cc-safety-net 2.4.3 → 2.4.5

package/dist/openclaw/cc-safety-net/index.js

@@ -1,48 +1,48 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.4.3
-var tl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var fi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",$e="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",En="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var di={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},vn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...di},processedCandidateBytes:{cap:4194304,...di},pathEnvironmentExpansion:{cap:64,...di},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...vn},trackedHeredocFiles:{cap:64,...vn},controlFlowStates:{cap:64,...vn},wrapperPeelIterations:{cap:20,...vn},derivedCommandShape:vn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function ye(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var op=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function st(e){return ip(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function ip(e){return op.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var sp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function ap(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,sp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+// version: 2.4.5
+var al={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Ci="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",$e="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",_n="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var yi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Rn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...yi},processedCandidateBytes:{cap:4194304,...yi},pathEnvironmentExpansion:{cap:64,...yi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Rn},trackedHeredocFiles:{cap:64,...Rn},controlFlowStates:{cap:64,...Rn},wrapperPeelIterations:{cap:20,...Rn},derivedCommandShape:Rn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function ye(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var pp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function st(e){return gp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function gp(e){return pp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var hp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function yp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,hp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function nl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function Rn(e={}){return{reason:En,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function rl(e){return ap({...e,redact:st})}function ol(e){return st(e instanceof Error?e.message:String(e))}import{isAbsolute as wl,relative as Dp,resolve as Lp,sep as Wp}from"node:path";import{basename as al,dirname as lp,isAbsolute as cp,join as up,normalize as dp,resolve as il}from"node:path";var fp=256,Er=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function at(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function hi(e,t){return mi(e,0,t)}function mi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=pi(e,o+2),a=mp(e,o,t);if(a===null){if(Er.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=pp(l,t,n),o=a+1;continue}let i=pi(e,o+1);if(!i){r+="$",o++;continue}r+=gi(i,n)??`$${i}`,o+=i.length+1}return r}function mp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function pp(e,t,n){let r=e.slice(2,-1),o=pi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return gi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Er.has(o))throw new N("pathEnvironmentExpansion");return e}if(!Er.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=gi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":mi(i.slice(s.length),t+1,n);return l?mi(i.slice(s.length),t+1,n):""}function pi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function gi(e,t){if(!Er.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function G(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){ll(n,i);let s=t.realpath(i);if(s!==null)return sl(n,e,s,o);let a=lp(i);if(a===i||o.length>=fp)return sl(n,e,i,o);o.push(al(i)),i=a}}function sl(e,t,n,r){let o=r.length===0?n:up(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function gp(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;ll(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function ll(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ie(e,t,n,r){let o=ul(e,t,n);if(!o)return"";return G(o,n.paths,r).replace(/\\/g,"/")}function cl(e,t,n,r,o){let i=ul(e,t,n);if(!i)return null;if(o(al(i)))return G(i,n.paths,r).replace(/\\/g,"/");let s=gp(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function ul(e,t,n){let r=n.home,o=hi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?il(r,o.slice(2)):o,s=Ce(i);return dp(cp(s)?s:il(t,s))}import{types as hp}from"node:util";var yp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Cp=new Set(["command","diff","input","patch","patchtext"]),dl=new TextEncoder,bp=new TextDecoder,Sp=/\s/,vp=64;class Ve extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var xn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Ep(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function xr(e){return yp.has(Ep(e))}function wn(e){if(!e||typeof e!=="object")return;El(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ue();return}if(t.get||t.set)Ue();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function hl(e,t){return yl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function yl(e,t,n,r){let o=vl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=yl(a,t,n,r+1);return typeof a==="string"&&t.has(Cl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Cl(e){return e.replace(/-/g,"_").toLowerCase()}function bl(e){return Sl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(xp)}function Sl(e,t,n,r){let o=vl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Sl(a,o.array?t:Cp.has(Cl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Rp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>xn.maxDepth||t.nodes>xn.maxNodes)Ue();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>xn.maxStringBytes||t.stringBytes>xn.maxAggregateStringBytes)Ue()}function vl(e,t,n){if(Rp(e,t,n),!e||typeof e!=="object")return null;let r=El(e);if(t.ancestors.has(e))Ue();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>xn.maxKeys)Ue();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ue();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function El(e){if(hp.isProxy(e))Ue();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ue();return t}function Ue(){throw new Ve}function xp(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let f=_p(c);if(o=!0,i=f?.oldLines??null,s=f?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let f=c.startsWith(" ")||c.startsWith("-")?1:0,d=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-f),s=Math.max(0,s-d),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...yi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...yi(c));continue}if(c.startsWith("--- ")){let f=n[l+1]??"";if(!f.startsWith("+++ "))continue;t.push(...bi(Rr(c.slice(4),!0),Rr(f.slice(4),!0))),l++;continue}if(!r)t.push(...yi(c))}return t}function _p(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function yi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return gl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return gl(n[1]);if(e.startsWith("diff --git "))return wp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return pl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return pl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Mp(i[1]);return[]}function wp(e){let t=Pp(e);if(t.length===2&&t[0]&&t[1])return bi(t[0],t[1]);let n=Ap(e);return n?bi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Pp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Rt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Rt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Rl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Rt(e[n]))n++;return n===e.length?t:[]}function Ap(e){let t=0;while(t<e.length&&Rt(e[t]))t++;let n=e.length;while(n>t&&Rt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Rt(e[o])){o++;continue}let i=o;while(o<n&&Rt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>vp)Ue();if(Tp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Tp(e,t,n,r,o){if(Ci(e,t,n,r,o))return!0;let i=fl(e,"/",t,n),s=fl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ci(e,t,i,r,s))return!1;return Ci(e,i+1,n,s+1,o)}function Ci(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function fl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Rt(e){return e!==void 0&&Sp.test(e)}function Rl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:bp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...dl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...dl.encode(Ip(s[0]??""))),o+=2}return null}function Ip(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function kp(e){return _n(Np(e))}function bi(e,t){if(e==="/dev/null")return ml(t);if(t==="/dev/null")return ml(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(_n);let n=Op(e,t)??(e===t?xl(e):null);return[e,t,...n?[n]:[]].flatMap(_n)}function ml(e){let t=xl(e);return[e,...t?[t]:[]].flatMap(_n)}function xl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Op(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function pl(e){return kp(Rr(e,!0))}function Mp(e){return _n(Rr(e,!1))}function Rr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Rl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Np(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function _n(e){return e===""||e==="/dev/null"?[]:[e]}function gl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function Si(e,t,n){if(at(e))return;let r=t.flatMap((i)=>_l(i,n));if(!r[0])return;let o=_l(wl(e)?e:Lp(r[0],e),n)[0];if(!o)return;return r.some((i)=>Fp(o,i))?o:void 0}function _l(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Fp(e,t){let n=Dp(t,e);return n===""||n!==".."&&!n.startsWith(`..${Wp}`)&&!wl(n)}function Pn(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as fg,realpathSync as mg,statSync as pg}from"node:fs";import{homedir as gg,tmpdir as hg}from"node:os";import{statSync as cg}from"node:fs";import{join as ug}from"node:path";import{spawnSync as Gp}from"node:child_process";import{existsSync as Tn,lstatSync as zp,readFileSync as In,realpathSync as qt,statSync as An}from"node:fs";import{dirname as vi,isAbsolute as Ei,join as Yt,resolve as _r}from"node:path";var Bp=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],$p=5000;function Al(e,t=ig(),n=$p){let r=Up(e),o=r===null?null:Hp(r);if(r===null||o===null)return null;let i=rg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Up(e){try{let t=qt(_r(e));return An(t).isDirectory()?t:null}catch{return null}}function Hp(e){let t=ng(e);if(!t)return null;try{let n=zp(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Ri(t);if(!r?.commonDir)return null;if(!Kp(r.gitDir,t))return null;return qp(r.gitDir,vi(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Ri(e){try{let t=jp(e);if(!t)return null;let n=qt(Ei(t)?t:_r(vi(e),t));if(!An(n).isDirectory())return null;return{gitDir:n,commonDir:Vp(n)}}catch{return null}}function jp(e){let t=In(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Vp(e){try{let t=In(Yt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=qt(Ei(t)?t:_r(e,t));return An(n).isDirectory()?n:null}catch{return null}}function Kp(e,t){let n=Yp(e);return n===null?!1:Tl(e,n,t)}function qp(e,t){let n=Zp(e);return n===null?!0:Tl(e,n,t)}function Yp(e){let t=Yt(e,"gitdir");if(!Tn(t))return null;let n=In(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Zp(e){let t=Yt(e,"config.worktree");return Tn(t)?Jp(t):null}function Tl(e,t,n){try{return Xp(Ei(t)?t:_r(e,t),n)}catch{return!1}}function Xp(e,t){try{let n=An(e),r=An(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Pl(qt.native(e))===Pl(qt.native(t))}function Pl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Jp(e){let t=In(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Qp(s[1]??"")}return r}function Qp(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return tg(t.slice(1,-1))}var eg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function tg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:eg[n]??t)}function ng(e){try{return xi(qt(e))}catch{return null}}function xi(e){let t=e;while(!0){let n=Yt(t,".git");if(Tn(n))return n;let r=vi(t);if(r===t)return null;t=r}}function rg(e,t,n,r){if(og(t))return!0;if(n===null)return!0;let o=Gp(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:sg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Il(o.stdout.trim())}function og(e){return[Yt(e.commonDir,"config"),Yt(e.gitDir,"config.worktree")].filter((t)=>Tn(t)).some((t)=>ag(t))}function ig(){return Bp.find((e)=>Tn(e))??null}function kn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function sg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!kn(t)))}function ag(e){let t;try{t=In(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(lg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Il(c)}return r}function lg(e){return e==="include"||e.startsWith("includeif ")}function Il(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function kl(e,t){if(e==="")return null;let n=ye(),r=xi(ie(e,e,t,n)),o=r?dg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function dg(e,t,n,r){try{let o=ie(e,t,n,r),i=cg(e),s=i.isFile()?o:null,a=i.isFile()?Ri(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((f)=>f?[Zt(ie(f,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Zt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Zt(o),markerFile:s?Zt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((f)=>{let d=Zt(ug(f,"hooks").replace(/\\/g,"/"));return[d,Zt(ie(d,t,n,r))]}))]}}catch{return null}}function Zt(e){return process.platform==="win32"?e.toLowerCase():e}var yg={realpath:(e)=>{try{return mg(e)}catch{return null}},entryKind:(e)=>{let t=fg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return pg(e).isDirectory()}catch{return!1}}};function Ml(){return Cg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ce(process.env.HOME||gg()),tmpdir:hg(),paths:yg})}function Cg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Ol(n,i,()=>kl(i,o)),worktreeFacts:(i)=>Ol(r,i,()=>Al(i)),...t};return o}function Ol(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Xt=["fail_closed","paranoid_rm","paranoid_interpreters"],wr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Pr=["standard","strict","paranoid"];function bg(e,t){if(!t)return e;return Pr.indexOf(t)>Pr.indexOf(e)?t:e}function Sg(e){let t=Ai(Q.level,e);if(t===void 0||t==="")return;if(Pr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Pr.join(", ")}.`);return}function vg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Nl(e){return vg(Ai(Q.auditScope,e))==="all"}function wi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Pi(e={},t){let n=e.safety?.level??"standard",r=Sg(t),o=bg(n,r),i=wr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(xt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(xt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(xt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(xt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||xt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:wi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function xt(e,t){let n=typeof e==="string"?_i(e,t):Ai(e,t);return n==="1"||n?.toLowerCase()==="true"}function _i(e,t){return t.get(e)}function Ai(e,t){let n=_i(e.name,t);if(n!==void 0)return n;if(e.legacyName)return _i(e.legacyName,t);return}import{dirname as Lr}from"node:path";import{closeSync as Eg,constants as Dl,fstatSync as Rg,fsyncSync as NP,lstatSync as ki,mkdirSync as DP,openSync as xg,readdirSync as LP,readFileSync as _g,realpathSync as Oi,renameSync as WP,rmdirSync as FP,statSync as wg,unlinkSync as GP,writeFileSync as zP}from"node:fs";import{isAbsolute as Ll,join as Mi,normalize as Pg,parse as Ii,relative as Ni,resolve as Di,sep as Li}from"node:path";function Ti(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Ag=Symbol("PolicyFilesystemScope"),Tg=Symbol("PolicyFilesystemTarget"),Ig=Dl.O_NOFOLLOW??0;class se extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function _t(e,t){return{[Ag]:!0,root:Di(e),label:t}}function Wl(e,t){let n=Pg(t);if(t===""||Ll(t)||n===".."||n.startsWith(`..${Li}`))throw new se(e.label);return{[Tg]:!0,scope:e,relativePath:n,path:Mi(e.root,n)}}function On(e,t){return Wl(e,Ni(e.root,Di(t)))}function Fl(e,t="rules policy"){let n=Di(e),r=Ii(n).dir;return Wl(_t(r,t),Ni(r,n))}function Tr(e){return zl(e.scope.label,()=>{if(!Ar(e))return null;let t=xg(e.path,Dl.O_RDONLY|Ig);return kg(t,()=>{let n=Rg(t);if(!n.isFile())throw new se(e.scope.label);let r=_g(t,"utf-8"),o=ki(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new se(e.scope.label);return Ar(e),r})})}function Gl(e,t){if(e.path===t.path)return!0;return zl(e.scope.label,()=>{if(!Ar(e)||!Ar(t))return!1;let n=(r)=>Mi(Oi(Ii(r).dir),Ii(r).base);return n(e.path)===n(t.path)})}function zl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof se)throw r;throw new se(e)}}function kg(e,t){try{return t()}finally{Eg(e)}}function Ar(e,t="file"){let n=Og(e.scope);if(!n)return!1;let r=e.relativePath.split(Li);for(let o of r.keys()){let i=Mi(e.scope.root,...r.slice(0,o+1)),s=ki(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new se(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new se(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new se(e.scope.label);Mg(n,Oi(i),e.scope.label)}return!0}function Og(e){if(!ki(e.root,{throwIfNoEntry:!1}))return null;if(!wg(e.root).isDirectory())throw new se(e.label);return Oi(e.root)}function Mg(e,t,n){let r=Ni(e,t);if(r===".."||r.startsWith(`..${Li}`)||Ll(r))throw new se(n)}import{dirname as Pt,isAbsolute as Fg,join as Tt,relative as Gg,resolve as At,sep as zg}from"node:path";var wt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Bl="rulebook.json",$l=".cc-safety-net/rules";var Ul=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Ng=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Dg=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Lg="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),HP=new RegExp(`^${Dg}/(${wt.source.slice(1,-1)})/${Lg}$`);function Wg(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Hl(e){if(Ir(e))try{return Wi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return wt.test(e)?null:`Local rulebook sources must be bare names matching ${wt}: ${e}`}function Wi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Ul);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Ng.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!wt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Wg(o),name:o}}function Ir(e){return Ul.test(e)}var jl="rule.json",kr="policy.json",Vl=".cc-safety-net",Bg="rules",$g="CC_SAFETY_NET_HOME",Kl="`cc-safety-net rule update`";function Ug(e){return At(e,$l)}function Hg(e){return Tt(Ug(e),jl)}function Mn(e){return Tt(At(e),Vl,kr)}function Fi(e,t={}){return t.userConfigDir??(t.userConfigPath?Pt(t.userConfigPath):Tt(jg(e),Bg))}function jg(e){let t=e.env.get($g);return t?At(Ce(t)):Tt(e.home,Vl)}function Vg(e,t={}){return Tt(Fi(e,t),jl)}function Jt(e,t={}){return Tt(Pt(Fi(e,t)),kr)}function ql(e,t){let n=t.userConfigPath??Vg(e,t),r=t.projectConfigPath??Hg(t.cwd),o=Kg(e,t),i=qg(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:On(o,n),projectConfigTarget:On(i,r)}}function Kg(e,t){let n=t.userConfigPath?Pt(Pt(At(t.userConfigPath))):Pt(At(t.userConfigDir??Fi(e,t)));return _t(n,"user policy")}function qg(e,t){let n=At(t),r=At(e),o=Gg(n,r);if(o!==".."&&!o.startsWith(`..${zg}`)&&!Fg(o))return _t(n,"project policy");return _t(Pt(Pt(r)),"project policy")}function Yl(e,t){return Tt(e,t,Bl)}var be=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),lt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ct=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Zl=new Set(["python","python3","python2","node","ruby","perl"]),Or=/^python(?:[23](?:\.\d+)*)?$/,_e=new Set(["awk","gawk","nawk","mawk"]),Mr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Xl="Rulebook exceeds CC Safety Net's safe validation limits.",Jl="Additional rulebook validation errors were omitted.",Ie=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Ql(e){if(Gi(e.allowed_commands,Ie.maxAllowedCommands)||Gi(e.rules,Ie.maxRules)||Gi(e.tests,Ie.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Ie,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Ie.maxStringCodeUnits||i&&o.length>Ie.