continue}if(yR.has(y)){c=!0;let E=v??h;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(gR.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Ua:Zm);let u=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){u.push(p),p=[];continue}if(g!==void 0)p.push(g)}u.push(p)}c||=u.length>1;let m=_R(u),d=n.some(B),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function _R(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>X.derivedTokens.cap)throw new M("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>X.derivedTokens.cap)throw new M("derivedTokens");o.push([...i,s])}t=o}return t}function Qm(e){return Jm(e).childStart}var wR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",vi="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function ja(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function $a(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function tf(e,t,n,r,o=!1,i){let a=(sr(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&fe(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",wR):null;return P(a,i)??nf(e,t,n,o,i)}function nf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>ja(a)?[l]:[]);if(i.length===0)return null;let s=L(t[0]?.text??"");if(s==="git"){let a=xn(e,t),l=PR(a);if(fe(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return P(b("shell.dynamic-structure",vi),o);if(P(ui(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&w(m)==="--");if(fe(o,"shell.dynamic-structure",r)&&c&&Mn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return P(b("shell.dynamic-structure",vi),o);return null}if(s==="find")return fe(o,"shell.dynamic-structure",r)&&TR(t)?P(b("shell.dynamic-structure",vi),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=tt(t.map(w));return fe(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?P(b("shell.dynamic-structure",vi),o):null}if(s==="xargs")return ef(e,t.slice(sn(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return ef(e,t.slice(Qm(t.map(w))),"parallel",n,r,o);return null}function ef(e,t,n,r,o,i){if(t.length===0)return null;let s=AR(t,r);if(sr(e,s)){let l=P(b(`${n}.shell-dynamic`,n==="xargs"?za:Wr),i);if(l)return l}let a=nf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>ja(l)&&$a(l)))return P(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ga:Lr),i);return null}function AR(e,t){let n=Yt(e,t),r=n.rewritten?J(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function PR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(Oe.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function TR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=ja(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||$a(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||$a(s)))return!0;continue}if(t=!0,a)return!0;let l=Wt(s.text);if(l>0){n=l;continue}if(yt(s.text))o=!0,r=!0}return!1}function Va(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!Mo(t[n.tokenIndex],n.value)})}var IR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",kR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",OR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function rf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",IR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",kR);if(e==="shred"&&n.length>0)return b("shred.target",OR);return null}var sf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>mi(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Lt(e.envAssignments,e.options.environment),trustedTmpdirValue:Qt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>ui(e.words,Ka(e))},{heads:new Set(["find"]),analyze:(e)=>Bd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Lt(e.envAssignments,e.options.environment),trustedTmpdirValue:Qt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>an(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>Pm(e.words,{...of(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>an(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Um(e.words,{...of(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>an(e.options.analyzeNested(t,n))})}];function of(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function an(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Ka(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var uf="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function df(e){return sf.find((t)=>t.heads.has(e))?.analyze}function Wn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=Ho(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=Yt(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let x=[...p,...i(f.words)].join(" "),I=ft(x);if(I)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:I.reason}),ve(I);if(n.strict)return Pe(r);let G=Bo(p,i(f.words));if(G){n.budget.charge("derivedTokens",G.length);let ue=n.analyzeNested(G.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(ue)return ue}}let h=f.rewritten?J(i(f.words)):xn(o,f.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>h.length){let x=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),E=g[0];if(!E)return null;if(tn(E))throw new M("wrapperPeelIterations");let S=L(E),T=f.cwd===null?void 0:f.cwd??u,R=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,Q=s?s.allowTmpdirVar:!_r(v,n.environment),re=tf(o,f.words,n.environment,t===0,n.strict,n.policy);if(re)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:re.reason}),ve(re);let ce=oi(g,n.policy);if(ce){for(let x of[ce.childIndex,...ce.alternativeChildIndices]){af(y.wrapperNormalizationBudget);let I=h.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:ce.wrapper,output:i(I)});let G=Wn(I,t,{...y,effectiveCwd:A,envAssignments:v});if(G)return G}return null}let oe=l?void 0:S==="eval"?fi(h):S==="trap"&&!a?vm(h):void 0;if(a&&s&&S==="eval"){if(oe?.kind==="dynamic")return Ln(s,n.policy);if(oe?.kind==="literal"){let x=n.analyzeNested(oe.source,{effectiveCwd:A,envAssignments:v});if(x)return x}return Fn(s,n.policy)}if(oe?.kind==="dynamic"&&(n.strict||!n.commandView||!Wa(n.commandView)))return Pe(r);if(oe?.kind==="literal"){r?.recordSegment({type:"recurse",reason:S==="eval"?"shell-eval":"shell-trap",innerCommand:oe.source,depth:t+1});let x=n.analyzeNested(oe.source,{effectiveCwd:A,envAssignments:v,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?ie.has(S):ff(E,S)){if(vt(g))return null;if(a&&s){let x=St(g);if(x){if(s.dynamicSourceInput??s.dynamicInput){let G=Ln(s,n.policy);if(G)return G}if(Nr(x)){let G=Ln(s,n.policy);if(G)return G}return n.analyzeNested(x,{effectiveCwd:A,envAssignments:v})}let I=bt(h);if(I.kind==="dynamic")return Ln(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?Ln(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?Ln(s,n.policy):null}if(l){let x=St(g),I=x?n.analyzeNested(x,{effectiveCwd:A,envAssignments:v}):bt(h).kind==="dynamic"?Pe(r):null;if(I)return I}if(s===void 0){let x=LR(g,v,A,n,r,t);if(x)return x;let I=St(g);if(I){let fn=pi(h,I);if(fn.kind==="dynamic")return Pe(r);let Fi=fn.kind==="literal"?fn.source:I,bl=WR(Fi);r?.recordSegment({type:"shell-wrapper",wrapper:S,innerCommand:bl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:bl,depth:t+1});let Sl=n.analyzeNested(Fi,{effectiveCwd:A,envAssignments:v});if(Sl)return Sl;return Nr(Fi)?Pe(r):null}let G=bt(h);if(G.kind==="dynamic")return Pe(r);if(G.kind==="literal")return Ei(G.source,A,v,n,r,t);let ue=Em(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(ue.kind==="dynamic")return Pe(r);if(ue.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:ue.source,depth:t+1}),n.analyzeNested(ue.source,{effectiveCwd:A,envAssignments:v})}}if(!s&&(S==="source"||S===".")){let x=g[1]==="-p"?2:null;if(x!==null){let fn=n.commandView?h[x]:void 0;if(!fn)return null;if(fn.provenance!