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Ie.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Gi(e,t){return Array.isArray(e)&&e.length>t}var zi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Bi=64,$i="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Yg={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Ui=new Set(["--init-file","--rcfile"]);function Hi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let f=t[c];if(f===void 0)break;if(e==="ksh"&&f==="o"&&c+1<t.length){if(r==="argv"){let d=t.slice(c+1);if(t[0]==="-"&&(d==="c"||d[0]==="-"&&d.endsWith("c")))s=!0}break}if(e==="ksh"&&f==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&f==="o"&&c+1<t.length)break;if(r==="startup"&&f==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&f==="c")s=!0;if(r==="argv"&&f==="n")l=t[0]==="-";if(r==="argv"&&f==="s")a=t[0]==="-";if(!Yg[e]?.includes(f))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Se(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Ui.has(l)&&!s.includes("="))i++;continue}let a=Hi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Nn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Nr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Zg(e))Nn(n,t);return t.inSingle||t.inDouble}function Zg(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Nn(s,n)}return t}var ji=new Set(["rm","find","xargs","parallel"]),Xg=new Set(["git","busybox",...ji,...J,...Zl,..._e]),Jg=new Set(["python","node","ruby","perl"]);function ec(e){let t=M(e);return Xg.has(t)||ke(t)}function ke(e){return Jg.has(Qg(e))}function Qg(e){let t=k(e).toLowerCase();return Or.test(t)?"python":t}function Vi(e){try{let t=Tr(eh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=rh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof se)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function eh(e){return typeof e==="string"?Fl(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function tc(e){let t=new Set;return e.flatMap((n,r)=>{let o=Qt(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Ki=`must be one of ${zi.join(", ")}`,th=/^[^/]+\/[^/]+$/,nh=["version","rules","overrides","transparent_wrappers"];function rh(e){let t=oh(e);return{errors:qi(mh(t,nh,(n)=>n.kind==="custom"),": "," "),sources:fh(e,t)}}function oh(e){if(!Qt(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Bi;return[...e.version===1?[]:[_(["version"],"must be 1")],...ih(e.rules,t),...lh(e.overrides),...uh(e.transparent_wrappers),...t?[]:ah(e.rules),...Qt(e.overrides)?Object.keys(e.overrides).filter((n)=>!th.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...dh(e.transparent_wrappers)]}function ih(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...nc(e,Bi)?[_(["rules"],$i)]:[]];if(t)return[{path:["rules"],message:$i,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...sh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function nc(e,t){let n=rc(e);return n!==void 0&&!(n<=t)}function sh(e,t){let n=rc(e);return n!==void 0&&!(n>=t)}function rc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function ah(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=Hl(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function lh(e){if(e===void 0)return[];if(!Qt(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!Qt(n))return[_(["overrides",t],'must be "off" or an object')];return[...ch(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Zi(n.intent)?[]:[_(["overrides",t,"intent"],Ki)]]})}function ch(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...nc(e,ct)?[_(t,`must be at most ${ct} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ct?[_(t,`must be at most ${ct} characters`)]:[]}function uh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return lt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function dh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(ec(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function fh(e,t){let n=Qt(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function mh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function qi(e,t,n){return[...new Set(e.map((r)=>{let o=Yi(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Yi(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Zi(e){return zi.includes(e)}function Qt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function ic(e){let t=hh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var ph=`required non-empty string up to ${ct} characters`,oc="must be a non-empty array of unique non-empty strings",gh="required non-empty array of non-empty strings";function hh(e){if(!ut(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Ql(e))return{errors:[Xl],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...qi(yh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Ie.maxValidationErrors?[...t.slice(0,Ie.maxValidationErrors),Jl]:t,ruleNames:new Set(sc(e).map((n)=>n.toLowerCase()))}}function sc(e){let t=ut(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ut(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function yh(e,t){return[...typeof e.name==="string"&&wt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Ch(e.allowed_commands),...bh(e.rules,t),...Rh(e.tests),...xh(e),..._h(e)]}function Ch(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&lt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function bh(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!ut(n))return[_(["rules",r],"must be an object")];return t?vh(n,["rules",r]):Sh(n,["rules",r])}),...tc(e)]}function Sh(e,t){return[...ac(e.name,t),...lc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&lt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Dr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...cc(e.reason,t),...uc(e.intent,t)]}function vh(e,t){return[...ac(e.name,t),...lc(e.command,t),...cc(e.reason,t),...uc(e.intent,t),...Eh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function ac(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return wt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function lc(e,t){return typeof e==="string"&&lt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function cc(e,t){return typeof e==="string"&&e!==""&&e.length<=ct?[]:[_([...t,"reason"],ph)]}function uc(e,t){return e===void 0||Zi(e)?[]:[_([...t,"intent"],Ki)]}function Eh(e,t){if(!ut(e))return[_(t,"required object")];return[...Dr(e.command_path,[...t,"command_path"],gh,!1),...e.any_args===void 0?[]:Dr(e.any_args,[...t,"any_args"],oc,!0),...e.exclude_args===void 0?[]:Dr(e.exclude_args,[...t,"exclude_args"],oc,!0)]}function Dr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Rh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!ut(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function xh(e){if(!Array.isArray(e.tests))return[];let t=new Set(sc(e));return[...new Set(e.tests.flatMap((n)=>ut(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function _h(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=ut(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function ut(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function hc(e,t){let n=ql(e,t),r=!1;try{r=Gl(n.userConfigTarget,n.projectConfigTarget)}catch(m){if(m instanceof se)return Nh(n,m.message);throw m}let o=Vi(n.userConfigTarget),i=r?{config:null,errors:[]}:Vi(n.projectConfigTarget),s=pc(n.userConfigPath,o.errors),a=pc(n.projectConfigPath,i.errors),l=new Set,c=o.config?dc(o.config,Lr(n.userConfigPath),"user",n.userScope,l):gc(),f=i.config?dc(i.config,Lr(n.projectConfigPath),"project",n.projectScope,l):gc(),d=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...fc(c.rules,d),...fc(f.rules,u)],transparent_wrappers:Oh(o.config,i.config),rulebooks:[...c.rulebooks,...f.rulebooks],errors:[...s,...a,...c.errors,...f.errors],warnings:[...c.warnings,...f.warnings,...c.canValidateOverrides?mc(d,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Mh(u,c.knownRuleIds,n.projectConfigPath):[],...f.canValidateOverrides?mc(u,f.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function dc(e,t,n,r=_t(Lr(Lr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let f=Ph(c,t,r);if(f.errors.length>0||!f.rulebook)return i.push(...f.errors),[];let d=f.rulebook;if(o.has(d.name))return s.push(`duplicate active rulebook name "${d.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(d.name),[{rules:wh(d),rulebook:{source:n,spec:c,name:d.name,version:d.version,rules:d.rules.map((u)=>`${d.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function wh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Ph(e,t,n){let r=Ah(e),o=Yl(t,r),i=Ih(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Th(e)}`]};let s=kh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Ah(e){return Ir(e)?Wi(e).name:e}function Th(e){return Ir(e)?`run ${Kl} to vendor ${e}`:"create that file or remove that source from the rules config"}function Ih(e,t){try{return{content:Tr(On(t,e))}}catch(n){if(n instanceof se)return{error:n.message};throw n}}function kh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:ic(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function Oh(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function fc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function mc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Mh(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function pc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Nh(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function gc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Kh,readFileSync as qh}from"node:fs";var yc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Xi=new Set(yc.map((e)=>e.id)),Wr=yc,Dh=new Map(Wr.map((e)=>[e.id,e.intent]));function b(e,t){return{id:e,reason:t,intent:Dh.get(e)??"manual_only"}}var Ji=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Fr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Lh=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Wh=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Qi=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Wh.flatMap((e)=>Lh.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Gr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Cc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Fh=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],es=Cc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ts=Cc.flatMap((e)=>Fh.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Dn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ns=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),rs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Gh=[...Ji,Fr,...Qi,...es,...ts,Dn,...ns,...rs,...Gr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),zr=new Set(Gr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),os=new Set(Gh.map((e)=>e.id));import{isAbsolute as is,join as zh,normalize as Bh,sep as Br}from"node:path";var bc=process.platform==="win32",$h=/[*?]/;function Ln(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ss(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Ln(e.trim(),t);if(!is(n))return"must be an absolute path or start with ~/";return Wn(n,t)}function as(e,t){let n=Sc(e,t);if(n===null)return"must be a non-empty path string";if(!is(n))return null;if(Wn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Uh="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Hh="cannot cover the guard's own configuration";function Sc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Ln(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ls(e,t){let n=Sc(e,t);if(n===null)return"must be a non-empty path string";if($h.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!is(n))return null;if(Wn(n,t)!==null)return Uh;return jh(n,t)?Hh:null}function jh(e,t){let n=$r(e),r=$r(zh(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Br}`)}function Wn(e,t){let n=$r(e),r=$r(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Br)?n:`${n}${Br}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function $r(e){let t=Bh(e);if(bc)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(bc?3:1)&&t.endsWith(Br))t=t.slice(0,-1);return t}var vc=30,Ur=1,Hr=365;function Ec(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Rc=new Set(Wr.filter((e)=>e.catastrophic).map((e)=>e.id));function A(e,t){if(!e)return null;if(Rc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Rc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function xc(e,t){return Object.freeze(Object.fromEntries(Wr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function _c(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:xc(e,t)})}var wc={standard:0,strict:1,paranoid:2};function Tc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:cs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:cs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:cs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:Vh(e,t)}}function cs(e,t){return[...new Set([...e,...t??[]])]}function Vh(e,t){let n=t.safety?.level,r=wr[e.safety.level];return[...n&&wc[n]<wc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Xt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Pc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Pc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!zr.has(o))),...e.destructive_command_protection.enabled?Ac(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Ac(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Pc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Ac(e,t){return(t??[]).filter((n)=>!e.includes(n))}var fs=new Set(["standard","strict","paranoid"]),Mc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:vc}};function Nc(e,t){let n=oy(Jt(e,t),e.home),r=Kr(Mn(t.cwd),e.home),o=Zh(r.parsed,e.home),i=Object.keys(o.policy).length>0?Tc(n.gui??Mc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ds(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Yh="project policy audit settings are ignored; audit is user scope only";function Zh(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...fs.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Ic({overrides:Dc(n.overrides,Xt,["safety","overrides"],It)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Vr(o.overrides,Xi,Wc,It)}:{},...o.allow_paths!==void 0?{allow_paths:tn(o.allow_paths,ss,t,["destructive_command_protection","allow_paths"],It)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Vr(i.overrides,os,Fc,It)}:{},...i.deny_paths!==void 0?{deny_paths:tn(i.deny_paths,as,t,["secret_protection","deny_paths"],It)}:{},...i.allow_paths!==void 0?{allow_paths:tn(i.allow_paths,ls,t,["secret_protection","allow_paths"],It)}:{}};return{policy:Ic({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Yh]}}function Dc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],ms));return[]}))}function Ic(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var It=()=>{return},ms="must be a boolean",ps="must be an object if provided",Lc=`must be an integer between ${Ur} and ${Hr}`,Wc={path:["destructive_command_protection","overrides"],label:"destructive command"},Fc={path:["secret_protection","overrides"],label:"secret protection"},Xh=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Jh(e,t){let n=[];return{policy:Gc(e,t,(o)=>{n.push(o)}),issues:n}}function Qh(e,t){return Gc(e,t,It)}function Gc(e,t,n){if(!ve(e))return n(_([],"Config must be an object")),jr();if(e.version!==1)n(_(["version"],"must be 1"));let r=en(e.safety,["safety"],["level","overrides"],n),o=en(r.overrides,["safety","overrides"],Xt,n),i=en(e.workflow,["workflow"],["worktree_mode"],n),s=en(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=en(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=en(e.audit,["audit"],["retention_days"],n);return zc(e,Xh,[],n),{version:1,safety:{level:ey(r.level,n),overrides:Dc(o,Xt,["safety","overrides"],n)},workflow:{worktree_mode:us(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:us(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Vr(s.overrides,Xi,Wc,n),allow_paths:tn(s.allow_paths,ss,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:us(a.enabled,["secret_protection","enabled"],!0,n),overrides:Vr(a.overrides,os,Fc,n),deny_paths:tn(a.deny_paths,as,t,["secret_protection","deny_paths"],n),allow_paths:tn(a.allow_paths,ls,t,["secret_protection","allow_paths"],n)},audit:{retention_days:ty(l.retention_days,n)}}}function en(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(t,ps)),{};return zc(e,n,t,r),e}function zc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function ey(e,t){if(e===void 0)return"standard";if(fs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function us(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,ms));return n}function ty(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Ur&&e<=Hr))t(_(["audit","retention_days"],Lc));return Ec(e)}function Vr(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(n.path,ps)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function tn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function jr(){return structuredClone(Mc)}function Kr(e,t){if(!Kh(e))return{exists:!1,policy:jr(),errors:[]};try{let n=qh(e,"utf-8");if(!n.trim())return{exists:!0,policy:jr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Jh(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${ry(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:jr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var ny=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[ps,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[ms,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Lc,`not an integer between ${Ur} and ${Hr}`]]);function ry(e){let t=Yi(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=ny.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function oy(e,t){let n=Kr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:Oc(),errors:[]};let o=Qh(r,t);return{policy:ds(o),gui:o,errors:[],levelPresent:kc(r)}}if(n.parsed===void 0)return{policy:Oc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ds(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:kc(n.parsed)}}function kc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return fs.has(t.level)}function Bc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...zr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Oc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Bc({}),denyPaths:[],allowPaths:[]}}}function ds(e){return{safety:iy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Bc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function iy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function $c(e,t){let n=hc(e,t),r=Nc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((f)=>f.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...cy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return uy(o,sy(n,r),s,r.policyScopes)}function sy(e,t){let n=ly(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:dy(e.errors.length>0?ay(e.errors):void 0,e.warnings.length>0?hs(e.warnings.join("; ")):void 0,n)}}function ay(e){return`${hs(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function ly(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function cy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function uy(e,t,n=Object.freeze({}),r){let o=gs(structuredClone(e)),i=r?{policyScopes:gs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function gs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))gs(t);return Object.freeze(e)}function dy(...e){return hs(e.filter((t)=>!!t).join("; "))}function hs(e){return/[.!?]$/.test(e)?e:`${e}.`}function Uc(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:ys(t.fail_closed,e.strict,"strict"),paranoid_rm:ys(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:ys(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:_c(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:wi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function ys(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Fn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var fy=/^[A-Za-z_][A-Za-z0-9_]*=/;function qr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Gn(e){let t=qr(e.words[0],"time")?1:0,n=t===1&&qr(e.words[t],"-p")?t+1:t,r=t===1&&qr(e.words[n],"--")?n+1:n,o=qr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!fy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var dt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Yr(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function my(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function Zr(e,t,n){e.push(n),t.reset()}function Xr(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Cs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function nn(e,t,n,r,o,i,s){return Cs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return my(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function bs(e,t,n){if(t>=n||jc(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!jc(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Hc(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Hc(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ss(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=py(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?gy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Hc(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function jc(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function py(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function gy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Yc=new Set(["&&","||","|","|&"]);function Zc(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=eo(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:ro(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function eo(e,t,n,r,o,i,s){let a=[],l=[],c=Yr(),f=[],d=()=>{if(c.words.length===0&&c.redirections.length===0)return;let m={start:c.start,end:c.end},p=c.words.map((h)=>h.text);Zr(a,c,{kind:"command",dialect:"posix",source:e.slice(m.start,m.end),span:m,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(s&&m===s)return d(),qc(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:f};if(no(m)){if(m===`