=="literal")return Pe(r)}let I=x===null?1:3,G=g[I]==="--"?I+1:I,ue=n.commandView?h[G]:void 0;if(!ue)return null;if(ue.provenance==="literal")return Ei(ue.text,A,v,n,r,t);if(n.strict||!n.commandView||!Wa(n.commandView))return Pe(r)}if(He.has(S)&&!l){if(!s&&n.strict&&Va(Tr(g),h))return Pe(r);let x=Wd(g,(G)=>an(n.analyzeNested(G,{effectiveCwd:A,envAssignments:v}))),I=P(x,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),ve(I)}if(Ke(S)&&!l){if(!s&&n.strict&&Va(Wo(g),h))return Pe(r);let x=Uu(g);if(a&&s)return DR(S,x,A,v,n,s);if(x){let I=fe(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:S,codeArg:x,paranoidBlocked:I}),I){let ue=P(b("interpreter.one-liner-paranoid",gr),n.policy);if(ue)return ve(ue)}if(ea(S,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let G=n.analyzeNested(x,{effectiveCwd:A,envAssignments:v});if(G&&!mf(G,x))return G;if(hr(x)){let ue=P(b("interpreter.dangerous-command",An),n.policy);if(ue)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:An}),ve(ue)}r=void 0}}if(S==="busybox"&&g.length>1)return af(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),Wn(h.slice(1),t,{...y,effectiveCwd:A,envAssignments:v});let F=s?null:P(rf(S,g),n.policy);if(F)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:F.reason}),ve(F);let be=r===y.trace?y:{...y,trace:r},ze={words:h,head:S,cwd:T,originalCwd:R,envAssignments:v,allowTmpdirVar:Q,dynamicArguments:f.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:be,analyzeChildTokens:(x,I)=>a&&s?qa(x,t,be,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):an(Wn(J(x),t+1,{...be,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:v}))??ht(x,be.policy.rules),analyzeChild:(x,I)=>qa(x,t,be,I)},lt=s&&(S==="xargs"||S==="parallel")?void 0:df(S);if(S==="rm"||S==="xargs"||S==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Q});let je=r&&S==="git"?fm(ze.words,Ka(ze)):void 0,Li=lf(je?je.match:lt?.(ze)??null,n.policy);if(r)FR(ze,Li,je?.relaxation??null);if(Li)return ve(Li);if(a&&s&&(S==="rm"||S==="rmdir")){if(!(S==="rm"&&(tt(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Fn(s,n.policy):null)??NR(s,n.policy)}let yl=lt!==void 0,Cl=!s&&!yl&&!ao.has(S),Wi=r&&Cl?[]:void 0;if(Cl)for(let x=1;x<g.length;x++){let I=g[x];if(!I)continue;Wi?.push(I);let G=lf(MR(g,x,t,be,T,R,A,v),n.policy);if(G)return r?.recordSegment({type:"fallback-scan",tokensScanned:Wi??[],embeddedCommandFound:L(I)}),ve(G)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Wi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&yl)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let jr=ht(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!jr,reason:jr?.reason}),jr)return ve(jr);return a&&s?Fn(s,n.policy):null}function qa(e,t,n,r){return an(Wn(J(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function MR(e,t,n,r,o,i,s,a){for(let l of et(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=L(c);if(ff(c,u)||df(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=qa(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!_r(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function DR(e,t,n,r,o,i){if(!t)return Fn(i,o.policy);if(fe(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=P(b("interpreter.one-liner-paranoid",gr),o.policy);if(a)return ve(a)}if(ea(e,t))return Fn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!mf(s,t))return s;if(hr(t)){let a=P(b("interpreter.dangerous-command",An),o.policy);if(a)return ve(a)}return Fn(i,o.policy)}function mf(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(ti)||e.reason===On)&&!lo(t)}function Ln(e,t){let n=e.shellDynamicMatch?P(e.shellDynamicMatch,t):null;return n?ve(n):null}function Fn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?P(e.dynamicSourceMatch,t):null;return n?ve(n):null}function NR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?P(e.rmDynamicMatch,t):null;return n?ve(n):null}function LR(e,t,n,r,o,i){let s=_m(e);if(s.argvSource?.kind==="absent")return Pe(o);if(s.argvSourceApplies&&s.argvSource){let l=Ei(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Ei(a,n,t,r,o,i,!0)}function Ei(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return Pe(o);let a=pr(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?Pe(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function WR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function FR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function af(e){if(e.iterations>=X.wrapperPeelIterations.cap)throw new M("wrapperPeelIterations");e.iterations++}function ve(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function Pe(e){return e?.recordSegment({type:"error",message:uf}),ve(GR())}function GR(){return{id:"",reason:uf,intent:"stop_and_explain"}}function ff(e,t){return ie.has(t)||e==="$SHELL"||e==="${SHELL}"||ie.has(k(t))}function lf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:P(e,t)}var zR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,HR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function BR(e,t){let n=hf(e,t);if(n.length===0)return!1;let r=n[gf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return zR.test(e.join(" "))}function pf(e,t,n,r,o){if(e.dialect==="powershell"){let g=$R(e.words,o);if(g.kind==="none")return;if(!t||g.kind==="unknown")return null;return cf(qR(g.target),t,n.paths)}let i=e.words.map(w),s=i.some((g)=>/^CDPATH\+?=/.test(g));if(!BR(i,n))return s?null:void 0;if(!t)return null;let a=hf(i,n,t),l=gf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((g)=>g.length<=1||!g.startsWith("-")||g==="--");if((u===-1?c:c.slice(0,u)).some((g)=>!/^-[LP]+$/.test(g)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length!==1)return null;let p=f[0]??"",h=e.words.some((g)=>g.provenance==="variable"&&g.text===p)?UR(p,r):p;if(h===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(h)&&(s||n.env.has("CDPATH")))return null;return cf(h,t,n.paths)}function UR(e,t){let n=Or(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function cf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return Mt(t,e,n)}catch{return null}}function $R(e,t){let n=jR(e[0])?1:0,r=e[n];if(!VR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!HR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return KR(e.slice(n+1),t)}function jR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function VR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function KR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function qR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function gf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function hf(e,t,n){let r=YR(e);return Dt([...r],t,n)}function YR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var ZR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",ln="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Qa(e,t,n,r){if(t>=X.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:rt}),{reason:rt,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??qe(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:rt}),{reason:rt,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Ja(e,n);let u=`${ti}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return Ef(e,n),{reason:On,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Ef(e,n),{reason:On,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Ja(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=em(n.environment.env,n.envAssignments);return _i(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function _i(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,d=XR(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=f||zn(m);if(c.kind==="function"){let re=h.flatMap((oe)=>{let K=Hn(oe);return K.functionDefinitions.set(c.name,c.body),Ya(oe,[K],d,m==="&",zn(m))}),ce=Za(re,[],g,y,a,m);i=ce.states,s=ce.conditionalStates,a=void 0;continue}if(c.kind==="group"){let re=[],ce=[];for(let K of h){let F=_i(c.body,t,n,r,[Hn(K)]);if(F.result)return F;if(re.push(...Ya(K,F.states,d,m==="&",zn(m))),v)ce.push(K,...d?F.states.map((be)=>Ri(K,be)):F.states)}let oe=Za(re,ce,g,y,a,m);i=oe.states,s=oe.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),S=e.nodes[l-2],T=wi(a)&&S?.kind==="command"?Sm(S)??QR(S):void 0,R=[],A=[];for(let re of h){let ce=ex(c,t,n,r,[Hn(re)]);if(ce.result)return{result:ce.result,states:i};let oe=e.dialect==="powershell"?ce.states:ce.states.map((K)=>Ri(re,K));for(let K of oe){let F=Hn(K),be=rx(c,t,n.trace?{...n,trace:Rf(n.trace,E)}:n,r,F,wi(a),T);if(be)return{result:be,states:i};let ze=bx(c,F.functionDefinitions);if(ze)n.budget.charge("derivedTokens",Ai(ze));let lt=ze?t+1>=X.recursionDepth.cap?Xa(c.displayText,n,[F]):_i(ze,t+1,n,r,[F]):{result:null,states:yx(c,F)};if(lt.result)return lt;if(R.push(...Ya(re,lt.states,d,m==="&",zn(m))),v)A.push(re),A.push(...lt.states.map((je)=>d?Ri(re,je):je))}}let Q=Za(R,A,g,y,a,m);i=Q.states,s=Q.conditionalStates,a=void 0}return{result:null,states:i}}function XR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(wi(r)||wi(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&JR(e,t)}function Ya(e,t,n,r,o){let i=n?t.map((a)=>Ri(e,a)):[...t],s=o?i.flatMap((a)=>Gn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function Ri(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function JR(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(tx(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function wi(e){return e==="|"||e==="|&"}function QR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function zn(e){return e==="&&"||e==="||"}function Za(e,t,n,r,o,i){let s={success:xi([...n,...e]),failure:xi([...r,...t])},a=zn(i)?s:void 0;return{states:zn(o)||a?xi([...s.success,...s.failure]):s.success,conditionalStates:a}}function Rf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function ex(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=nx(e);if(s){if(t+1>=X.recursionDepth.cap)return Xa(s,n,o);let a=qe(s,"powershell");if(a.status==="limited")return Xa(s,n,o);if(a.status!=="complete")return yf(i,n,r,o);n.budget.charge("derivedTokens",Ai(a)),i.push({program:a,depth:t+1})}}return yf(i,n,r,o)}function tx(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function yf(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=_i(i.program,i.depth,t,n,[Hn(a)]);if(l.result)return l;s.push(...l.states)}o=xi(s)}return{result:null,states:o}}function nx(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function Ai(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+Ai(o),0):n.kind==="group"||n.kind==="function"?Ai(n.body):0),0)}function Xa(e,t,n){return t.trace?.recordSegment({type:"error",message:rt}),{result:{reason:rt,segment:e,intent:"stop_and_explain"},states:[...n]}}function rx(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=ux(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};xf(e,o,"before-consumer",a.environment.paths,a.budget);let c=xn(e.dialect,e.words),u=c.map(w),m=e.displayText,d=Qd(c,o.shellGitContextState),f=nm(d,o.shellGitContextState);if(e.dialect==="powershell"){let g=P(Td(e,i,vx(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!g,reason:g?.reason}),g)return Sx(m,g)}if(u.length===1&&u[0]?.includes(" ")&&!sr(e.dialect,e.words)){let g=P(ft(u[0]),a.policy),y=g!==null&&!a.strict&&Gu(e,a.rootProgram);if(g&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:g.reason}),{reason:g.reason,segment:m,ruleId:g.id,intent:g.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let v=Cf(e,l,o,f,s,a);if(v)return v;return ka(d,o.shellGitContextState),null}let p=Wn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(g,y)=>{let v=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=Qa(g,t+1,{...a,effectiveCwd:v,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?Rf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:m};let h=Cf(e,l,o,f,s,a);if(h)return h;return ka(d,o.shellGitContextState),null}function Cf(e,t,n,r,o,i){let s=dx(e,t,n,r??new Map,i);if(s)return s;return xf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),sx(e,t,n,i.environment.paths,i.budget),px(e,n,o,i.environment,i.trace),null}var ox=new Set([">>","<>"]);function xf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?ix(s):ox.has(s.operator)))continue;bf(s.target,t,r,o)}if(n!=="before-consumer"||!Ge(e.words[0],"tee"))return;let i=_f(e.words.slice(1));if(!i)return;for(let s of i.operands)bf(s,t,r,o)}function ix(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function bf(e,t,n,r){let o=e?.provenance==="literal"?pr(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function sx(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!Pi(i))return;for(let s of ax(e)){let a=pr(s.text,n.effectiveCwd,r,o);if(!a||!Hu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=X.trackedHeredocFiles.cap)throw new M("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function ax(e){let t=cx(e.redirections)?.target,n=Sf(t)?[t]:[];if(Ge(e.words[0],"cat"))return lx(e.words)?n:[];if(!Ge(e.words[0],"tee"))return[];let r=_f(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(Sf))return[];return[...r.operands,...n]}function lx(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function cx(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function _f(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&Ge(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function Sf(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function Ge(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Pi(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function ux(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return ln;let n=t[0];if(!n?.heredoc)return ln;if(!Pi(n.heredoc))return ZR;if(n.fd!==void 0&&n.fd!==0)return ln;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return ln;let r=e.redirections.some((s)=>s!==n&&vf(s.target));if(Ge(e.words[0],"cat"))return r?ln:void 0;if(Ge(e.words[0],"tee"))return r||e.words.slice(1).some(vf)?ln:void 0;let o=e.words[0],i=e.words[1];if(Ge(o,"git")&&(Ge(i,"apply")||Ge(i,"commit")))return;if(Ge(o,"gh")&&(Ge(i,"pr")||Ge(i,"issue"))&&Ge(e.words[2],"create"))return;return ln}function vf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function dx(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(fx(e,i,n,r,o))return null;let a=mx(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Ja(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function mx(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Pi(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Ke(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=fe(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=P(b("interpreter.one-liner-paranoid",gr),n.policy);if(c)return c}if(!hr(s))return null;let l=P(b("interpreter.dangerous-command",An),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function fx(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Pi(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Yt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=L(a[0]??"");if((s.envSplitValues?.length??0)>0||!ie.has(l)&&!ie.has(k(l)))return!1;return vt(a)}function px(e,t,n,r,o){let i=pf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var gx=/^[A-Za-z_][A-Za-z0-9_]*$/,hx=8;function yx(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!gx.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=hx&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=Hn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function Hn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:tm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function xi(e){let t=[];for(let n of e){if(!t.some((r)=>Cx(r,n)))t.push(n);if(t.length>X.controlFlowStates.cap)throw new M("controlFlowStates")}return t}function Cx(e,t){return e.effectiveCwd===t.effectiveCwd&&Gn(e.shellGitContextState.env,t.shellGitContextState.env)&&Gn(e.literalHeredocFiles,t.literalHeredocFiles)&&Gn(e.functionDefinitions,t.functionDefinitions)&&Gn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Gn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function Gn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function bx(e,t){let n=ar(e);return n===void 0?void 0:t.get(n)}function Sx(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function vx(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Ja(e,t){let n=P(ft(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Ef(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:On},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var Ex=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function wf(e,t,n,r){let o=Qa(e,0,{...t,...au(t),budget:t.budget??de(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function Af(e,t,n){try{return{decision:e()}}catch(r){let o=Rx(r,t,n);if(!o)throw r;return o}}function Rx(e,t,n){if(!(e instanceof M)||!Ex.has(e.kind))return null;let r=X[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var xx=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),tl=new Set(["cc-safety-net","ccsn"]),_x=new Set(["bunx","npx","pnpx"]),wx=new Set(["pnpm","yarn"]),Ax=new Set(["npm","pnpm","yarn"]),Px=new Set(["bun","node"]);function Ii(e,t,n={}){if(tl.has(e))return 0;if(_x.has(e)){if(n.broad)return el(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return Ti(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&Ax.has(e)&&n.broad&&t[r]==="exec"){let o=el(t.slice(r+1));return o===null?null:r+1+o}if(wx.