-`||m==="\r"){d();let S=m==="\r"&&e[u+1]===`
-`?u+2:u+1,T=a.at(-1);if(T?.kind!=="connector"||!Yc.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,S),span:Object.freeze({start:u,end:S})}));if(f.length>0){let R=Ss(e,S,n,f.splice(0));l.push(...R.issues),u=R.next;continue}u=S;continue}u++;continue}if(m==="#"){while(u<n&&e[u]!==`
-`&&e[u]!=="\r")u++;continue}let p=c.start===-1?Ly(e,u,n):void 0;if(p){if(Es(a,l),i>=r.maxDepth)return rn(a,l,u,"depth-limit",r.maxDepth);if(!vs(o))return rn(a,l,u,"word-limit",r.maxWords);let S=eo(e,p.braceIndex+1,n,r,o,i+1,"}"),T=S.next,R={start:p.braceIndex+1,end:S.closed?T-1:T},P=Vc(e,R,S);if(a.push({kind:"function",name:p.name,span:{start:u,end:T},body:P}),l.push(...S.issues),S.pendingHeredocs.length>0||Bn(S.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(f.push(...S.pendingHeredocs),S.limited)return Qr(a,l,S.next);if(!S.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=T;continue}let h=to(e,u);if(h){if(d(),!ou(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:u,end:u+h.length})})),u+=h.length;continue}if(m===")"){d(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:m,span:{start:u,end:u+1}}),u++;continue}if((m==="("||m==="{"&&Ry(e,u,n))&&c.start===-1){if(Es(a,l),i>=r.maxDepth)return rn(a,l,u,"depth-limit",r.maxDepth);let S=m==="("?")":"}",T=eo(e,u+1,n,r,o,i+1,S),R=T.next,P={start:u+1,end:T.closed?R-1:R},q=Vc(e,P,T);if(a.push({kind:"group",style:m==="("?"subshell":"brace",span:{start:u,end:R},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Bn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(f.push(...T.pendingHeredocs),T.limited)return Qr(a,l,T.next);if(!T.closed)l.push({code:m==="("?"unclosed-subshell":"unclosed-brace-group",message:`${m} group is not closed`});u=R;continue}let g=(m==="<"||m===">")&&e[u+1]!=="("?by(e,u):null;if(g){let S=c.words.at(-1),T=S&&S.span.end===u&&/^[0-9]+$/.test(S.raw)?Number(S.raw):void 0;if(T!==void 0)c.words.pop();let R=T===void 0?u:S?.span.start??u;c.start=c.start===-1?u:c.start;let P=u+g.length;while(P<n&&/[ \t]/.test(e[P]??""))P++;let q=e[P],Z=P>u+g.length&&q==="#",ee=!q||no(q)||!!to(e,P)||q===s||q===")"||Z||(q==="<"||q===">")&&e[P+1]!=="(",X=g==="<<"||g==="<<-",U=X?bs(e,P,n):void 0,D=U?{word:nn(e,P,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Rs(e,P,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return Qr(a,l,D.next);if(!vs(o))return rn(a,l,D.next,"word-limit",r.maxWords)}let le=D?.next??u+g.length,xe={kind:"redirection",operator:g,span:{start:R,end:le},...T===void 0?{}:{fd:T},...D?{target:D.word}:{}};if(c.redirections.push(xe),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let je=c.nested;f.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:g==="<<-",attach:(Te)=>{if(xe.heredoc=Te,Te.quotedDelimiter)return;je.push(...yy(e,Te.bodySpan.start,Te.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`});if(D)c.nested.push(...D.nested);c.end=le,u=le;continue}if(c.start===-1)Es(a,l);let y=Rs(e,u,n,r,o,i);if(l.push(...y.issues),y.limited)return Qr(a,l,y.next);let v=wy(c.words)?ky(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return rn(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let S of E){if(!vs(o))return rn(a,l,y.next,"word-limit",r.maxWords);c.words.push(S)}c.start=c.start===-1?u:c.start,c.end=y.next,c.nested.push(...y.nested),u=y.next>u?y.next:u+1}return d(),qc(a,l),l.push(...Wy(f)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Vc(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:ro(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Rs(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",f=[],d=[],u=!1;while(a<n){let m=e[a],p=(m==="<"||m===">")&&e[a+1]==="(";if(!m||no(m)||(m===";"||m==="|"||m==="&")&&to(e,a)||(m==="<"||m===">")&&!p)break;if(m===")")break;if(m==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),d.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(m==='"'){l=!0;let g=hy(e,a,n,r,o,i);if(s+=g.text,f.push(...g.nested),d.push(...g.issues),u||=g.limited,c=zn(c,g.provenance),a=g.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Sy(e,a+2,n);if(s+=g.text,d.push(...g.issues),!g.closed)d.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=g.next;continue}if(m==="\\"){let g=e[a+1];if(!g){d.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(g===`
-`){a+=2;continue}s+=g,a+=2;continue}let h=m==="$"||m==="<"||m===">"||m==="`"?oo(e,a,n,r,o,i):null;if(h){let g=Xc(h,f,d);if(u||=g.limited,c=zn(c,g.provenance),a=g.next,u)break;continue}if(m==="$"){let g=eu(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(m==="*"||m==="?"||m==="[")c=zn(c,"glob");s+=m,a++}return{word:nn(e,t,a,s,c,l,c==="literal"?void 0:Ey(e,t,a)),nested:f,issues:d,next:a,limited:u}}function hy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],f=!1,d=t+1;while(d<n){let u=e[d];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:d+1,limited:f};if(u==="\\"&&e[d+1]){let p=e[d+1]??"";if(p===`
-`){d+=2;continue}if(p==="\r"&&e[d+2]===`
-`){d+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,d+=2;continue}if(e.startsWith("$((",d)){let p=xs(e,d+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(d,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});d=h;continue}let m=oo(e,d,n,r,o,i);if(m){let p=Xc(m,l,c);if(d=p.next,f||=p.limited,a=zn(a,p.provenance),f)return{text:s,provenance:a,nested:l,issues:c,next:d,limited:f};continue}if(u==="$"){let p=eu(e,d,n,s,a);s=p.text,a=p.provenance,d=p.next;continue}s+=u??"",d++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:f}}function oo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let f=s?3:c?1:2,d=s?"))":c?"`":")",u=xs(e,t+f,n,d),m=u===-1?n:u,p=u===-1?n:u+d.length;if(i>=r.maxDepth)return{program:Dy(e,t+f,m,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],S=!1,T=t+f;while(T<m){let R=oo(e,T,m,r,o,i+1);if(!R){T++;continue}if(v.push(...R.program.nodes),E.push(...R.program.issues),S||=R.program.status==="limited",T=R.next,S)break}if(u===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+f,m),span:{start:t+f,end:m},status:ro(E,S),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=eo(e,t+f,m,r,o,i+1),g=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+f)} substitution is not closed`}]:[],y=(c||l)&&Bn(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+f,m),span:{start:t+f,end:m},status:ro([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function yy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?oo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function Xc(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function xs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
-`||l==="\r")&&s.length>0){let f=l==="\r"&&e[a+1]===`
-`?a+2:a+1,d=Ss(e,f,n,s.splice(0));if(!d.terminated)return-1;a=d.next-1;continue}let c=Jc(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let f=Cy(e,a+3,n);if(f===-1)return-1;a=f+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let f=e[a+2]==="-",d=a+(f?3:2);while(d<n&&/[ \t]/.test(e[d]??""))d++;let u=bs(e,d,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:f,attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Cy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=Jc(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function Jc(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!Fy(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function to(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function by(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function no(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function Qc(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Sy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=vy(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function vy(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return Jr(e,t+1,n,16,2,t+1);if(r==="u")return Jr(e,t+1,n,16,4,t+1);if(r==="U")return Jr(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return Jr(e,t,n,8,3,t+1);return{text:r,next:t+1}}function Jr(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function ro(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function eu(e,t,n,r,o){let i=Qc(e,t,n);return{text:r+e.slice(t,i),provenance:zn(o,"variable"),next:i}}function Ey(e,t,n){let r=Xr(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),f=e.startsWith("$(",a)&&!c,d=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||f||d||u){let m=c?3:u?1:2,p=c?"))":u?"`":")",h=xs(e,a+m,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let m=Qc(e,a,n);if(m>a+1){r.push(o,a,"literal"),r.push(a,m,"variable"),a=m,o=m;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function zn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function Ry(e,t,n){return t+1>=n||no(e[t+1]??"")||to(e,t+1)!==null}var xy=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),_y=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function wy(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Py(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Py(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Ay(e,t);if(n==="env")return Ty(e,t);if(n==="sudo")return Iy(e,t);return}function Ay(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Ty(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(xy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function Iy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(_y.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function tu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=nu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>ru(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function ky(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=nu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>ru(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>nn(e,t.span.start,t.span.end,a,"literal",!1))}}function nu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((m)=>Kc(m,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",f=Kc(c,o);if(!f||f.kind==="range")return{limited:"expansions"};let d=f.start+c.length-f.end,u=f.alternatives.reduce((m,p)=>m+d+p.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+f.alternatives.length>t)return{limited:"words"};i.splice(l,1,...Oy(c,f)),s+=u-c.length}return a===0?void 0:{values:i}}function Kc(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Ny(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:My(e,r)}}function Oy(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function My(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Ny(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function ru(e,t){let n=`x${e}`,r=Rs(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function Dy(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function rn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Qr(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function vs(e){return e.used++,e.used<=e.max}function Ly(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Bn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Bn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Bn(t.body.nodes)})}function Wy(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function ou(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function qc(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!Yc.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Es(e,t){if(!ou(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function Fy(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var su=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Gy=new Set(["gc","cat","type","cp","mv","rm"]),au=["-rec","-for","-path","-literalpath","-whatif"],zy=/^\$env:\w/i,By=/^(?:\$\{?\w+\}?|~)\\./;function lu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...su].some((o)=>n.includes(o))&&!(n.includes("rm")&&au.some((o)=>n.includes(o)))&&!n.includes("<#")&&!$y(n))return!1;let r=As(e,t);if(cu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ps(r).some(Uy)}function cu(e){return e.nodes.some((t)=>{if(t.kind==="group")return cu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function $y(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Uy(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&su.has(n))return!0;let r=e.slice(t+1);if(n&&Gy.has(n)&&r.some(Hy))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return au.some((s)=>i.startsWith(s))})}function Hy(e){return zy.test(e)||By.test(e)}function As(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ts(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:Yy(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ts(e,t,n,r,o,i=!1){let s=[],a=[],l=Yr(),c=0,f=!1,d=()=>{if(l.words.length===0&&l.redirections.length===0)return;let m={start:l.start,end:l.end};Zr(s,l,{kind:"command",dialect:"powershell",source:e.slice(m.start,m.end),span:m,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(i&&m==="}")return d(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:f};let p=qy(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return d(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(m)){if(m==="\r"||m===`
-`){d();let y=m==="\r"&&e[u+1]===`
-`?u+2:u+1;s.push(_s(e,u,y)),u=y;continue}u++;continue}let h=fu(e,u);if(h){d(),s.push(_s(e,u,u+h.length)),u+=h.length;continue}if(m==="{"){if(d(),o>=r.maxDepth)return a.push(du(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ts(e,u+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(u+1,v),span:{start:u+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,f||=y.limited,u=y.next;continue}if(m==="}"){d(),s.push(_s(e,u,u+1)),u++;continue}if(m===">"||m==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===m?u+2:u+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?iu(e,v,n,r,o):void 0,S=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:S}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,f||=E.limited;l.end=S,u=S;continue}if(m===","){l.start=l.start===-1?u:l.start,l.words.push(Cs({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let g=iu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,f||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),d(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};u=g.next>u?g.next:u+1}return d(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:f}}function iu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],f=0,d=!1,u=(p)=>{let h=jy(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),f+=ws(h.program),d||=h.program.status==="limited",s="command-substitution",h.next},m=t;while(m<n){let p=e[m];if(!p||/\s/.test(p)||fu(e,m)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[m+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),m++;break}i+=h,m+=2;continue}if(e.startsWith("$(",m)){m=u(m);continue}if(p==="'"){a=!0,m++;let h=!1;while(m<e.length){if(e[m]==="'"&&e[m+1]==="'"){i+="'",m+=2;continue}if(e[m]==="'"){h=!0,m++;break}i+=e[m]??"",m++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,m++;let h=!1;while(m<n){let g=e[m];if(g==="`"&&e[m+1]){i+=e[m+1],m+=2;continue}if(g==='"'){h=!0,m++;break}if(e.startsWith("$(",m)){m=u(m);continue}if(g==="$")s=e[m+1]==="("?"command-substitution":"variable";i+=g??"",m++}if(!h)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[m+1]==="("?"command-substitution":"variable";if(p==="@"&&m===t)s="variable";i+=p,m++}return{word:nn(e,t,m,i,s,a,s==="literal"?void 0:Vy(e,t,m)),next:m,issues:l,nested:c,words:f,limited:d}}function jy(e,t,n,r,o){let i=uu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[du(r.maxDepth)],nodes:[]}),next:a};let l=Ts(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function uu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function ws(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=ws(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=ws(r)}}return t}function Vy(e,t,n){let r=Xr(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=uu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=Ky(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function Ky(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function du(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ps(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ps(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ps)]})}function fu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function qy(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Yy(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function _s(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Oe(e,t="auto",n=dt){if(t==="powershell"||t==="auto"&&lu(e.slice(0,n.maxInputLength),n))return As(e,n);return Zc(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function on(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function io(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Is(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function $n(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){$n(e,t)}function kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function ks(e){return e===`
+`)}function ll(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function wn(e={}){return{reason:_n,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function cl(e){return yp({...e,redact:st})}function ul(e){return st(e instanceof Error?e.message:String(e))}import{isAbsolute as Ol,relative as jp,resolve as Vp,sep as Kp}from"node:path";import{basename as fl,dirname as Cp,isAbsolute as bp,join as Sp,normalize as vp,resolve as dl}from"node:path";var Ep=256,_r=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function at(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ei(e,t){return bi(e,0,t)}function bi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Si(e,o+2),a=xp(e,o,t);if(a===null){if(_r.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Rp(l,t,n),o=a+1;continue}let i=Si(e,o+1);if(!i){r+="$",o++;continue}r+=vi(i,n)??`$${i}`,o+=i.length+1}return r}function xp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Rp(e,t,n){let r=e.slice(2,-1),o=Si(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return vi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(_r.has(o))throw new N("pathEnvironmentExpansion");return e}if(!_r.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=vi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":bi(i.slice(s.length),t+1,n);return l?bi(i.slice(s.length),t+1,n):""}function Si(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function vi(e,t){if(!_r.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function F(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){pl(n,i);let s=t.realpath(i);if(s!==null)return ml(n,e,s,o);let a=Cp(i);if(a===i||o.length>=Ep)return ml(n,e,i,o);o.push(fl(i)),i=a}}function ml(e,t,n,r){let o=r.length===0?n:Sp(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function _p(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;pl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function pl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=hl(e,t,n);if(!o)return"";return F(o,n.paths,r).replace(/\\/g,"/")}function gl(e,t,n,r,o){let i=hl(e,t,n);if(!i)return null;if(o(fl(i)))return F(i,n.paths,r).replace(/\\/g,"/");let s=_p(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function hl(e,t,n){let r=n.home,o=Ei(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?dl(r,o.slice(2)):o,s=Ce(i);return vp(bp(s)?s:dl(t,s))}import{types as wp}from"node:util";var Pp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Ap=new Set(["command","diff","input","patch","patchtext"]),yl=new TextEncoder,Tp=new TextDecoder,Ip=/\s/,kp=64;class Ve extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Pn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Op(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Pr(e){return Pp.has(Op(e))}function Tn(e){if(!e||typeof e!=="object")return;Al(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ue();return}if(t.get||t.set)Ue();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function El(e,t){return xl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function xl(e,t,n,r){let o=Pl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=xl(a,t,n,r+1);return typeof a==="string"&&t.has(Rl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Rl(e){return e.replace(/-/g,"_").toLowerCase()}function _l(e){return wl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Np)}function wl(e,t,n,r){let o=Pl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>wl(a,o.array?t:Ap.has(Rl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Mp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Pn.maxDepth||t.nodes>Pn.maxNodes)Ue();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Pn.maxStringBytes||t.stringBytes>Pn.maxAggregateStringBytes)Ue()}function Pl(e,t,n){if(Mp(e,t,n),!e||typeof e!=="object")return null;let r=Al(e);if(t.ancestors.has(e))Ue();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Pn.maxKeys)Ue();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ue();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Al(e){if(wp.isProxy(e))Ue();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ue();return t}function Ue(){throw new Ve}function Np(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Dp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...xi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...xi(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(..._i(wr(c.slice(4),!0),wr(u.slice(4),!0))),l++;continue}if(!r)t.push(...xi(c))}return t}function Dp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function xi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return vl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return vl(n[1]);if(e.startsWith("diff --git "))return Lp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Sl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Sl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Up(i[1]);return[]}function Lp(e){let t=Wp(e);if(t.length===2&&t[0]&&t[1])return _i(t[0],t[1]);let n=Gp(e);return n?_i(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Wp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(xt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!xt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Tl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(xt(e[n]))n++;return n===e.length?t:[]}function Gp(e){let t=0;while(t<e.length&&xt(e[t]))t++;let n=e.length;while(n>t&&xt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!xt(e[o])){o++;continue}let i=o;while(o<n&&xt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>kp)Ue();if(Fp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Fp(e,t,n,r,o){if(Ri(e,t,n,r,o))return!0;let i=Cl(e,"/",t,n),s=Cl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ri(e,t,i,r,s))return!1;return Ri(e,i+1,n,s+1,o)}function Ri(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Cl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function xt(e){return e!==void 0&&Ip.test(e)}function Tl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Tp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...yl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...yl.encode(zp(s[0]??""))),o+=2}return null}function zp(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function Bp(e){return An(Hp(e))}function _i(e,t){if(e==="/dev/null")return bl(t);if(t==="/dev/null")return bl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(An);let n=$p(e,t)??(e===t?Il(e):null);return[e,t,...n?[n]:[]].flatMap(An)}function bl(e){let t=Il(e);return[e,...t?[t]:[]].flatMap(An)}function Il(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function $p(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Sl(e){return Bp(wr(e,!0))}function Up(e){return An(wr(e,!1))}function wr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Tl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Hp(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function An(e){return e===""||e==="/dev/null"?[]:[e]}function vl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function wi(e,t,n){if(at(e))return;let r=t.flatMap((i)=>kl(i,n));if(!r[0])return;let o=kl(Ol(e)?e:Vp(r[0],e),n)[0];if(!o)return;return r.some((i)=>qp(o,i))?o:void 0}function kl(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function qp(e,t){let n=jp(t,e);return n===""||n!==".."&&!n.startsWith(`..${Kp}`)&&!Ol(n)}function In(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Eg,realpathSync as xg,statSync as Rg}from"node:fs";import{homedir as _g,tmpdir as wg}from"node:os";import{statSync as bg}from"node:fs";import{join as Sg}from"node:path";import{spawnSync as Yp}from"node:child_process";import{existsSync as On,lstatSync as Zp,readFileSync as Mn,realpathSync as Yt,statSync as kn}from"node:fs";import{dirname as Pi,isAbsolute as Ai,join as Zt,resolve as Ar}from"node:path";var Xp=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Jp=5000;function Nl(e,t=gg(),n=Jp){let r=Qp(e),o=r===null?null:eg(r);if(r===null||o===null)return null;let i=fg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Qp(e){try{let t=Yt(Ar(e));return kn(t).isDirectory()?t:null}catch{return null}}function eg(e){let t=mg(e);if(!t)return null;try{let n=Zp(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Ti(t);if(!r?.commonDir)return null;if(!rg(r.gitDir,t))return null;return og(r.gitDir,Pi(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Ti(e){try{let t=tg(e);if(!t)return null;let n=Yt(Ai(t)?t:Ar(Pi(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:ng(n)}}catch{return null}}function tg(e){let t=Mn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function ng(e){try{let t=Mn(Zt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Yt(Ai(t)?t:Ar(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function rg(e,t){let n=ig(e);return n===null?!1:Dl(e,n,t)}function og(e,t){let n=sg(e);return n===null?!0:Dl(e,n,t)}function ig(e){let t=Zt(e,"gitdir");if(!On(t))return null;let n=Mn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function sg(e){let t=Zt(e,"config.worktree");return On(t)?lg(t):null}function Dl(e,t,n){try{return ag(Ai(t)?t:Ar(e,t),n)}catch{return!1}}function ag(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Ml(Yt.native(e))===Ml(Yt.native(t))}function Ml(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function lg(e){let t=Mn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=cg(s[1]??"")}return r}function cg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return dg(t.slice(1,-1))}var ug={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function dg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:ug[n]??t)}function mg(e){try{return Ii(Yt(e))}catch{return null}}function Ii(e){let t=e;while(!0){let n=Zt(t,".git");if(On(n))return n;let r=Pi(t);if(r===t)return null;t=r}}function fg(e,t,n,r){if(pg(t))return!0;if(n===null)return!0;let o=Yp(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:hg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Ll(o.stdout.trim())}function pg(e){return[Zt(e.commonDir,"config"),Zt(e.gitDir,"config.worktree")].filter((t)=>On(t)).some((t)=>yg(t))}function gg(){return Xp.find((e)=>On(e))??null}function Nn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function hg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Nn(t)))}function yg(e){let t;try{t=Mn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Cg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Ll(c)}return r}function Cg(e){return e==="include"||e.startsWith("includeif ")}function Ll(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Wl(e,t){if(e==="")return null;let n=ye(),r=Ii(se(e,e,t,n)),o=r?vg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function vg(e,t,n,r){try{let o=se(e,t,n,r),i=bg(e),s=i.isFile()?o:null,a=i.isFile()?Ti(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Xt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Xt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Xt(o),markerFile:s?Xt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=Xt(Sg(u,"hooks").replace(/\\/g,"/"));return[m,Xt(se(m,t,n,r))]}))]}}catch{return null}}function Xt(e){return process.platform==="win32"?e.toLowerCase():e}var Pg={realpath:(e)=>{try{return xg(e)}catch{return null}},entryKind:(e)=>{let t=Eg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Rg(e).isDirectory()}catch{return!1}}};function Fl(){return Ag({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ce(process.env.HOME||_g()),tmpdir:wg(),paths:Pg})}function Ag(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Gl(n,i,()=>Wl(i,o)),worktreeFacts:(i)=>Gl(r,i,()=>Nl(i)),...t};return o}function Gl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Jt=["fail_closed","paranoid_rm","paranoid_interpreters"],Tr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Ir=["standard","strict","paranoid"];function Tg(e,t){if(!t)return e;return Ir.indexOf(t)>Ir.indexOf(e)?t:e}function Ig(e){let t=Ni(Q.level,e);if(t===void 0||t==="")return;if(Ir.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Ir.join(", ")}.`);return}function kg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function zl(e){return kg(Ni(Q.auditScope,e))==="all"}function Oi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Mi(e={},t){let n=e.safety?.level??"standard",r=Ig(t),o=Tg(n,r),i=Tr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Rt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(Rt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(Rt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(Rt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Rt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Oi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Rt(e,t){let n=typeof e==="string"?ki(e,t):Ni(e,t);return n==="1"||n?.toLowerCase()==="true"}function ki(e,t){return t.get(e)}function Ni(e,t){let n=ki(e.name,t);if(n!==void 0)return n;if(e.legacyName)return ki(e.legacyName,t);return}import{dirname as Fr}from"node:path";import{closeSync as Og,constants as Bl,fstatSync as Mg,fsyncSync as eA,lstatSync as Wi,mkdirSync as tA,openSync as Ng,readdirSync as nA,readFileSync as Dg,realpathSync as Gi,renameSync as rA,rmdirSync as oA,statSync as Lg,unlinkSync as iA,writeFileSync as sA}from"node:fs";import{isAbsolute as $l,join as Fi,normalize as Wg,parse as Li,relative as zi,resolve as Bi,sep as $i}from"node:path";function Di(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Gg=Symbol("PolicyFilesystemScope"),Fg=Symbol("PolicyFilesystemTarget"),zg=Bl.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function _t(e,t){return{[Gg]:!0,root:Bi(e),label:t}}function Ul(e,t){let n=Wg(t);if(t===""||$l(t)||n===".."||n.startsWith(`..${$i}`))throw new ae(e.label);return{[Fg]:!0,scope:e,relativePath:n,path:Fi(e.root,n)}}function Dn(e,t){return Ul(e,zi(e.root,Bi(t)))}function Hl(e,t="rules policy"){let n=Bi(e),r=Li(n).dir;return Ul(_t(r,t),zi(r,n))}function Or(e){return Vl(e.scope.label,()=>{if(!kr(e))return null;let t=Ng(e.path,Bl.O_RDONLY|zg);return Bg(t,()=>{let n=Mg(t);if(!n.isFile())throw new ae(e.scope.label);let r=Dg(t,"utf-8"),o=Wi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return kr(e),r})})}function jl(e,t){if(e.path===t.path)return!0;return Vl(e.scope.label,()=>{if(!kr(e)||!kr(t))return!1;let n=(r)=>Fi(Gi(Li(r).dir),Li(r).base);return n(e.path)===n(t.path)})}function Vl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function Bg(e,t){try{return t()}finally{Og(e)}}function kr(e,t="file"){let n=$g(e.scope);if(!n)return!1;let r=e.relativePath.split($i);for(let o of r.keys()){let i=Fi(e.scope.root,...r.slice(0,o+1)),s=Wi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);Ug(n,Gi(i),e.scope.label)}return!0}function $g(e){if(!Wi(e.root,{throwIfNoEntry:!1}))return null;if(!Lg(e.root).isDirectory())throw new ae(e.label);return Gi(e.root)}function Ug(e,t,n){let r=zi(e,t);if(r===".."||r.startsWith(`..${$i}`)||$l(r))throw new ae(n)}import{dirname as Pt,isAbsolute as qg,join as Tt,relative as Yg,resolve as At,sep as Zg}from"node:path";var wt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Kl="rulebook.json",ql=".cc-safety-net/rules";var Yl=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Hg=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,jg=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Vg="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),uA=new RegExp(`^${jg}/(${wt.source.slice(1,-1)})/${Vg}$`);function Kg(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Zl(e){if(Mr(e))try{return Ui(e),null}catch(t){return t instanceof Error?t.message:String(t)}return wt.test(e)?null:`Local rulebook sources must be bare names matching ${wt}: ${e}`}function Ui(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Yl);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Hg.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!wt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Kg(o),name:o}}function Mr(e){return Yl.test(e)}var Xl="rule.json",Nr="policy.json",Jl=".cc-safety-net",Xg="rules",Jg="CC_SAFETY_NET_HOME",Ql="`cc-safety-net rule update`";function Qg(e){return At(e,ql)}function eh(e){return Tt(Qg(e),Xl)}function Ln(e){return Tt(At(e),Jl,Nr)}function Hi(e,t={}){return t.userConfigDir??(t.userConfigPath?Pt(t.userConfigPath):Tt(th(e),Xg))}function th(e){let t=e.env.get(Jg);return t?At(Ce(t)):Tt(e.home,Jl)}function nh(e,t={}){return Tt(Hi(e,t),Xl)}function Qt(e,t={}){return Tt(Pt(Hi(e,t)),Nr)}function ec(e,t){let n=t.userConfigPath??nh(e,t),r=t.projectConfigPath??eh(t.cwd),o=rh(e,t),i=oh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Dn(o,n),projectConfigTarget:Dn(i,r)}}function rh(e,t){let n=t.userConfigPath?Pt(Pt(At(t.userConfigPath))):Pt(At(t.userConfigDir??Hi(e,t)));return _t(n,"user policy")}function oh(e,t){let n=At(t),r=At(e),o=Yg(n,r);if(o!==".."&&!o.startsWith(`..${Zg}`)&&!qg(o))return _t(n,"project policy");return _t(Pt(Pt(r)),"project policy")}function tc(e,t){return Tt(e,t,Kl)}var be=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),lt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ct=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),nc=new Set(["python","python3","python2","node","ruby","perl"]),Dr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Lr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var rc="Rulebook exceeds CC Safety Net's safe validation limits.",oc="Additional rulebook validation errors were omitted.",ke=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function ic(e){if(ji(e.allowed_commands,ke.maxAllowedCommands)||ji(e.rules,ke.maxRules)||ji(e.tests,ke.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=ke,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>ke.maxStringCodeUnits||i&&o.length>ke.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>ke.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function ji(e,t){return Array.isArray(e)&&e.length>t}var Vi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ki=64,qi="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var ih={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Yi=new Set(["--init-file","--rcfile"]);function Zi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!ih[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Se(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Yi.has(l)&&!s.includes("="))i++;continue}let a=Zi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Wn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Wr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of sh(e))Wn(n,t);return t.inSingle||t.inDouble}function sh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Wn(s,n)}return t}var Xi=new Set(["rm","find","xargs","parallel"]),ah=new Set(["git","busybox",...Xi,...J,...nc,...we]),lh=new Set(["python","node","ruby","perl"]);function sc(e){let t=M(e);return ah.has(t)||Oe(t)}function Oe(e){return lh.has(ch(e))}function ch(e){let t=k(e).toLowerCase();return Dr.test(t)?"python":t}function Ji(e){try{let t=Or(uh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=fh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function uh(e){return typeof e==="string"?Hl(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function ac(e){let t=new Set;return e.flatMap((n,r)=>{let o=en(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Qi=`must be one of ${Vi.join(", ")}`,dh=/^[^/]+\/[^/]+$/,mh=["version","rules","overrides","transparent_wrappers"];function fh(e){let t=ph(e);return{errors:es(xh(t,mh,(n)=>n.kind==="custom"),": "," "),sources:Eh(e,t)}}function ph(e){if(!en(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Ki;return[...e.version===1?[]:[_(["version"],"must be 1")],...gh(e.rules,t),...Ch(e.overrides),...Sh(e.transparent_wrappers),...t?[]:yh(e.rules),...en(e.overrides)?Object.keys(e.overrides).filter((n)=>!dh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...vh(e.transparent_wrappers)]}function gh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...lc(e,Ki)?[_(["rules"],qi)]:[]];if(t)return[{path:["rules"],message:qi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...hh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function lc(e,t){let n=cc(e);return n!==void 0&&!(n<=t)}function hh(e,t){let n=cc(e);return n!==void 0&&!(n>=t)}function cc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function yh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=Zl(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Ch(e){if(e===void 0)return[];if(!en(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!en(n))return[_(["overrides",t],'must be "off" or an object')];return[...bh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||ns(n.intent)?[]:[_(["overrides",t,"intent"],Qi)]]})}function bh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...lc(e,ct)?[_(t,`must be at most ${ct} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ct?[_(t,`must be at most ${ct} characters`)]:[]}function Sh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return lt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function vh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(sc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Eh(e,t){let n=en(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function xh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function es(e,t,n){return[...new Set(e.map((r)=>{let o=ts(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ts(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function ns(e){return Vi.includes(e)}function en(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function dc(e){let t=wh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Rh=`required non-empty string up to ${ct} characters`,uc="must be a non-empty array of unique non-empty strings",_h="required non-empty array of non-empty strings";function wh(e){if(!ut(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!ic(e))return{errors:[rc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...es(Ph(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>ke.maxValidationErrors?[...t.slice(0,ke.maxValidationErrors),oc]:t,ruleNames:new Set(mc(e).map((n)=>n.toLowerCase()))}}function mc(e){let t=ut(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ut(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Ph(e,t){return[...typeof e.name==="string"&&wt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Ah(e.allowed_commands),...Th(e.rules,t),...Mh(e.tests),...Nh(e),...Dh(e)]}function Ah(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&lt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Th(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!ut(n))return[_(["rules",r],"must be an object")];return t?kh(n,["rules",r]):Ih(n,["rules",r])}),...ac(e)]}function Ih(e,t){return[...fc(e.name,t),...pc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&lt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Gr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...gc(e.reason,t),...hc(e.intent,t)]}function kh(e,t){return[...fc(e.name,t),...pc(e.command,t),...gc(e.reason,t),...hc(e.intent,t),...Oh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function fc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return wt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function pc(e,t){return typeof e==="string"&&lt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function gc(e,t){return typeof e==="string"&&e!