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&Ti(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=el(t.slice(r+1));return o===null?null:r+1+o}if(Px.has(e)){let o=n.broad&&r!==-1?r:0;if(Pf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Pf(t[o+1]))return o+2}return null}function el(e){let t=e.findIndex((r)=>Ti(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!Ti(r))break;n++}return n}function Ti(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return tl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return tl.has(e.slice(0,t))}function Pf(e){let t=e?.replaceAll("\\","/");return[...xx].some((n)=>t===n||t?.endsWith(`/${n}`))}var Tf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function If(e,t,n){let r=we(e,"input-candidate");if(!r)return null;let o=Tn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>Tx(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function Tx(e,t){let n=Dt([...e],t),r=n.slice(1),o=Ii(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}var Fr=require("node:path");var Df="This path contains the protected policy config and you must not modify or delete it.",Ix=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Nf(e,t,n){let r=Lx(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return kf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=we(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Of(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Of(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return kf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Yr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function kf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>Gr(a,n,r,o,i));return s?{target:s}:null}function Of(e,t,n,r,o){let i=Tn(e,t,r,o,{findSegmentTarget:(s,a)=>kx(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>Gr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>Nx(s,t,n,r,o)?.target??null});return i?{target:i}:null}function kx(e,t,n,r,o){if(Er(e))return null;let i=Zt([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&Ox(a)){let l=Mx(a).find((c)=>Mf(_e(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(ai(i,1)||Ra(i,r)){let c=(si(J(i))??J(["."])).find((u)=>{let m=_e(u.text,t.variables);return Gr(m,t.cwd,n,r,o)||Mf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=qo(a).sources.find((c)=>Wx(_e(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(Dx(i,s))return null;for(let l of[...e,...i])for(let c of Lf(l))if(Gr(_e(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function Ox(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function Mx(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function Dx(e,t){if(!Ix.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function Nx(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Lf(i))if(Gr(s,t,n,r,o))return{target:s};return null}function Lf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function Lx(e,t,n){let r=(a)=>zr(he(a,e.executionCwd,t,n)),o=r(Cn(t)),i=[r(er(e.executionCwd)),r(er(e.configCwd))],s=new Set(i.map((a)=>Fr.dirname(a)));for(let a=Fr.dirname(o);;a=Fr.dirname(a))if(s.add(a),Fr.dirname(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function Gr(e,t,n,r,o){let i=_l(e,t,r,o,(s)=>zr(s)===io);return i!==null&&n.files.has(zr(i))}function Mf(e,t,n,r,o){return n.directoriesAndAncestors.has(zr(he(e,t,r,o)))}function Wx(e,t,n,r,o){let i=zr(he(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function zr(e){return process.platform==="win32"?e.toLowerCase():e}var Te=require("node:path"),Vf=require("node:url");var Kf="Access to a sensitive path is not allowed.",qf=new Set(["echo","printf"]),Fx=new Set(["find"]),Gx=new Set(["-exec","-execdir"]),zx=new Set([";","+"]),Hx=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),Bx=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Yf=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),Ux=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),$x=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Zf=new Set(["-c","-e","-r","-E","--eval","--exec"]),jx=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),Vx=new Set(["grep","rg"]),Wf=new Set(["jq","gojq","jaq"]),Ff="f",Gf="file",Kx="files",qx=new Set(["e","f"]),Yx=new Set(["regexp","file"]),Zx=new Set(["e","f","A","B","C","m"]),Xx=new Set(["regexp","file","after-context","before-context","context","max-count"]),nl="__CC_SAFETY_NET_PIPE_INPUT__",ol=/[\w./~@+-]*[./~][\w./~@+-]*/g,Jx=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,Qx=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,e_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,t_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,n_=/\b(?:system|exec)\s*$/,r_=/\b(?:eval|exec)\s*\(/g,o_=/\b(?:eval|exec)\s*$/,i_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function zf(e,t,n,r,o,i){for(let s of e){let a=s.target;if(rw(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=tw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&ow(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Xf(e,t,n,r,o={}){let i=Hf(e,n,r),s=zf(i,t,e.invocation.context.configCwd,n,r);if(s===null)return null;let a=s.ruleId!=="secret.deny-path"&&o.strict===!1?Hf(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:zf(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&s_(e,n))return null;return l}function s_(e,t){let n=we(e,"input-candidate")??we(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of Ko(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(gt(a.text,t))}let o=Ht(r);if(o.length===0)return!1;let i=xt(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>Hx.has(a))}function Hf(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=we(e,"input-candidate");return[...s?Bn(s.shell,e.store,r,t,o,n,a_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function a_(e){return e.program.dialect==="powershell"}function Bn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Je;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...W_(gt(e.source,r),t,n,r,o,i)],l=(c)=>gt(C_(c,s),r);return Vo(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...Oi(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...c_(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Jf(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>u_(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return aa;return a.push({target:l(c.target),cwd:u.cwd}),null}}),a}function il(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Je;return s.status==="complete"?Bn(s,t,n,r,o,i):null}function Oi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(Wf.has(xt(Ht(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...Oi(p,t,n,r,o,i)]}let l=y_(e).map(a),c=Ht(e);if(c.length===0)return l;let u=c[0]??"",m=xt(u).toLowerCase(),d=c.slice(1),f=l_(u,m,d);if(f)return[...l,...f.map(a)];if(qf.has(m))return n.capturedOutput===!0?[...l,...Qf(e).map(a)]:l;if(m==="eval")return[...l,...il(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:Rt(m,p)).map(a)];if(m==="git")return[...l,...S_(d).map(a)];if(Wf.has(m))return[...l,...b_(d).map(a)];if(Vx.has(m))return[...l,...j_(d).map(a)];if(Fx.has(m))return[...l,...x_(d,t,n,r,o,i).map(a)];if(He.has(m))return[...l,...d.flatMap((p)=>Rt("awk",p)).map(a),...d.flatMap((p)=>w_(p,t,n,r,o,i)),...d.flatMap(A_).map(a)];if(m==="curl")return[...l,...d.flatMap((p)=>Rt(m,p)).map(a),...v_(d).map(a)];if(Rr(m)){let p=vr.has(m)?Me([m,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new Je;if(h.status==="complete")return[...l,...Bn(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...__(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>Rt(m,p)).map(a)]}function l_(e,t,n){let r=Ii(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function c_(e,t,n,r,o,i,s){if(p_(t,n,r,o,i,s))return Qf(e).map((a)=>({target:a,cwd:i}));return Jf(t,d_(e),n,r,o,i,s,()=>[])}function u_(e,t,n,r,o,i,s){let a=Ht(e);if(!Rr(xt(a[0]??"").toLowerCase()))return[];return il(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Jf(e,t,n,r,o,i,s,a){let l=g_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>vr.has(l)?Bn(n.getShellSyntax(c),n,r,o,i,s):ki(l,c,n,r,o,i,s))}function Qf(e){let t=Ht(e);if(t.length===0)return[];let n=xt(t[0]??"").toLowerCase();if(!qf.