==""&&e.length<=ct?[]:[_([...t,"reason"],Rh)]}function hc(e,t){return e===void 0||ns(e)?[]:[_([...t,"intent"],Qi)]}function Oh(e,t){if(!ut(e))return[_(t,"required object")];return[...Gr(e.command_path,[...t,"command_path"],_h,!1),...e.any_args===void 0?[]:Gr(e.any_args,[...t,"any_args"],uc,!0),...e.exclude_args===void 0?[]:Gr(e.exclude_args,[...t,"exclude_args"],uc,!0)]}function Gr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Mh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!ut(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Nh(e){if(!Array.isArray(e.tests))return[];let t=new Set(mc(e));return[...new Set(e.tests.flatMap((n)=>ut(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function Dh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=ut(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function ut(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ec(e,t){let n=ec(e,t),r=!1;try{r=jl(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ae)return Hh(n,f.message);throw f}let o=Ji(n.userConfigTarget),i=r?{config:null,errors:[]}:Ji(n.projectConfigTarget),s=Sc(n.userConfigPath,o.errors),a=Sc(n.projectConfigPath,i.errors),l=new Set,c=o.config?yc(o.config,Fr(n.userConfigPath),"user",n.userScope,l):vc(),u=i.config?yc(i.config,Fr(n.projectConfigPath),"project",n.projectScope,l):vc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Cc(c.rules,m),...Cc(u.rules,d)],transparent_wrappers:$h(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?bc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Uh(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?bc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function yc(e,t,n,r=_t(Fr(Fr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Wh(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:Lh(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Lh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Wh(e,t,n){let r=Gh(e),o=tc(t,r),i=zh(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Fh(e)}`]};let s=Bh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Gh(e){return Mr(e)?Ui(e).name:e}function Fh(e){return Mr(e)?`run ${Ql} to vendor ${e}`:"create that file or remove that source from the rules config"}function zh(e,t){try{return{content:Or(Dn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function Bh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:dc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function $h(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Cc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function bc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Uh(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Sc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Hh(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function vc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as ry,readFileSync as oy}from"node:fs";var xc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],rs=new Set(xc.map((e)=>e.id)),zr=xc,jh=new Map(zr.map((e)=>[e.id,e.intent]));function b(e,t){return{id:e,reason:t,intent:jh.get(e)??"manual_only"}}var os=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Br={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Vh=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Kh=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],is=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Kh.flatMap((e)=>Vh.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var $r=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Rc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],qh=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ss=Rc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),as=Rc.flatMap((e)=>qh.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Gn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ls=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),cs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Yh=[...os,Br,...is,...ss,...as,Gn,...ls,...cs,...$r].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Ur=new Set($r.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),us=new Set(Yh.map((e)=>e.id));import{isAbsolute as ds,join as Zh,normalize as Xh,sep as Hr}from"node:path";var _c=process.platform==="win32",Jh=/[*?]/;function Fn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ms(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Fn(e.trim(),t);if(!ds(n))return"must be an absolute path or start with ~/";return zn(n,t)}function fs(e,t){let n=wc(e,t);if(n===null)return"must be a non-empty path string";if(!ds(n))return null;if(zn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Qh="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",ey="cannot cover the guard's own configuration";function wc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Fn(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ps(e,t){let n=wc(e,t);if(n===null)return"must be a non-empty path string";if(Jh.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!ds(n))return null;if(zn(n,t)!==null)return Qh;return ty(n,t)?ey:null}function ty(e,t){let n=jr(e),r=jr(Zh(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Hr}`)}function zn(e,t){let n=jr(e),r=jr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Hr)?n:`${n}${Hr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function jr(e){let t=Xh(e);if(_c)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(_c?3:1)&&t.endsWith(Hr))t=t.slice(0,-1);return t}var Pc=30,Vr=1,Kr=365;function Ac(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Tc=new Set(zr.filter((e)=>e.catastrophic).map((e)=>e.id));function A(e,t){if(!e)return null;if(Tc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Tc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Ic(e,t){return Object.freeze(Object.fromEntries(zr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function kc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Ic(e,t)})}var Oc={standard:0,strict:1,paranoid:2};function Dc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:gs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:gs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:gs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:ny(e,t)}}function gs(e,t){return[...new Set([...e,...t??[]])]}function ny(e,t){let n=t.safety?.level,r=Tr[e.safety.level];return[...n&&Oc[n]<Oc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Jt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Mc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Mc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Ur.has(o))),...e.destructive_command_protection.enabled?Nc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Nc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Mc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Nc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Cs=new Set(["standard","strict","paranoid"]),Fc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Pc}};function zc(e,t){let n=py(Qt(e,t),e.home),r=Zr(Ln(t.cwd),e.home),o=sy(r.parsed,e.home),i=Object.keys(o.policy).length>0?Dc(n.gui??Fc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ys(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var iy="project policy audit settings are ignored; audit is user scope only";function sy(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...Cs.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Lc({overrides:Bc(n.overrides,Jt,["safety","overrides"],It)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Yr(o.overrides,rs,Uc,It)}:{},...o.allow_paths!==void 0?{allow_paths:nn(o.allow_paths,ms,t,["destructive_command_protection","allow_paths"],It)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Yr(i.overrides,us,Hc,It)}:{},...i.deny_paths!==void 0?{deny_paths:nn(i.deny_paths,fs,t,["secret_protection","deny_paths"],It)}:{},...i.allow_paths!==void 0?{allow_paths:nn(i.allow_paths,ps,t,["secret_protection","allow_paths"],It)}:{}};return{policy:Lc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[iy]}}function Bc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],bs));return[]}))}function Lc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var It=()=>{return},bs="must be a boolean",Ss="must be an object if provided",$c=`must be an integer between ${Vr} and ${Kr}`,Uc={path:["destructive_command_protection","overrides"],label:"destructive command"},Hc={path:["secret_protection","overrides"],label:"secret protection"},ay=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function ly(e,t){let n=[];return{policy:jc(e,t,(o)=>{n.push(o)}),issues:n}}function cy(e,t){return jc(e,t,It)}function jc(e,t,n){if(!ve(e))return n(_([],"Config must be an object")),qr();if(e.version!==1)n(_(["version"],"must be 1"));let r=tn(e.safety,["safety"],["level","overrides"],n),o=tn(r.overrides,["safety","overrides"],Jt,n),i=tn(e.workflow,["workflow"],["worktree_mode"],n),s=tn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=tn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=tn(e.audit,["audit"],["retention_days"],n);return Vc(e,ay,[],n),{version:1,safety:{level:uy(r.level,n),overrides:Bc(o,Jt,["safety","overrides"],n)},workflow:{worktree_mode:hs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:hs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Yr(s.overrides,rs,Uc,n),allow_paths:nn(s.allow_paths,ms,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:hs(a.enabled,["secret_protection","enabled"],!0,n),overrides:Yr(a.overrides,us,Hc,n),deny_paths:nn(a.deny_paths,fs,t,["secret_protection","deny_paths"],n),allow_paths:nn(a.allow_paths,ps,t,["secret_protection","allow_paths"],n)},audit:{retention_days:dy(l.retention_days,n)}}}function tn(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(t,Ss)),{};return Vc(e,n,t,r),e}function Vc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function uy(e,t){if(e===void 0)return"standard";if(Cs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function hs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,bs));return n}function dy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Vr&&e<=Kr))t(_(["audit","retention_days"],$c));return Ac(e)}function Yr(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(n.path,Ss)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function nn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function qr(){return structuredClone(Fc)}function Zr(e,t){if(!ry(e))return{exists:!1,policy:qr(),errors:[]};try{let n=oy(e,"utf-8");if(!n.trim())return{exists:!0,policy:qr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=ly(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${fy(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:qr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var my=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ss,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[bs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[$c,`not an integer between ${Vr} and ${Kr}`]]);function fy(e){let t=ts(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=my.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function py(e,t){let n=Zr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:Gc(),errors:[]};let o=cy(r,t);return{policy:ys(o),gui:o,errors:[],levelPresent:Wc(r)}}if(n.parsed===void 0)return{policy:Gc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ys(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Wc(n.parsed)}}function Wc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return Cs.has(t.level)}function Kc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Ur].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Gc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Kc({}),denyPaths:[],allowPaths:[]}}}function ys(e){return{safety:gy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Kc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function gy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function qc(e,t){let n=Ec(e,t),r=zc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...by(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Sy(o,hy(n,r),s,r.policyScopes)}function hy(e,t){let n=Cy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:vy(e.errors.length>0?yy(e.errors):void 0,e.warnings.length>0?Es(e.warnings.join("; ")):void 0,n)}}function yy(e){return`${Es(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Cy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function by(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Sy(e,t,n=Object.freeze({}),r){let o=vs(structuredClone(e)),i=r?{policyScopes:vs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function vs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))vs(t);return Object.freeze(e)}function vy(...e){return Es(e.filter((t)=>!!t).join("; "))}function Es(e){return/[.!?]$/.test(e)?e:`${e}.`}function Yc(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:xs(t.fail_closed,e.strict,"strict"),paranoid_rm:xs(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:xs(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:kc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Oi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function xs(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Bn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Ey=/^[A-Za-z_][A-Za-z0-9_]*=/;function Xr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function $n(e){let t=Xr(e.words[0],"time")?1:0,n=t===1&&Xr(e.words[t],"-p")?t+1:t,r=t===1&&Xr(e.words[n],"--")?n+1:n,o=Xr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Ey.test(s.text));return i?.provenance==="literal"?i.text:void 0}var dt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Jr(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function xy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>me(t)))})}function Qr(e,t,n){e.push(n),t.reset()}function eo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Rs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function rn(e,t,n,r,o,i,s){return Rs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function me(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return xy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:me(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function _s(e,t,n){if(t>=n||Xc(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Xc(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Zc(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Zc(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function ws(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Ry(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?_y(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Zc(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Xc(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Ry(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function _y(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var tu=new Set(["&&","||","|","|&"]);function nu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=ro(e,0,e.length,t,{used:0,max:t.maxWords},0);return me({kind:"program",dialect:"posix",source:e,span:n,status:so(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function ro(e,t,n,r,o,i,s){let a=[],l=[],c=Jr(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((h)=>h.text);Qr(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),eu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(io(f)){if(f===`
+`||f==="\r"){m();let S=f==="\r"&&e[d+1]===`
+`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!tu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,S),span:Object.freeze({start:d,end:S})}));if(u.length>0){let x=ws(e,S,n,u.splice(0));l.push(...x.issues),d=x.next;continue}d=S;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
+`&&e[d]!=="\r")d++;continue}let p=c.start===-1?Vy(e,d,n):void 0;if(p){if(As(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);if(!Ps(o))return on(a,l,d,"word-limit",r.maxWords);let S=ro(e,p.braceIndex+1,n,r,o,i+1,"}"),T=S.next,x={start:p.braceIndex+1,end:S.closed?T-1:T},P=Jc(e,x,S);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:P}),l.push(...S.issues),S.pendingHeredocs.length>0||Hn(S.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...S.pendingHeredocs),S.limited)return no(a,l,S.next);if(!S.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let h=oo(e,d);if(h){if(m(),!uu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:d,end:d+h.length})})),d+=h.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&My(e,d,n))&&c.start===-1){if(As(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);let S=f==="("?")":"}",T=ro(e,d+1,n,r,o,i+1,S),x=T.next,P={start:d+1,end:T.closed?x-1:x},q=Jc(e,P,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:x},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Hn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return no(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=x;continue}let g=(f==="<"||f===">")&&e[d+1]!=="("?Ty(e,d):null;if(g){let S=c.words.at(-1),T=S&&S.span.end===d&&/^[0-9]+$/.test(S.raw)?Number(S.raw):void 0;if(T!==void 0)c.words.pop();let x=T===void 0?d:S?.span.start??d;c.start=c.start===-1?d:c.start;let P=d+g.length;while(P<n&&/[ \t]/.test(e[P]??""))P++;let q=e[P],Z=P>d+g.length&&q==="#",ee=!q||io(q)||!!oo(e,P)||q===s||q===")"||Z||(q==="<"||q===">")&&e[P+1]!=="(",X=g==="<<"||g==="<<-",U=X?_s(e,P,n):void 0,D=U?{word:rn(e,P,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Ts(e,P,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return no(a,l,D.next);if(!Ps(o))return on(a,l,D.next,"word-limit",r.maxWords)}let ce=D?.next??d+g.length,_e={kind:"redirection",operator:g,span:{start:x,end:ce},...T===void 0?{}:{fd:T},...D?{target:D.word}:{}};if(c.redirections.push(_e),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let je=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:g==="<<-",attach:(Ie)=>{if(_e.heredoc=Ie,Ie.quotedDelimiter)return;je.push(...Py(e,Ie.bodySpan.start,Ie.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`});if(D)c.nested.push(...D.nested);c.end=ce,d=ce;continue}if(c.start===-1)As(a,l);let y=Ts(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return no(a,l,y.next);let v=Ly(c.words)?By(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return on(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let S of E){if(!Ps(o))return on(a,l,y.next,"word-limit",r.maxWords);c.words.push(S)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return m(),eu(a,l),l.push(...Ky(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Jc(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:so(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ts(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||io(f)||(f===";"||f==="|"||f==="&")&&oo(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(f==='"'){l=!0;let g=wy(e,a,n,r,o,i);if(s+=g.text,u.push(...g.nested),m.push(...g.issues),d||=g.limited,c=Un(c,g.provenance),a=g.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Iy(e,a+2,n);if(s+=g.text,m.push(...g.issues),!g.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=g.next;continue}if(f==="\\"){let g=e[a+1];if(!g){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(g===`
+`){a+=2;continue}s+=g,a+=2;continue}let h=f==="$"||f==="<"||f===">"||f==="`"?ao(e,a,n,r,o,i):null;if(h){let g=ru(h,u,m);if(d||=g.limited,c=Un(c,g.provenance),a=g.next,d)break;continue}if(f==="$"){let g=su(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(f==="*"||f==="?"||f==="[")c=Un(c,"glob");s+=f,a++}return{word:rn(e,t,a,s,c,l,c==="literal"?void 0:Oy(e,t,a)),nested:u,issues:m,next:a,limited:d}}function wy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
+`){m+=2;continue}if(p==="\r"&&e[m+2]===`
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=Is(e,m+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(m,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=h;continue}let f=ao(e,m,n,r,o,i);if(f){let p=ru(f,l,c);if(m=p.next,u||=p.limited,a=Un(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=su(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function ao(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=Is(e,t+u,n,m),f=d===-1?n:d,p=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:jy(e,t+u,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],S=!1,T=t+u;while(T<f){let x=ao(e,T,f,r,o,i+1);if(!x){T++;continue}if(v.push(...x.program.nodes),E.push(...x.program.issues),S||=x.program.status==="limited",T=x.next,S)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:so(E,S),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=ro(e,t+u,f,r,o,i+1),g=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Hn(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:so([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function Py(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?ao(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function ru(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Is(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
+`?a+2:a+1,m=ws(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=ou(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=Ay(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=_s(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Ay(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=ou(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function ou(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!qy(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function oo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Ty(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function io(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function iu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Iy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=ky(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function ky(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return to(e,t+1,n,16,2,t+1);if(r==="u")return to(e,t+1,n,16,4,t+1);if(r==="U")return to(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return to(e,t,n,8,3,t+1);return{text:r,next:t+1}}function to(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function so(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function su(e,t,n,r,o){let i=iu(e,t,n);return{text:r+e.slice(t,i),provenance:Un(o,"variable"),next:i}}function Oy(e,t,n){let r=eo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,p=c?"))":d?"`":")",h=Is(e,a+f,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let f=iu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Un(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function My(e,t,n){return t+1>=n||io(e[t+1]??"")||oo(e,t+1)!==null}var Ny=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Dy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Ly(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Wy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Wy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Gy(e,t);if(n==="env")return Fy(e,t);if(n==="sudo")return zy(e,t);return}function Gy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Fy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Ny.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function zy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Dy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function au(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=lu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>cu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function By(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=lu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>cu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>rn(e,t.span.start,t.span.end,a,"literal",!1))}}function lu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>Qc(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=Qc(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...$y(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function Qc(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Hy(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:Uy(e,r)}}function $y(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function Uy(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Hy(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function cu(e,t){let n=`x${e}`,r=Ts(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function jy(e,t,n,r){return me({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function on(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function no(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ps(e){return e.used++,e.used<=e.max}function Vy(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Hn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Hn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Hn(t.body.nodes)})}function Ky(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function uu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function eu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!tu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function As(e,t){if(!uu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function qy(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var mu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Yy=new Set(["gc","cat","type","cp","mv","rm"]),fu=["-rec","-for","-path","-literalpath","-whatif"],Zy=/^\$env:\w/i,Xy=/^(?:\$\{?\w+\}?|~)\\./;function pu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...mu].some((o)=>n.includes(o))&&!(n.includes("rm")&&fu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!Jy(n))return!1;let r=Ns(e,t);if(gu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ms(r).some(Qy)}function gu(e){return e.nodes.some((t)=>{if(t.kind==="group")return gu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function Jy(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Qy(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&mu.has(n))return!0;let r=e.slice(t+1);if(n&&Yy.has(n)&&r.some(eC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return fu.some((s)=>i.startsWith(s))})}function eC(e){return Zy.test(e)||Xy.test(e)}function Ns(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ds(e,0,e.length,t,0);return me({kind:"program",dialect:"powershell",source:e,span:n,status:iC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ds(e,t,n,r,o,i=!1){let s=[],a=[],l=Jr(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};Qr(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=oC(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`){m();let y=f==="\r"&&e[d+1]===`
+`?d+2:d+1;s.push(ks(e,d,y)),d=y;continue}d++;continue}let h=Cu(e,d);if(h){m(),s.push(ks(e,d,d+h.length)),d+=h.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(yu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ds(e,d+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=me({kind:"program",dialect:"powershell",source:e.slice(d+1,v),span:{start:d+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(ks(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?du(e,v,n,r,o):void 0,S=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:S}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=S,d=S;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Rs({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let g=du(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,u||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next>d?g.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function du(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(p)=>{let h=tC(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),u+=Os(h.program),m||=h.program.status==="limited",s="command-substitution",h.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||Cu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[f+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=h,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(p==="'"){a=!0,f++;let h=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){h=!0,f++;break}i+=e[f]??"",f++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let h=!1;while(f<n){let g=e[f];if(g==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(g==='"'){h=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=g??"",f++}if(!h)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:rn(e,t,f,i,s,a,s==="literal"?void 0:nC(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function tC(e,t,n,r,o){let i=hu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[yu(r.maxDepth)],nodes:[]}),next:a};let l=Ds(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function hu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Os(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Os(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Os(r)}}return t}function nC(e,t,n){let r=eo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=hu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=rC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function rC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function yu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ms(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ms(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ms)]})}function Cu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function oC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function iC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ks(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Me(e,t="auto",n=dt){if(t==="powershell"||t==="auto"&&pu(e.slice(0,n.maxInputLength),n))return Ns(e,n);return nu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function sn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function lo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Ls(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function jn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){jn(e,t)}function kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Ws(e){return e===`
 `||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Y(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function Ke(e,t,n){return!kt(C(e,t-1))&&j(e,t,n)&&!kt(C(e,t+n.length))}function qe(e,t){return kt(C(e,t-1))!==kt(C(e,t))}function oe(e){return e===`
-`||e===";"||e==="&"||e==="|"}function sn(e){return e==="|"||e===";"}function so(e,t,n){let r=Is(e,n);if(t==="rm")return Zy(r);if(t==="dd")return Jy(r);return Cu(r,!0)}function ao(e,t,n){let r=Is(e,n);if(t==="rm")return Qy(r);if(t==="reset-hard")return hu(r,"--ha","rd");if(t==="reset-merge")return hu(r,"--me","rge");if(t==="clean")return rC(r);if(t==="checkout")return iC(r);if(t==="push-force")return sC(r);if(t==="push-refspec")return aC(r);if(t==="push-delete")return lC(r);if(t==="branch")return cC(r);if(t==="tag")return fC(r);if(t==="restore")return mC(r);return Cu(r,!1)}function Zy(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Ke(e,i,"rm")&&H(l)&&l!==`
-`)t=!0,i++;continue}let a=Xy(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=mu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=mu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function Xy(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function mu(e,t,n){if(pu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(pu(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function pu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function Jy(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(C(e,n))){t=!1;continue}if(Ke(e,n,"dd")){t=!0,n++;continue}if(!t||!Ke(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function Qy(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=C(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=tC(e,o);if(s>=0){if(eC(e,s))return!0;let a=s,l=!1;while(H(C(e,a)))l||=C(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(C(e,o-1)))&&(!C(e,o+2)||H(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&qe(e,o+11)||Os(e,o,"recursive"),r||=j(e,o,"--force")&&qe(e,o+7)||Os(e,o,"force"),n&&r)return!0;o++}return!1}function Os(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&qe(e,t+r+2)}function eC(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(C(e,n)))n++;let i=n;while(n<Y(e)&&!H(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=gu(e,i,"recursive"),a=gu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=nC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function gu(e,t,n){return j(e,t,`--${n}`)&&qe(e,t+n.length+2)||Os(e,t,n)}function tC(e,t){if(t>0&&kt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!H(C(e,n+1)))return-1;return n+1}function nC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let f=C(e,c)??"",d=(f==="r"||f==="f")&&qe(e,c+1);r||=f==="r",o||=f==="f",i||=f==="r"&&d,s||=f==="f"&&d,a||=(l==="r"&&f==="f"||l==="f"&&f==="r")&&d,l=f}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function hu(e,t,n){return Hn(e,"reset",sn,!0,(r)=>C(e,r)==="-"&&an(e,r,t,n)?!0:r)}function rC(e){return Hn(e,"clean",sn,!0,(t)=>{if(C(e,t)!=="-")return t;if(an(e,t,"--fo","rce"))return!0;let n=Un(e,t,sn);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function lo(e,t,n){if(!Ke(e,t,"git"))return null;let r=t+3;if(!H(C(e,r)))return{commandEnd:-1,next:r};while(H(C(e,r)))r++;while(r<Y(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=Un(e,r,oe);if(Ke(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=oC(e,r,o);r=o;while(H(C(e,r)))r++;if(i)return{commandEnd:Ke(e,r,n)?r+n.length:-1,next:Un(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=Un(e,r,oe);while(H(C(e,r)))r++}return{commandEnd:-1,next:r}}function oC(e,t,n){for(let r of be)if(n-t===r.length&&j(e,t,r))return!0;return!1}function iC(e){return yu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function sC(e){return Hn(e,"push",sn,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!kt(C(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=bu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function aC(e){return Hn(e,"push",oe,!1,(t)=>{if(H(C(e,t))&&C(e,t+1)==="+"&&t+2<Y(e)&&!oe(C(e,t+2))&&!H(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function lC(e){return Hn(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&an(e,t,"--de","lete"))return!0;if(H(C(e,t))&&C(e,t+1)===":"&&t+2<Y(e)&&!H(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function cC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=lo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=Un(e,o,oe),s=uC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function uC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(an(e,i,"--de","lete"))r=!0;if(an(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&dC(C(e,s))){let f=C(e,s);a||=f==="d"||f==="D",l||=f==="f",c||=f==="D",s++}if(!qe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function dC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function fC(e){return yu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function yu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=lo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(an(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&qe(e,r+1))return!0;if(sn(o))i.outerActive=!1}return!1}function Hn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=lo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let f=s;f<=c;f++)if(n(C(e,f)))i=!1;s=c}if(l)i=!1}return!1}function mC(e){let t=!1;for(let n=0;n<Y(e);n++){if(ks(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=lo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Cu(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=C(e,r),i=t?ks(o):oe(o);if(n&&H(o)&&C(e,r+1)==="-"&&Ke(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Ke(e,r,"find"))n=!0,r+=3}return!1}function Un(e,t,n){let r=t;while(r<Y(e)&&!H(C(e,r))&&!n(C(e,r)))r++;return r}function bu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return qe(e,o)?o:-1}function an(e,t,n,r){return bu(e,t,n,r)>=0}function Ye(e,t){$n(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&ao(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var pC=/^[A-Za-z_][A-Za-z0-9_]*=/;function vu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;$n(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Eu(t.nodes,r,i)}function Eu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Eu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return gC(r,t,n)})}function gC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!pC.test(o.text));return e.words.every((o,i)=>o===t||Su(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Su(o.target.raw,n.anchored,!0)))}function Su(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as hC,resolve as Ru}from"node:path";function jn(e,t,n,r){let o=hC(e)?Ru(e):t?Ru(t,e):void 0;if(!o)return;try{return G(o,n,r)}catch{return o}}function xu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var ln="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Vn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Ms=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),yC=new Set(["-p","--print"]),CC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),bC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),SC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),vC=new Map([["python",new Set(["m"])]]),EC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),RC=new Set(["always","default","never"]),xC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),_C=/\\\r?\n/g,wC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function wu(e){return uo(e).code}function co(e){return uo(e).sources}function Pu(e){return wC.get(Ds(e))??[]}function uo(e){let t=Ds(e[0]??"");if(!Ms.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Me(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Me(t,n,r,o,i,s);if(t==="node"&&yC.has(s)){let d=e[i+1];if(d===void 0)return Me(t,n,r,o);if(d.startsWith("-"))continue;n.push({tokenIndex:i+1,value:d}),r.push({tokenIndex:i+1,kind:"inline-code",value:d}),i++;continue}if(AC(t,s)){let d=e[i+1];if(d===void 0)return Me(t,n,r,o);if(n.push({tokenIndex:i+1,value:d}),r.push({tokenIndex:i+1,kind:"inline-code",value:d}),t==="python")return Me(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(TC(t)&&a){let d=a[1]??"";n.push({tokenIndex:i,value:d}),r.push({tokenIndex:i,kind:"inline-code",value:d});continue}if(t==="node"){let d=PC(s);if(d){if(d.attached){if(o&&=d.value!=="",d.value!=="")r.push({tokenIndex:i,kind:"module-file",value:d.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Me(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Me(t,n,r,o);if(EC.get(t)?.has(s)){let d=e[i+1];if(d===void 0||d.startsWith("-")&&!(t==="ruby"&&xC.has(s))||t==="python"&&!RC.has(d))return Me(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let d=1;d<s.length;d++){let u=s[d];if(u===void 0)break;if(vC.get(t)?.has(u)){let m=s.slice(d+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return Me(t,n,r,o)}if(CC.get(t)?.has(u)){l=s.slice(d+1)||e[i+1],c=d+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&u==="r"){let m=s.slice(d+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let m=s.slice(d+1);if(!m){if(o=!1,d+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(bC.get(t)?.has(u)){if(d+1===s.length)i++;break}if(SC.get(t)?.has(u)&&d+1<s.length)break}if(l===void 0)continue;let f=c?i+1:i;if(n.push({tokenIndex:f,value:l}),r.push({tokenIndex:f,kind:"inline-code",value:l}),t==="python")return Me(t,n,r,o);if(c)i++}return Me(t,n,r,o,void 0,void 0,!0)}function Me(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((f)=>f.tokenIndex)),c=n.filter((f)=>f.kind!=="inline-code"||l.has(f.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((f)=>f.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function PC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ns(e,t){return Ds(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Ds(e){let t=k(e).toLowerCase();return Or.test(t)?"python":t}function AC(e,t){return Ms.get(e)?.has(t)??!1}function TC(e){return Ms.get(e)?.has("--eval")??!1}function Kn(e,t){let n=OC(e,t);if(!_u(n,t))return!1;Ee(t,n);let r=kC(n);if(_u(r,t))return!0;return Ee(t,r),IC.test(r)}var IC=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function kC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function _u(e,t){if(so(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(so(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(so(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>ao(o,r))))}function OC(e,t){return Ee(t,e),e.replace(_C,"")}import{isAbsolute as Qu,relative as ed}from"node:path";import{isAbsolute as Nu,parse as $C}from"node:path";import{dirname as MC,isAbsolute as NC,parse as DC,sep as LC}from"node:path";function ft(e,t,n){if(at(t))throw Error("Unsupported Windows namespace path");let r=NC(t)?DC(t).root:"",o=r||e;for(let i of FC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=MC(o);continue}let s=WC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function WC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${LC}${t}`}function FC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Ls=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],GC=new Set(Ls),zC=1024,Au=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Tu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),BC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function fo(e){return GC.has(e)}function Ws(e){return fo(e)||Au.has(e)||Tu.has(e)||kn(e)}function Ze(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Iu(e,t){let n=Ze("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=zC?