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[sl(r.replaceAll("%%","%"))];return t.slice(1)}function d_(e){let t=Ht(e);if(t.length===0)return[];let n=xt(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return m_(r);return[]}function m_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[sl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>f_(t,r.slice(i*n,(i+1)*n)))}function f_(e,t){let n=0;return sl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function sl(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function p_(e,t,n,r,o,i){let s=Ht(e);if(s.length===0||xt(s[0]??"").toLowerCase()!=="xargs")return!1;let a=sn(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,nl]:l.map((m)=>m.split(c).join(nl));return Oi(u,t,n,r,o,i).some((m)=>m.target.includes(nl))}function g_(e){let t=Ht(e);if(t.length===0)return null;let n=xt(t[0]??"").toLowerCase();if(!Rr(n))return null;return h_(n,t.slice(1))?n:null}function h_(e,t){let n=al(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Zf.has(o)||ep(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(i_.get(n)?.has(o))r++;continue}return!1}return!0}function al(e){return/^python\d/.test(e)?"python":e}function y_(e){let t=[];for(let n of e){if(np(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Bf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function C_(e,t){if(!t||!Bf.test(e))return e;return`~${e.replace(Bf,"").replace(/\\/g,"/")}`}function Rt(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function b_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Rt("jq",i))}return e.flatMap((r,o)=>o===t?[]:Rt("jq",r))}function S_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>Rt("git",i))];if(t.push(...Rt("git",r)),!Oe.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Rt("git",o)),n++}return t}function v_(e){return e.flatMap((t,n)=>{let r=R_(t);if(r!==null)return Uf(r.flag,r.value);let o=E_(e[n-1]);return o===null?[]:Uf(o,t)})}function Uf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return rl(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return rl(t.slice(n+1))}return t.startsWith("@")?rl(t.slice(1)):[]}function E_(e){if(e===void 0)return null;if(Yf.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function R_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Yf.has(r)?{flag:r,value:e.slice(n+1)}:null}function rl(e){return e===""||e==="-"?[]:[e]}function x_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!Gx.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>zx.has(f)),m=u===-1?c:c.slice(0,u),d=Oi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,h)=>{if(!Bx.has(f))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function __(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Zf.has(c)||ep(e,c)){let m=t[l+1];if(m!==void 0)a.push(...ki(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...ki(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function ep(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return jx.get(t[t.length-1]??"")?.has(al(e))??!1}function w_(e,t,n,r,o,i){if(!e.includes("system"))return[];return ba(e)?.commands.flatMap((s)=>Bn(t.getShellSyntax(s),t,n,r,o,i))??[]}function A_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function P_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(ll),...e.match(ol)??[]]}function ki(e,t,n,r,o,i,s){let a=(f)=>({target:f,cwd:i}),l=I_(t,T_(e));if(l===null)return P_(t).map(a);let c=l.masked.match(t_)!==null||l.literals.some((f)=>n_.test(l.masked.slice(0,f.start))),u=l.masked.match(r_)!==null||l.literals.some((f)=>o_.test(l.masked.slice(0,f.start))),m=r.refineInlineData===!0&&!vr.has(e),d=m&&!(D_(l.masked)||c||u)?[]:l.literals;return[...d.map((f)=>f.text).filter((f)=>f!=="").map(a),...d.flatMap((f)=>ll(f.text)).map(a),...m?[]:l.literals.flatMap((f)=>f.text.match(ol)??[]).map(a),...c?l.literals.flatMap((f)=>il(f.text,n,r,o,i,s)??[a(f.text)]):[],...u?l.literals.flatMap((f)=>ki(e,f.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
+`:h),n,r,o,i,s)):[],...(l.masked.match(ol)??[]).map(a)]}function T_(e){let t=al(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function I_(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(Qx.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&M_(e,o))return null;let a=t==="python"?k_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=O_(e,c,l);if(u===null)return null;let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&e_.test(m))return null;r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function k_(e,t){return Jx.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function O_(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function M_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function D_(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(Ux.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>$x.has(i)))continue;if(o.length>1)return!0;if(N_(e,r)===".")return!0;if(L_(e,r+n.length)==="(")return!0}return!1}function N_(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function L_(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function W_(e,t,n,r,o,i){return B_(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Bn(a,t,{...n,capturedOutput:!0},r,o,i),...F_(a,r)?G_(a,r).map((l)=>({target:l,cwd:o})):[]]})}function F_(e,t){let n=Ko(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||xt(gt(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=gt(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function G_(e,t){return Ko(e).flatMap((n)=>n.kind==="word"?[gt(n.text,t)]:n.kind==="redirection"&&n.target?[gt(n.target,t)]:[]).flatMap(ll)}function ll(e){let t=H_(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||z_(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function z_(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function H_(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function B_(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(tr(o,n))continue;if(tp(e,r,n)){let i=U_(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=$_(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function U_(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(tr(i,n))continue;if(tp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function $_(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function tp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function j_(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===Kx)o=!0;if(Yx.has(m))r=!0;if(d!==void 0){if(m===Gf)t.push(d);continue}if(Xx.has(m)){let f=e[l+1];if(m===Gf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let h=0;h<m.length;h++){let g=m[h]??"";if(qx.has(g))r=!0;if(Zx.has(g)){d=g,f=m.slice(h+1);break}}if(d==="")continue;if(f.length>0){if(d===Ff)t.push(f);continue}let p=e[l+1];if(d===Ff&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Ht(e){let t=e.findIndex((n)=>!np(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function np(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var V_=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),K_=".env.",q_=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Y_=[".env.example.",".env.sample."];function Z_(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function X_(e){return e.length>0&&!/\s/.test(e)}function J_(e,t,n,r){try{let o=Ur(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof M)throw o;return!1}}var Q_=new Set(["node_modules","__pycache__"]),ew=[["vendor","bundle"],["vendor","cache"]];function tw(e,t,n,r,o){if(Z_(e))return null;let i=st(e,t,r,o);if(!i)return null;let s=V(i.split("/").pop()??""),a=V(i),l=()=>X_(s)||J_(e,t,r,o);if(q_.has(s)||Y_.some((d)=>s.startsWith(d)))return null;let c=V(aw(e,t,r,o));for(let d of Ss){let f=`~/${d.suffixParts.join("/")}`;if((jf(a,f)||jf(c,f))&&Et(d.id,n))return d.id}let u=nw(i,t,n,r,o);if(u)return u;if(V_.has(s))return null;for(let d of bs)if(s===d.basename&&Et(d.id,n))return d.id;if(s.startsWith(K_)&&Et(mo.id,n)&&l())return mo.id;for(let d of vs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&Et(d.id,n)&&l())return d.id}for(let d of Es)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&Et(d.id,n))return d.id}if(iw(a))return null;if(!s.includes(".")