{state:"valid",count:r}:{state:"invalid"}}function mo(e,t,n){let o=e.match(BC)?.[1];if(!o||!Ws(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ze(o,t,n)??""}${e.slice(i+1)}`}}function ku(e){return Mu(e,Tu)}function Ou(e){return Mu(e,Au)}function Mu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Lu=/^[A-Za-z_][A-Za-z0-9_]*=/;function we(e){if(!Lu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function po(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=we(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Wu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Ot(e,t,n,r){if(!Wu(cn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let d=0;d<V.wrapperPeelIterations.cap;d++){let u=Du(i),m=po(i);for(let[h,g]of m.envAssignments)s.set(h,g),a.set(h,g);if(i=m.words,i.length===0)break;while(i.length>0&&cn(i).includes("=")&&!HC(i)){let h=jC(cn(i),a,t.env)??mo(cn(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=cn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=KC(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=ZC(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=XC(i);if(p==="builtin")i=i.slice(Ne(i,1)==="--"?2:1);if(Du(i)===u)break}let f=po(i);for(let[d,u]of f.envAssignments)s.set(d,u),a.set(d,u);return{words:f.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:UC(f.words,o)}}function UC(e,t){return e.some((n)=>!t.has(n))}function Du(e){return e.map(w).join(" ")}function cn(e){let t=e[0];return t?w(t):""}function Ne(e,t){let n=e[t];return n?w(n):void 0}function HC(e){return Lu.test(cn(e))}function jC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var VC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function KC(e,t,n){let r=1,o=n;while(r<e.length){let i=Ne(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Ne(e,r+1);o=s?qn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=qn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=qn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(VC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var qC=new Set(["-i","-0","--null"]),YC=new Set(["-u","--unset","-C","--chdir","-P"]);function ZC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Ne(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let d of n.keys())o.set(d,"");o.set("TMPDIR",""),a++;continue}if(qC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let d=Ne(e,a+1);if(d!==void 0)o.set(d,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let f=c==="-S"||c==="--split-string"?{value:Ne(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(f){if(f.value!==void 0)i.push(f.value);return s=null,l(a+f.consumed)}if(YC.has(c)){if(c==="-C"||c==="--chdir"){let d=Ne(e,a+1);s=d?qn(s,d,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let d=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=qn(s,d,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!we(c))break;while(a<e.length){let d=we(Ne(e,a)??"");if(!d)break;o.set(d.name,d.value),a++}if(Ne(e,a)==="--")a++;return l(a)}return l(a)}function qn(e,t,n){if(t==="")return null;if(!e&&!Nu(t))return null;let r=Nu(t)?$C(t).root:n.realpath(e??"/");if(r===null)return null;try{return ft(r,t,n)}catch{return null}}function XC(e){if(Ne(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Ne(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var JC=/['"\\$`{}#]/;function go(e,t){if(e.some((r)=>JC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function mt(e,t,n){return ho(e,t,n).tokens}function QC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Mt(e,t,n,r=0){let o=ho(e,t,n),i=(o.envSplitValues??[]).flatMap(QC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Mt(s,t,n,r+1)}function ho(e,t,n,r){if(!Wu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Ot(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Bs=Symbol("adopt-as-operand"),eb=new Set(["env","sudo","command","builtin"]),tb=new Set(["&&","||","|&","|","&",";"]),nb=new Set(["<<","<<<",">|"]),rb=new Set(["|","|&"]),ob=/[*@#?$!_-]/,ib=/^\w+(?::\w+)*/,sb=Object.freeze([]),Yn=Object.freeze({kind:"scope",edge:"enter"}),Zn=Object.freeze({kind:"scope",edge:"exit"}),ab=Object.freeze([]),lb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Xn=new Set(["bash","sh","zsh","dash","ksh"]),cb=256,$u=new WeakMap;function Uu(e,t){let n=t.status==="complete"?new Set(zs(t)):new Set,r=fb(e,n);if(Nr(r))return yo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Nt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return yo("structural-limit",r,t);if(o.invalid)return yo("invalid",r,t);let s=yo("complete",r,t,o.assignmentFallbacks);return $u.set(s,Object.freeze(i)),s}function bo(e,t,n,r,o){let i=o.word??((d)=>d),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,f=[];for(let d of Hu(e)){if(d.kind==="scope"){if(d.edge==="enter"){f.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let u=o.segment(a,s,c,null,l);if(u)return u;let m=f.pop();if(m===void 0)throw Error("scope exit without a matching enter");s=m.state,a=m.segment,l=m.shellWords,c=m.pipeProducer;continue}if(d.kind==="operator"){if(!d.boundary)continue;let u=o.segment(a,s,c,d.operator,l);if(u)return u;s=ub(a,s,n,r),c=a.length>0&&rb.has(d.operator)?a:null,a=[],l=new Set;continue}if(d.kind==="redirection"){if(d.fd!==void 0)l.add(a.length-1);if(d.target===void 0)continue;let u=o.redirection({operator:d.operator,role:d.role,targetOrder:d.targetOrder,target:d.target,...d.body===void 0?{}:{body:d.body,consumer:d.consumer}},s);if(u===Bs){l.add(a.length),a.push(i(d.target));continue}if(u)return u;continue}a.push(i(d.text))}return o.segment(a,s,c,null,l)}function So(e){return Hu(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function me(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:me(i,t);return a?me(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function Jn(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function ub(e,t,n,r){let o=Jn(e)?new Map([...t.variables,...db(e,t.variables)]):t.variables,i=mt([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ie(me(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function db(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],me(o,t)]]:[]})}function Hu(e){return $u.get(e)??sb}function fb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function yo(e,t,n,r=ab){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Nt(e,t){return e.nodes.flatMap((n,r)=>mb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function mb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[De(Cb(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[De(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[Co("{"),...Nt(e.body,a),...s?[Co("}")]:[]]:[Yn,De("("),...Nt(e.body,a),...s?[De(")")]:[],Zn]}]}let o=Eb(e,r.functions);if(o){if(r.depth>=dt.maxDepth||++r.flags.expansions>cb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Fu(e,r),Co(";"),...Nt(o,{...r,depth:r.depth+1}),Co(";")]},...Gu(e,t,n,r)]}return[{start:e.span.start,events:Fu(e,r)},...Gu(e,t,n,r)]}function Fu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Vu(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:pb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function pb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Vu(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[$s(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:bb(r),targetOrder:nb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:qu(t)}:{}}),...s===void 0?o:o.slice(1)]}function Gu(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[$s(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[De(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...ju(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?gb(t,n,r):[]]}function gb(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:ju(n.source.slice(r.span.end,e.span.end),n)}]}function ju(e,t){if(t.depth>=dt.maxDepth)return t.flags.limited=!0,[];let n=Oe(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Nt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Vu(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?De("glob"):s!==""||e.quoted&&o.length===0?$s(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of Fs(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(De(m));continue}s+=m.text,a||=m.glob}continue}let f=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=Fs(m,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=f?Nt(f,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(Yn,...p,Zn);continue}let d=f?Nt(f,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Yn,...d,Zn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?De("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Yn,...d,...c.raw.endsWith(")")?[De(")")]:[],Zn);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>De("(")),...u===1?[Yn]:[],...d,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>De(")")):[],...u===1?[Zn]:[])}return l(),o}function Fs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=zu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=zu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function zu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=yb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return hb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&ob.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?ib:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function hb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Fs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function yb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Cb(e){return/^[\r\n]+$/.test(e)?";":e}function De(e){return Object.freeze({kind:"operator",operator:e,boundary:tb.has(e)})}function Co(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function $s(e){return Object.freeze({kind:"word",text:e})}function bb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function Qn(e){return lb.has(e)||/^python\d/.test(e)}var Sb=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Ku(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=Sb.get(e)?.has(n)??!1;return Ku(e,t.slice(r?2:1))}function Gs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Gs(e.slice(1));if(!eb.has(t))return[...e];return Gs(Ku(t,e.slice(1)))}function qu(e){let t=Gn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Gs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function vb(e){let t=qu(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return Qn(n)&&!Xn.has(n)}function zs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return zs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>zs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(vb(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!xb(t))return r;return[...r,...o]})}function Eb(e,t){let n=Gn(e);return n===void 0?void 0:t.get(n)}function pt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function Rb(e){if(pt(e.words[0],"git"))return pt(e.words[1],"commit");if(!pt(e.words[0],"gh")||!pt(e.words[2],"create"))return!1;return pt(e.words[1],"pr")||pt(e.words[1],"issue")}function xb(e){return(pt(e.words[0],"cat")||pt(e.words[0],"tee")||Rb(e))&&!e.words.some(Bu)&&!e.redirections.some((n)=>Bu(n.target))}function Bu(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Yu=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Zu=new Set([...Yu,"glob"]),_b=new Set([...Zu,"pattern"]);class Le extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function er(e){let t=wb(),n=wn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((f)=>f.source===s.source);if(a!==-1){let f=i[a];if(!f)return i;return i[a]={...f,usages:[...f.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:Pb(e),store:t}}function pe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Xe(e,t){if(!e.includes("$"))return e;return hi(e,t)}function wb(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Oe(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let f=n.get(a);if(f)return f;let d={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,d),d}let l=e.get(i);if(l)return l;let c=Uu(i,a);return e.set(i,c),c},getCommandProgram:r}}function Pb(e){let t=e.route.kind==="grep"?Zu:e.route.kind==="glob"?_b:Yu;return[...hl(e.input,t),...e.route.kind==="patch"?bl(e.input):[]]}var Ab=new Set(["-S","--suffix"]);function un(e,t,n,r,o){if(e.status==="structural-limit")throw new Le;if(e.status!=="complete")return o.findMalformedTarget(e.source);return bo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(me(i.target,s.variables),s)?i.target:null})}function vo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Ab.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Pe="Git metadata and hooks are protected. Ask the user before modifying them.";function td(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(xr(e.invocation.toolName))return null;let a=e.paths.find((l)=>Xu(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=pe(e,"input-candidate");if(!i)return null;let s=un(i.shell,o,n,r,{findSegmentTarget:(a,l)=>Ob(a,l,t,n,r),isRedirectionTarget:(a,l)=>Xu(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Ro(ie(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Us(l,n))return!0;let c=s||a.slice(l.length).includes("/."),f=(d)=>c?Eo(d,l):Tb(d,l);if(n.markerFiles.some(f))return!0;return r&&Ju(n).some(f)}if(Us(a,n))return!0;return r&&Ju(n).some((c)=>Eo(c,a))}function Tb(e,t){let n=ed(t,e);if(n===""||n.startsWith("..")||Qu(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function Ib(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function kb(e,t,n,r,o){if(!n)return!1;return Us(Ro(ie(e,t,r,o)),n)}function Xu(e,t,n,r,o,i){let s=Ro(ie(e,t,r,o));return i.includes(s)||rd(s,n)}function nd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Eo(i,Ro(ie(s,t,r,o)))))}function Us(e,t){return t.entries.includes(e)||t.directories.includes(e)||rd(e,t)}function rd(e,t){return t.hooksDirectories.some((n)=>Eo(e,n))}function Ju(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Eo(e,t){let n=ed(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!Qu(n)}function Ro(e){return process.platform==="win32"?e.toLowerCase():e}function Ob(e,t,n,r,o){if(Jn(e))return null;let i=Mt([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=vo(i.slice(1)),a=s.sources.find((l)=>Ib(me(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&kb(me(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Ys,normalize as Bb,parse as $b,posix as fd,resolve as dn,sep as qs}from"node:path";import{isAbsolute as Mb,join as od,normalize as ad,parse as Nb,sep as id}from"node:path";var Db=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Lb=` 	
-`;function tr(e,t){if(gt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Hs(e.get("TMPDIR")??"",t)}function Lt(e,t){if(e.has("TMPDIR"))return Hs(e.get("TMPDIR")??"",t);let n=js(e,t);if(n===void 0)return!0;return Hs(n,t)}function js(e,t){return ud(e,t,"TMPDIR")}function Hs(e,t){if(!e)return!1;if(Fb(e))return!1;return Vs(e,t)}function gt(e,t){let n=ud(e,t,"IFS");return n!==void 0&&n!==""&&n!==Lb}function Vs(e,t){let n=xo(e,t.paths);if(n===null)return!1;return cd(t).some((r)=>zb(n,r))}function ld(e,t){let n=xo(e,t.paths);if(n===null)return!1;return cd(t).some((r)=>_o(r)===_o(n))}var sd=new WeakMap;function cd(e){let t=sd.get(e);if(t)return t;let n=Wb(e);return sd.set(e,n),n}function Wb(e){let t=Db.map((r)=>xo(r,e.paths)??ad(r)),n=xo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&Gb(n))return[...t,n];return t}function Fb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function ud(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function Gb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function xo(e,t){try{let n=ad(e);if(!Mb(n))return n;let r=Nb(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=od(i,o[s]??"");if(t.entryKind(a)==="missing")return od(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function zb(e,t){let n=_o(e),r=_o(t);if(n===r)return!0;let o=r.endsWith(id)?r:`${r}${id}`;return n.startsWith(o)}function _o(e){return process.platform==="win32"?e.toLowerCase():e}var Ub=process.platform==="win32",dd=64,Hb=16384;function nr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return b(o.id,o.reason)}function rr(e){let t=tu(e,dd,dd,Hb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:jb(e)}}function jb(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>Vb(e.raw,n.span.start-e.span.start))}function Vb(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Wt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??ye();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:Xb(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function We(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&Qb(e))return{kind:"outside_anchored_cwd"};let o=!r&&gd(e,t.posixShell);if(at(e))return{kind:"outside_anchored_cwd"};if(Zs(e,r))return{kind:"root_or_home_target"};if(Kb(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(qb(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(Jb(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&rS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&oS(e,t.resolvedCwd??i,t.environment.paths,t.budget))return{kind:"cwd_self_target"};if(iS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function md(e,t,n={}){let{containmentTarget:r,...o}=n;if(We(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(Zb(i))return!1;if(ld(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>sS(r??i,s,t.environment.paths,t.budget))}function Zs(e,t=!1){let n=e.trim(),r=fd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function Kb(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Ys(o)?o:t.resolvedCwd?dn(t.resolvedCwd,o):null;if(!i)return!1;let s=ge(G(i,t.environment.paths,t.budget));if(s===$b(s).root)return!0;return s===ge(G(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function ge(e){let t=Bb(e);if(Ub){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function qb(e,t,n,r,o,i,s,a){let l=e.trim();if(pd(l))return!1;if(!r&&Vs(l,a))return!0;return(t||i&&s)&&n&&!o&&Yb(l,n)}function Yb(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!gd(e.slice(n.length+1),t)})}function Zb(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return fd.normalize(`/${t[1]??""}`)==="/"}function pd(e){return e.split(/[\\/]+/).includes("..")