&&rr.pattern.test(s)&&Et(rr.id,n))return rr.id;let m=sw(s,n);if(m)return m;return null}function nw(e,t,n,r,o){return fo.find((i)=>{if(!Et(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return H(e,j(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=V(e).split("/");return H(e,j(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Br(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return H(e,st("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=j(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return H(e,s,["auth.json",".credentials.json"])||Hr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=j(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=V(e).split("/").at(-1)??"";return H(e,s,["config.toml"])||a.endsWith(".config.toml")&&H(e,s,[a])}case"secret.cli.gemini":return H(e,Ce(j(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=V(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[Ce(j(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return H(e,Ce(j(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Br(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>H(e,st(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=j(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return H(e,s,["config.json"])||Hr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return H(e,j(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=j(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=j(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return H(e,s,["server.token"])||Hr(e,s,["credentials"])||Hr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=V(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||H(e,j(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||H(e,j(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=Ce(j(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=V(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return H(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&H(e,s,[a])||c.some((u)=>Br(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?j(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):Ce(j(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[Ce(j(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(V(e).split("/").at(-1)??"")||H(e,s,l)||(c?.trim()?Br(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>H(e,st(u,t,r,o),l))}case"secret.cli.pi":return H(e,j(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return H(e,j(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=st("~",t,r,o);return[Ce(j(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),Ce(s,".local","share","amp")].some((l)=>H(e,l,["secrets.json"]))||Hr(e,Ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[Ce(j(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),Ce(st("~",t,r,o),".config","amp")],l=V(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>H(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Br(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=Ce(j(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=Ce(j(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return H(e,st("~/.cursor",t,r,o),["auth.json"])||H(e,s,["auth.json"])||V(e).split("/").at(-1)==="mcp-auth.json"&&cn(V(e),V(a))}case"secret.cli.cursor.config":{let s=V(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return H(e,j(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=V(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||H(e,j(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||H(e,st("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var $f=new WeakMap;function j(e,t,n,r,o){let i=$f.get(o)??new Map;$f.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=st(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function H(e,t,n){return n.some((r)=>rp(e,Ce(t,r)))}function Hr(e,t,n){return n.some((r)=>cn(V(e),V(Ce(t,r))))}function Br(e,t,n,r,o){return rp(e,st(t,n,r,o))}function rp(e,t){return V(e)===V(t)}function Ce(e,...t){return nt([e,...t].filter(Boolean).join("/"))}function rw(e,t,n,r,o,i){if(n.length===0)return!1;let s=V(Ur(e,t,o,i));return n.some((a)=>cn(s,V(Ur(a,r,o,i))))}function ow(e,t,n,r,o,i){if(n.length===0)return!1;let s=V(Ur(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?nt(D(ke(a),o.paths,i)):"",c=V(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=V(u?nt(D(Te.resolve(ke(u)),o.paths,i)):l&&nt(D(`${l}/.cc-safety-net`,o.paths,i)));if(m&&cn(s,m))return!1;return n.some((d)=>{let f=V(Ur(d,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return cn(s,f)})}function iw(e){let t=e.split("/");return t.some((n)=>Q_.has(n))||ew.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function sw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Rs)if(r===o.extension&&Et(o.id,t))return o.id;for(let o of xs)if(o.pattern.test(r)&&Et(o.id,t))return o.id;return null}function V(e){return e.toLowerCase()}function Et(e,t){return!t?.disabledRules?.includes(e)}function st(e,t,n,r){let{home:o,normalized:i}=cl(e,n,r);if(!i)return"";if(!o)return i;let s=ul(i,o),a=Te.isAbsolute(s)?s:nt(Te.resolve(t,s)),l=nt(D(a,n.paths,r));if(!cn(l,o)){if(Te.isAbsolute(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function jf(e,t){return e===t||e.startsWith(`${t}/`)}function aw(e,t,n,r){let{home:o,normalized:i}=cl(e,n,r);if(!i||!o)return"";let s=ul(i,o),a=Te.posix.normalize(Te.isAbsolute(s)?s:nt(Te.resolve(t,s))),l=nt(ke(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&cn(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function Ur(e,t,n,r){let{home:o,normalized:i}=cl(e,n,r);if(!i)return"";let s=o?ul(i,o):i;return nt(D(Te.isAbsolute(s)?s:Te.resolve(t,s),n.paths,r))}function cl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?nt(D(ke(r),t.paths,n)):"",i=nt(ke(lw(gt(e,t))));return{home:o,normalized:i}}function lw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return Vf.fileURLToPath(e)}catch{return e}}function ul(e,t){if(e==="~")return t;if(e.startsWith("~/"))return Ce(t,e.slice(2));return e}function cw(e){if(process.platform==="win32")return!0;return Te.win32.parse(e).root.length>1}function nt(e){let t=e.trim(),n=(t.includes("\\")&&cw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function cn(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function xt(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class un extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var uw={findPolicyMutation:Nf,findGitMetadataMutation:gd,resolveGitMetadata:dw,loadPolicySnapshot:su,findSensitiveTarget:Xf,analyzeCommand:wf,getModes:ts};function op(e,t){let n={...uw,...t.dependencies},r=pw(e),o=$r(e)?e.command:r,i=Bt("policy-protection",o,()=>xr(e)),s=we(i,"input-candidate"),a=we(i,"declared-command");if($r(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:rt,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Id,intent:"stop_and_explain"}};let l=de(),c=Bt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=Bt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Df,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=Bt("policy-protection",o,()=>If(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Tf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let d=Bt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ue,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let f=Bt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...mw(f)},y=p.secretProtection.enabled===!1?null:Bt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:$r(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:Kf,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!$r(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...dl("command-validation",o),...g};let v=Bt("command-analysis",o,()=>Af(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},fw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function dw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function mw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function fw(e){return we(e,"declared-command")?.program}function pw(e){try{return At(e.input)}catch(t){let n=$r(e)?e.command:void 0;throw new un("policy-protection",dl("policy-protection",t instanceof Se?void 0:n,t),t)}}function Bt(e,t,n){try{return n()}catch(r){throw new un(e,dl(e,r instanceof Se?void 0:t,r),r)}}function dl(e,t,n){let r=n instanceof M||n instanceof Je;return{stage:e,decision:{kind:"deny",reason:r?zi:qn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function $r(e){return e.route.kind==="command"}var Di=require("node:fs"),$n=require("node:path");var le=require("node:fs"),Un=require("node:path");function ip(e,t={}){return vo(Cn(e,t),e.home).policy.audit.retention_days}var fl=86400000,gw=".last-prune",hw=/^\d{4}-\d{2}$/,yw=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,sp=(e)=>Math.floor(e/fl);function lp(e,t,n=()=>new Date){try{let r=n().getTime();if(!le.statSync(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Un.join(t,gw),i=le.statSync(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&sp(i)===sp(r))return;let s=r-ip(e)*fl,a=new Date(r).toISOString().slice(0,7);for(let l of ml(t)){if(l.isDirectory()){Cw(Un.join(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))bw(Un.join(t,l.name),s)}le.writeFileSync(o,"",{mode:384}),le.utimesSync(o,r/1000,r/1000)}catch{}}function Cw(e,t,n){for(let r of ml(e)){if(!r.isDirectory()||!hw.test(r.name))continue;let o=Un.join(e,r.name);for(let i of ml(o)){if(!i.isFile())continue;let s=yw.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+fl;if(!Number.isFinite(a)||a>=t)continue;cp(Un.join(o,i.name))}if(r.name!==n)ap(o)}ap(e)}function bw(e,t){try{let n=le.lstatSync(e);if(n.mtimeMs>=t)return;let r=le.readFileSync(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(Sw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(le.lstatSync(e).mtimeMs!==n.mtimeMs)return;cp(e)}catch{}}function Sw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function ml(e){try{return le.readdirSync(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function cp(e){try{le.unlinkSync(e)}catch{}}function ap(e){try{le.rmdirSync(e)}catch{}}var vw="2.4.5",Ew=1e4,Rw=2000,xw=256,_w=32768;function ww(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function Aw(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function pl(e,t,n,r,o,i,s={}){let a=ww(t);if(!a)return;let l=Tw(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=Mi(_t(n),s.failureStage?Number.POSITIVE_INFINITY:Ew),m=Mi(_t(r),Rw),d=s.toolName?Mi(_t(s.toolName),xw):void 0,f=i===null?void 0:Mi(_t(i),_w),p=$n.join(l,Aw(f?.value??null),c.slice(0,7));Di.mkdirSync(p,{recursive:!0,mode:448});let h=$n.join(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??rs)(),v:vw,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Di.appendFileSync(h,`${JSON.stringify(g)}
+`,{encoding:"utf-8",mode:384}),lp(e,l,s.now)}catch{}}function Mi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function Pw(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&$n.isAbsolute(n)?n:null}function Tw(e){let t=Pw(e);return t?$n.join(t,".cc-safety-net","logs"):null}function dp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=up(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?up(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function up(e){return"command"in e?e.command??"":""}function mp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;pl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function fp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;pl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function gp(e,t,n){try{let r=op(t,{environment:e,...n.guard});return pp(e,t,r,n),r}catch(r){if(!(r instanceof un))throw r;throw pp(e,t,r.evaluation,n,!(r.cause instanceof Se),{stage:r.stage,errorCode:Iw(r.cause)}),r}}function pp(e,t,n,r,o=!0,i){mp(e,dp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function Iw(e){if(e instanceof M)return X[e.kind].errorCode;if(e instanceof Se)return"tool-input-limit";if(e instanceof Je)return"structural-shell-syntax-limit";return"unexpected-error"}var at=(e,t,n,r,o)=>Ul(e.cwd,t,n,r,o.paths,process.cwd());function kw(e,t){console.log(JSON.stringify(e(vl(t))))}async function Ow(e){let t;try{t=(await Bl(process.stdin)).trim()}catch{e({reason:"Failed to parse hook input JSON."});return}if(!t){e({reason:"Missing hook input JSON."});return}return Jr(t,e,"Failed to parse hook input JSON.")}async function Mw(e){let t=Ql(),n=await Ow(e.outputDeny);if(n===void 0)return;if(!n||typeof n!=="object"||Array.isArray(n)){ee(e.outputDeny);return}if(!e.isSupported(n))return;let r=e.getAgent?.(n,t)??e.agent,o=e.agent===r?void 0:e.agent,i=Ww(n),s=(p,h)=>{fp(t,p,()=>e.getSessionId(n),{agent:r,shape:o,toolName:h,cwd:i}),e.outputDeny(p)},a=e.getToolName(n);if(typeof a!=="string"||a.trim()===""){ee((p)=>s(p),Lw(n));return}let l=a,c=(p)=>s(p,l),u;try{u=e.getToolInput(n,l,c,t)}catch(p){if(!(p instanceof Se))throw p;ee(c,void 0,l);return}if(!u.ok)return;let m=e.getContext(n,u.input,l,c,t);if(!m)return;let d;try{d=At(u.input)}catch(p){if(!(p instanceof Se))throw p;ee(c,void 0,l);return}let f=Jn(l,u.input,u.route,m,d??null);try{let p=gp(t,f,{guard:{auditAllowed:ec(t.env),dependencies:e.guardDependencies},audit:{agent:r,shape:o,getSessionId:()=>e.getSessionId(n)}}),h=Hi(p,{includeEvidence:!0,toolName:p.stage==="command-analysis"?void 0:l});if(h){e.outputDeny(h);return}e.outputAllow?.()}catch(p){if(!(p instanceof un))throw p;Dw(p,t.env);let h=Hi(p.evaluation,{includeEvidence:!0,toolName:p.evaluation.stage==="command-analysis"?void 0:l});if(h)e.outputDeny(h);return}}function Dw(e,t){if(!$t(ae.debug,t))return;console.error(`CC Safety Net debug: ${Nw(e.stage)}: ${El(e.cause)}`)}function Nw(e){if(e==="policy-protection")return"hook policy protection failed";if(e==="config-load")return"hook config loading failed";if(e==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function Lw(e){if(!e||typeof e!=="object"||Array.isArray(e))return;if(Object.hasOwn(e,"tool_input"))return e.tool_input;let t=e.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function Ww(e){if(!e||typeof e!=="object"||Array.isArray(e))return null;let t=e.cwd;if(typeof t==="string")return t;let n=e.toolCall;if(!n||typeof n!=="object"||Array.isArray(n))return null;let r=n.args;if(!r||typeof r!=="object"||Array.isArray(r))return null;let o=r.Cwd;return typeof o==="string"?o:null}async function Ie(e){let t=(o)=>kw(e.createDenyOutput,o),n=e.createAllowOutput,r=n?()=>console.log(JSON.stringify(n())):void 0;try{await Mw({...e,outputDeny:t,outputAllow:r})}catch(o){console.error("CC Safety Net error:",o),t(pn())}}var Fw=new Map([["run_command","auto"]]),Gw=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function hp(e){return se(e,Fw)}async function yp(){await Ie({agent:"antigravity-cli",createDenyOutput:(e)=>({decision:"deny",reason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolCall?.name,getToolInput:(e,t)=>({ok:!0,input:$w(e.toolCall?.args,t),route:hp(t)}),getContext:zw,getSessionId:(e)=>e.conversationId})}function zw(e,t,n,r,o){let s=Uw(e,o.paths).flatMap((u)=>{let m=it([u],o.paths);return m?[m]:[]});if(!s[0])return dn(r,t,n),null;if(n!=="run_command"){let u;try{u=Hw(t,n,s,o.paths)}catch(m){if(m instanceof Se)return dn(r,void 0,n),null;if(!(m instanceof M))throw m;return dn(r,t,n),null}if(!u)return dn(r,t,n),null;return{configCwd:u,executionCwd:u}}let a=e.toolCall?.args;if(!a||!Object.hasOwn(a,"Cwd"))return{configCwd:s[0],executionCwd:s[0]};let l=a.Cwd;if(typeof l!=="string"||l.trim()==="")return dn(r,t,n),null;let c=ut(l,s,o.paths);if(c){let u=Cp(c,s);if(!u)return dn(r,t,n,l),null;return{configCwd:u,executionCwd:c}}return dn(r,t,n,l),null}function Hw(e,t,n,r){let o=hp(t),i=[...Zr(e,Gw),...o.kind==="patch"?Xr(e):[]].filter(jn.isAbsolute),s=de(),a=new Set(i.flatMap((l)=>{let c=Cp(D(l,r,s),n);return c?[c]:[]}));if(a.size>1)return null;return[...a][0]??n[0]??null}function Cp(e,t){return t.filter((n)=>Bw(e,n)).reduce((n,r)=>r.length>n.length?r:n,"")||null}function Bw(e,t){let n=jn.relative(t,e);return n===""||!n.startsWith("..")&&!jn.isAbsolute(n)}function dn(e,t,n,r){let o=t&&typeof t==="object"?t.command:void 0;e(pn({command:typeof o==="string"?o:void 0,segment:r,toolName:n}))}function Uw(e,t){if(e.workspacePaths===void 0)return[process.cwd()];let n=Array.isArray(e.workspacePaths)?e.workspacePaths.filter((r)=>typeof r==="string"&&r.trim()!==""):[];return it(n,t)?n:[]}function $w(e,t){if(!e)return;if(t!=="run_command")return e;return{...e,command:typeof e.CommandLine==="string"&&e.CommandLine!==""?e.CommandLine:void 0}}var Ni=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,runtime:{order:3,flags:["-cx","--codex"],description:"Run as a Codex PreToolUse hook",legacyTopLevelFlags:[]},install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:7,runtime:{order:6,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:7,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:6,runtime:{order:5,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:6,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:8,runtime:{order:7,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:9,runtime:{order:8,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:10,runtime:{order:9,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:10,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:11,install:{order:11,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:12,install:{order:12,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:13,install:{order:13,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:4,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],WN=Ni.slice().sort((e,t)=>e.doctorOrder-t.doctorOrder).map((e)=>e.id),bp=Ni.filter((e)=>("runtime"in e)).slice().sort((e,t)=>e.runtime.order-t.runtime.order).map((e)=>({id:e.id,displayName:"displayName"in e.runtime?e.runtime.displayName:e.displayName,flags:e.runtime.flags,legacyFlags:"legacyFlags"in e.runtime?e.runtime.legacyFlags:[],description:e.runtime.description,legacyTopLevelFlags:e.runtime.legacyTopLevelFlags})),FN=Ni.slice().sort((e,t)=>e.install.order-t.install.order).map((e)=>({id:e.id,...e.install})).map(({order:e,...t})=>t),GN=Object.fromEntries(Ni.map((e)=>[e.id,e.displayName]));var mn=require("node:path");function Sp(e,t){if(e!==void 0&&e!==null&&typeof e!=="string")return"unknown";if(typeof e==="string"&&!mn.isAbsolute(e))return"unknown";try{let n=de(),r=typeof e==="string"&&e?D(e,t.paths,n):void 0,o=t.home,i=[["codex",t.env.get("CODEX_HOME")||mn.join(o,".codex")],["copilot-cli",t.env.get("COPILOT_HOME")||mn.join(o,".copilot")],["claude-code",t.env.get("CLAUDE_CONFIG_DIR")||mn.join(o,".claude")]],s=r?i.flatMap(([a,l])=>{if(!mn.isAbsolute(l))return[];return Zi(r,D(l,t.paths,n))?[a]:[]}):[];if(s.length===1)return s[0]??"unknown";if(s.length>1)return"unknown"}catch{return"unknown"}if(t.env.get("CLAUDECODE")==="1"||Boolean(t.env.get("CLAUDE_CODE_ENTRYPOINT")))return"claude-code";return"unknown"}var gl="PreToolUse",vp="BeforeTool",Ep="pre_tool_call";async function Vn(e){await Ie({agent:e.agent,...e.getAgent?{getAgent:e.getAgent}:{},createDenyOutput:(t)=>({hookSpecificOutput:{hookEventName:gl,permissionDecision:"deny",permissionDecisionReason:t}}),isSupported:(t)=>t.hook_event_name===gl,getToolName:(t)=>t.tool_name,getToolInput:(t,n)=>({ok:!0,input:t.tool_input,route:e.getToolRoute(n)}),getContext:e.getContext??at,getSessionId:(t)=>t.session_id})}var jw=new Map([["Bash","posix"],["PowerShell","powershell"]]);function Vw(e){return se(e,jw)}async function Rp(){await Vn({agent:"claude-code",getAgent:(e,t)=>Sp(e.transcript_path,t),getToolRoute:Vw})}var Kw=new Map([["Bash","auto"]]);async function xp(){await Vn({agent:"codex",getToolRoute:(e)=>se(e,Kw)})}var qw=new Map([["bash","auto"],["Bash","auto"],["powershell","powershell"],["PowerShell","powershell"]]);function Yw(e){return se(e,qw)}async function _p(){await Ie({agent:"copilot-cli",createDenyOutput:(e)=>({permissionDecision:"deny",permissionDecisionReason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(typeof e.toolArgs!=="string")return n({reason:"Failed to parse toolArgs JSON."}),{ok:!1};let r=Jr(e.toolArgs,n,"Failed to parse toolArgs JSON.");if(r===void 0)return{ok:!1};return{ok:!0,input:r,route:Yw(t)}},getContext:at,getSessionId:(e)=>typeof e.sessionId==="string"&&e.sessionId.trim()?e.sessionId:void 0})}var Zw=new Map([["Shell","auto"]]);function Xw(e){return se(e,Zw)}async function wp(){await Ie({agent:"cursor",createDenyOutput:(e)=>({permission:"deny",user_message:e,agent_message:e}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Xw(t)}),getContext:Jw,getSessionId:(e)=>e.conversation_id})}function Jw(e,t,n,r,o){let i=Qw(e,o.paths);if(!i[0])return ee(r,t,n),null;let s=ut(tA(e.cwd),i,o.paths);if(!s)return ee(r,t,n,typeof e.cwd==="string"?e.cwd:void 0),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:s,executionCwd:s};if(!Object.hasOwn(t,"working_directory"))return{configCwd:s,executionCwd:s};let a=t.working_directory;if(typeof a!=="string"||a.trim()==="")return ee(r,t,n),null;let l=ut(a,i,o.paths);if(!l)return ee(r,t,n,a),null;return{configCwd:s,executionCwd:l}}function Qw(e,t){return eA(e).flatMap((n)=>{let r=it([n],t);return r?[r]:[]})}function eA(e){if(e.workspace_roots===void 0)return typeof e.cwd==="string"&&e.cwd.trim()!==""?[e.cwd]:[];if(!Array.isArray(e.workspace_roots))return[];return e.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="")}function tA(e){return typeof e==="string"&&e.trim()!==""?e:"."}var nA=new Map([["run_shell_command","auto"]]);function rA(e){return se(e,nA)}async function Ap(){await Ie({agent:"gemini-cli",createDenyOutput:(e)=>({decision:"deny",reason:e,systemMessage:e}),isSupported:(e)=>e.hook_event_name===vp,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:rA(t)}),getContext:at,getSessionId:(e)=>e.session_id})}var oA=new Map([["run_terminal_command","auto"]]);function iA(e){return se(e,oA)}async function Pp(){await Ie({agent:"grok-build",createDenyOutput:(e)=>({decision:"deny",reason:e}),createAllowOutput:()=>({decision:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(e.toolInputTruncated===!0)return ee(n,e.toolInput,t),{ok:!1};return{ok:!0,input:e.toolInput,route:iA(t)}},getContext:sA,getSessionId:(e)=>e.sessionId})}function sA(e,t,n,r,o){let i=it(aA(e),o.paths);if(!i)return ee(r,t,n),null;let s=ut(lA(e.cwd),[i],o.paths);if(!s)return ee(r,t,n,typeof e.cwd==="string"?e.cwd:void 0),null;return{configCwd:s,executionCwd:s}}function aA(e){let t=e.workspaceRoot===void 0?e.cwd:e.workspaceRoot;return typeof t==="string"&&t.trim()!==""?[t]:[]}function lA(e){return typeof e==="string"&&e.trim()!==""?e:"."}var Tp=require("node:path");var cA=new Map([["terminal","posix"]]);async function Ip(){await Ie({agent:"hermes-agent",createDenyOutput:(e)=>({action:"block",message:e}),isSupported:(e)=>e.hook_event_name===Ep,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:se(t,cA)}),getContext:uA,getSessionId:(e)=>e.session_id})}function uA(e,t,n,r,o){let i=at(e,t,n,r,o);if(!i)return null;if(!t||typeof t!=="object"||Array.isArray(t))return i;if(!Object.hasOwn(t,"workdir"))return i;let s=t.workdir;if(typeof s!=="string"||s.trim()==="")return ee(r,t,n),null;let a=it([Tp.resolve(i.configCwd,s)],o.paths);if(!a)return ee(r,t,n,s),null;return{...i,executionCwd:a}}var kp=new Map([["Bash","posix"]]);function dA(e){return se(e,kp)}async function Op(){await Vn({agent:"kimi-code",getToolRoute:dA,getContext:(e,t,n,r,o)=>{let i=at(e,t,n,r,o);if(!i)return null;let s=e.tool_input;if(!kp.has(n)||!s||!Object.hasOwn(s,"cwd"))return i;let a=s.cwd;if(typeof a!=="string"||a.trim()==="")return ee(r,t,n),null;let l=ut(a,[i.configCwd],o.paths);if(!l)return ee(r,t,n,a),null;return{configCwd:i.configCwd,executionCwd:l}}})}var mA={"antigravity-cli":yp,"claude-code":Rp,codex:xp,"copilot-cli":_p,cursor:wp,"gemini-cli":Ap,"grok-build":Pp,"hermes-agent":Ip,"kimi-code":Op},hl=bp.map((e)=>({...e,run:mA[e.id]}));function Mp(e){let t=Vr({label:"hook",booleans:Object.fromEntries(hl.map((r)=>[r.id,[...r.flags,...r.legacyFlags]]))},e);if(t.errors.length>0)return;let n=hl.filter((r)=>t.flags[r.id]);return n.length===1?n[0]:void 0}function Dp(e){return hl.find((t)=>t.legacyTopLevelFlags.some((n)=>n===e))}async function fA(){let e=process.argv.slice(2),t=e[0],n=Vr({label:"cc-safety-net",booleans:{version:["-V","--version"]},positionals:"list"},e);if(!n.help&&!n.flags.version){if(t?.toLowerCase()==="hook"){let i=Mp(e.slice(1));if(i){await i.run();return}}let o=Dp(t);if(o){await o.run();return}}let r=await import("../cli.js");await r.runCli(e)}fA().catch((e)=>{console.error("CC Safety Net error:",e),process.exit(1)});