}function Xb(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Ln(o.trim(),t);if(!Ys(i))return[];try{let s=G(i,n,r);if(Wn(s,G(t,n,r)))return[];return[ge(s)]}catch{return[]}})}function Jb(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(pd(r))return!1;let o=n?r:Ln(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Ys(o)?o:i?dn(i,o):null;if(!s)return!1;try{let a=ge(G(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(qs)?l:`${l}${qs}`))}catch{return!1}}function Qb(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function gd(e,t=!1){return e.includes("$")||e.includes("`")||eS(e)||t&&tS(e)}function eS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function tS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&nS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function nS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function rS(e,t,n,r){try{return ge(G(e,n,r))===ge(G(t,n,r))}catch{try{return ge(e)===ge(t)}catch{return!1}}}function oS(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return ge(G(dn(t,e),n,r))===ge(G(t,n,r))}catch{try{return ge(dn(t,e))===ge(t)}catch{return!1}}}function iS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Ks(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Ks(dn(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Ks(dn(a,e),t,i,s)}catch{return!1}}function Ks(e,t,n,r){try{return hd(G(e,n,r),G(t,n,r))}catch{return!1}}function sS(e,t,n,r){if(!t)return!1;try{return hd(G(t,n,r),G(e,n,r))}catch{return!0}}function hd(e,t){let n=ge(e),r=ge(t);return n.startsWith(`${r}${qs}`)||n===r}var aS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),yd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",lS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Cd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",bd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",cS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",uS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",dS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:bd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Pe},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Cd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:cS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:yd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:lS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:yd}};function Sd(e,t,n,r=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return fS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function fS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=pS(o),s=o[i];if(!s||!aS.has(RS(s.text)))return null;let a=mS(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",uS);for(let l of a.targets)if(!at(l.text)&&Zs(Js(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",bd);for(let l of a.targets)if(n.resolvedCwd&&Dt(Js(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return b("powershell.remove-item-git-metadata",Pe);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",Cd);for(let l of a.targets){let c=nr(We(Js(l.text),n),n,r,dS);if(c)return c}return null}function mS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(gS(l))continue;if(s){t.push(Xs(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=yS(l.text);if(!c){t.push(Xs(l)),i=i||l.dynamic;continue}if(CS(c.name)){let f=c.value?hS(c.value,l):e[++a];if(f?.kind==="word"){t.push(Xs(f)),i=i||f.dynamic;continue}i=!0;continue}if(bS(c.name)){n=!0;continue}if(SS(c.name)){r=!0;continue}if(vS(c.name))o=ES(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function pS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Xs(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function gS(e){return e.kind==="word"&&e.text===","}function Js(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function hS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function yS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function CS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function bS(e){return"recurse".startsWith(e)}function SS(e){return e.length>=2&&"force".startsWith(e)}function vS(e){return e==="wi"||"whatif".startsWith(e)}function ES(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function RS(e){return e.toLowerCase()}var fn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",wo="Unsupported heredoc syntax",vd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";import{normalize as Vo}from"node:path";var xS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),_S=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),wS=new Set(["-o","--output","--query","--subscription"]),PS=new Set;function Ed(e){if(e==="aws")return xS;if(e==="gcloud")return _S;if(e==="az")return wS;return PS}var AS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),TS=new Set;function Rd(e){if(e==="git")return be;if(e==="docker")return AS;return TS}function Je(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=de(e);for(let o of t){if(!OS(n,o.command))continue;if(o.match){if(IS(n,e,o.match))return xd(o);continue}if(!MS(n,e,o.subcommand))continue;if(DS(e,new Set(o.block_args),r))return xd(o)}return null}function xd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function IS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return kS(r,n.command_path,Ed(e))}function kS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function OS(e,t){return e===M(t)}function MS(e,t,n){if(!n)return!0;return _d(t,1,n,Rd(e))}function _d(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&NS(e,i,n,r))return!0;continue}return s===n}return!1}function NS(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return _d(e,t+2,n,r)}function DS(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var LS=new Set(["-e","--source"]),WS=new Set(["-F","-v","--assign","--field-separator"]),wd=new Set(["-f","--file"]),FS=new Set(["print","printf","return"]),Pd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],GS="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Ad(e,t,n){let r=!1;for(let o of zS(e)){let i=BS(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",GS):null}function ea(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&LS.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(WS.has(a)||wd.has(a))){let l=e[s+1];if(i&&=l!==void 0,wd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function ir(e){return ea(e).sources}function zS(e){return ir(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function BS(e,t){Ee(t,e);let n=e.includes("system")?ta(e,t):null,r=$S(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ta(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Ao(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Td(e,i+1);continue}if(s==="/"&&Id(e,i)){i=kd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,or(e[a-1])||or(e[i]))continue;let l=Po(e,i);if(e[l]!=="(")continue;l=Po(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let f=Ao(e,l,c);if(!f){r=!0,o=!0;continue}if(l=Po(e,f.endIndex),r=!0,e[l]!==")"){o=!0,i=f.endIndex;continue}n.push(f.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function $S(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let f=e[i];if(!f)break;if(f==='"'||f==="'"){let m=Ao(e,i,f);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(f==="#"){i=Td(e,i+1),s=i,a=null,l=null,c=i;continue}if(f==="/"&&Id(e,i)){let m=kd(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
-{}`.includes(f)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Qs(e,i,"print")||Qs(e,i,"printf")))a=i;if(f!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(f))c=i+1;i++;continue}let d=e[i+1]==="&"?i+2:i+1,u=Po(e,d);if(Qs(e,u,"getline")){o=!0;let m=jS(s,l,c);if(r||=m===null,m!==null)n.push(m);c=d,i=d;continue}if(KS(s,a)){o=!0;let m=HS(e,u);if(!m){r=!0,c=d,i=d;continue}if(!US(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=d,i++}if(!o)return null;return{dynamic:r,commands:n}}function or(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Po(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function US(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Ao(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=VS(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function HS(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Ao(e,t,n)}function jS(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function VS(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Qs(e,t,n){return e.startsWith(n,t)&&!or(e[t-1])&&!or(e[t+n.length])}function KS(e,t){return t!==null&&t>=e}function Td(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Id(e,t){let n=qS(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(or(e[r-1]))r--;return FS.has(e.slice(r,n+1))}function qS(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function kd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var YS=new Set(["sudo","env","command","builtin"]);function To(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=ZS(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function ZS(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&XS(a,r);if(l)i.push(s);if(!l&&Mr.has(M(a)))break;if(o)break}return i}function XS(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||ji.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||ke(r)||_e.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return YS.has(e.toLowerCase())}function Gt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Fe(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Io([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Io(e,t,n,r,o,i,s,a,l){let c=ho(e,t,n,i);for(let[m,p]of c.envAssignments)i.set(m,p),o.set(m,p);let{tokens:f,cwd:d}=c;if(c.envSplitValues){let m=go(c.envSplitValues,f);if(!m)throw new N("derivedCommandShape");na(a),yield*Io(m,t,d,r,o,i,s,a,l);return}if(Ft(f[0]??""))throw new N("wrapperPeelIterations");let u=To(f,s);if(u){for(let m of[u.childIndex,...u.alternativeChildIndices])na(a),yield*Io(m===u.childIndex?u.tokens:[...f.slice(m)],t,d,r,new Map(o),new Map(i),s,a,!0);return}if(QS(f)){na(a),yield*Io([...f.slice(1)],t,d,r,o,i,s,a,l);return}yield JS(f,d,r,o,i,l)}function JS(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function na(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function QS(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ra(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Ge(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||oa(r,"recursive")){t=!0;continue}if(r==="-f"||oa(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Od(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>oa(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function oa(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var ev="find -delete permanently removes files. Use -print first to preview.",tv="find -exec rm -rf is dangerous. Use explicit file list instead.",nv=new Set(["-exec","-execdir","-ok","-okdir"]),rv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Md(e,t){let n=e.map(w),r=ov(e,n,t);if(r)return r;if(Oo(n,1)&&!sv(e,n,t)){let s=A(b("find.delete",ev),t.policy);if(s)return s}let o=t.budget??ye(),i=0;while(i<n.length){let s=n[i],a=ht(s??"");if(a>0){i+=a+1;continue}if(!Qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=sr(n,i);i=l.nextIndex;let c=lv(l.tokens,t.environment);if(c){let m=A(c,t.policy);if(m)return m}let f=s==="-execdir"||s==="-okdir",d=t.analyzeTokens?t.analyzeTokens(l.tokens,f?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:f?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=d?.id.startsWith("custom.")?d:A(d,t.policy);if(u)return u}return null}function ov(e,t,n){if(!Oo(t,1)&&!ia(t,n.environment))return null;let o=ko(e)??K(["."]),i=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=rr(s);for(let l of a.expandedTargets??[w(s)]){let c=We(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Pe)}}if(iv(t)&&i.resolvedCwd&&nd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return b("find.delete-git-metadata",Pe);return null}function ia(e,t){let n=0;while(n<e.length){if(!Qe(e[n])){n++;continue}let r=sr(e,n),o=Mt([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function iv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function sv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=ko(e);if(!r)return!1;let o=n.envAssignments??new Map,i=js(o,n.environment),s=n.trustedTmpdirValue??Lt(o,n.environment),a=n.allowTmpdirVar??!tr(o,n.environment),l=Wt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??gt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let f=rr(c);if(f.unsafeBraceExpansion)return!1;return(f.expandedTargets??[w(c)]).every((d)=>md(d,l,{containmentTarget:av(d,i),targetIsLiteral:f.expandedTargets!==void 0||f.targetIsLiteral,tmpdirWordSplittingProtected:f.tmpdirWordSplittingProtected}))})}function av(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function ko(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function lv(e,t){let n=mt([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&Ge(n))return b("find.exec-rm-recursive-force",tv);return null}function sr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Oo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Qe(r)){n=sr(e,n).nextIndex;continue}let o=ht(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ht(e){return rv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Qe(e){return e!==void 0&&nv.has(e)}function ar(e){let t=Oe(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var cv=5,sa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ce(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Dd(e,t,n){let r=Mo(e,t,n),o=uv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<cv;a++){let{subcommand:l,rest:c}=ze(i),f=l?.toLowerCase();if(!f||!o.has(f))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let d=o.get(f),u=gv(d);if(u===null||u.length===0)return{blockedReason:sa,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:sa,expanded:!0,tokens:i}}function Ld(e,t,n){return Mo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function ze(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=be.has(o)?2:1}return{subcommand:null,rest:[]}}function uv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Mo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=fv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...dv(e,t,n)]}}function dv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=aa(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=aa(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Nd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Nd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(be.has(i)){o+=2;continue}o++}return r}function fv(e,t){let n=mv(e,t),r=pv(e,t);return{blockedReason:n===null||r===null?sa:null,entries:[...n??[],...r??[]]}}function mv(e,t){let n=Ze("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=ar(n);if(!o)return null;for(let i of o){let s=aa(i);if(!s)return null;r.push(s)}return r}function pv(e,t){let n=Iu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ze(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ze(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function aa(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Nd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ze(e.slice(r+1),t,n)}}function gv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return ar(t)}var hv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",yv="git checkout --force discards uncommitted changes. Use 'git stash' first.",Cv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",bv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Sv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",vv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Ev="git switch --force discards uncommitted changes. Use 'git stash' first.",Rv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",xv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",_v="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",wv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Pv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Av="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Tv="git push --force destroys remote history. Use --force-with-lease for safer force push.",Iv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",kv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Ov="git branch -D force-deletes without merge check. Use -d for safe delete.",Mv="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",Nv="git merge --abort discards merge conflict resolutions. Use 'git status' first.",Dv="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Lv="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Wv="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",Fv="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Gv="git worktree remove --force can delete uncommitted changes. Remove --force flag.",zv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Bv=new Set(["--recurse-submodules","--track","-t"]),la=new Set(["-b","-B","-U"]),ca=new Set(["-c","-C"]),$v=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var mn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Fd(e){let{subcommand:t,rest:n}=ze(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return yt(Uv(n));case"switch":return yt(Hv(n));case"restore":return yt(Vv(n));case"reset":return qv(n);case"clean":return yt(Zv(n));case"rm":return yt(Xv(n));case"push":return zt(Jv(n));case"branch":return zt(tE(n));case"stash":return zt(sE(n));case"worktree":return zt(aE(n));case"rebase":return yt(nE(n));case"merge":return yt(rE(n));case"tag":return zt(oE(n));case"reflog":return zt(iE(n));default:return null}}function yt(e){return e?{...e,localDiscard:!0}:null}function zt(e){return e?{...e,localDiscard:!1}:null}function Uv(e){let{index:t,before:n}=ce(e),r=de(n,{shortOptsWithValue:la});if(n.some((i)=>O(i,"--force"))||r.has("-f"))return b("git.checkout-force",yv);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(O(i,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",bv)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return b("git.checkout-ref-path",Cv);return b("git.checkout-double-dash",hv)}if(jv(e).length>=2)return b("git.checkout-ambiguous",Sv);return null}function Hv(e){let{before:t}=ce(e);if(t.some((r)=>O(r,"--discard-changes")))return b("git.switch-discard-changes",vv);let n=de(t,{shortOptsWithValue:ca});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return b("git.switch-force",Ev);return null}function jv(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(zv.has(r)){n+=2;continue}if(Bv.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function Vv(e){let t=Kv(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",xv):b("git.restore-unstaged",Rv)}function Kv(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if($v.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function qv(e){let t=null;for(let n of e){if(O(n,"--hard")){t=b("git.reset-hard",_v);break}if(O(n,"--merge")){t=b("git.reset-merge",wv);break}}if(!t)return null;return Yv(e)?zt(t):yt(t)}function Yv(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function Zv(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return b("git.clean-force",Pv);return null}function Xv(e){let t=!1,n=!1,r=!1;for(let o of ce(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",Av):null}function Jv(e){let{before:t,after:n}=ce(e),r=de(t);if(t.some((s)=>O(s,"--mirror")))return b("git.push-mirror",kv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||Wd(t,n).some(Qv))return b("git.push-force",Tv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||Wd(t,n).some(eE))return b("git.push-delete",Iv);return null}function Wd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function Qv(e){return e.startsWith("+")||e.includes(":+")}function eE(e){return e.length>1&&e.startsWith(":")}function tE(e){let{before:t}=ce(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return b("git.branch-force-delete",Ov);return null}function nE(e){let{before:t}=ce(e);return t.some((n)=>O(n,"--abort"))?b("git.rebase-abort",Mv):null}function rE(e){let{before:t}=ce(e);return t.some((n)=>O(n,"--abort"))?b("git.merge-abort",Nv):null}function oE(e){let{before:t}=ce(e);return de(t).has("-d")||t.some((r)=>O(r,"--delete"))?b("git.tag-delete",Dv):null}function iE(e){return e[0]==="delete"?b("git.reflog-delete",Lv):null}function sE(e){for(let t of e){if(t==="drop")return b("git.stash-drop",Wv);if(t==="clear")return b("git.stash-clear",Fv)}return null}function aE(e){let{before:t}=ce(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",Gv);return null}import{resolve as lE}from"node:path";function zd(e,t){return Ls.some((n)=>t?.has(n)||e.has(n))}function Bd(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(lE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=Gd(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=Gd(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=be.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function Gd(e,t,n){try{let r=ft(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function $d(e,t,n){if(!t.localDiscard||!n.worktreeMode||zd(n.environment.env,n.envAssignments))return null;let r=Bd(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(cE(e,n,o))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function cE(e,t,n){let{subcommand:r,rest:o}=ze(e),i=r?.toLowerCase();if(t.dynamicArguments||uE(o)||gE(e,t.environment.env,t.envAssignments,n)||mE(o)||dE(i,o))return!0;return i==="clean"&&pE(o)>1}function uE(e){return e.some((t)=>/[$*?[]/.test(t))}function dE(e,t){if(e==="checkout"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:la}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:ca}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||fE(s))||r.has("-C");return o&&i}return!1}function fE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function mE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function pE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function gE(e,t,n,r){if(Ze("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Mo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>yE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||hE(s.value);if(Ou(n))return!0;return r.recursiveSubmodules}function hE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function yE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}var CE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",bE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function No(e,t){return Ud(e.map(w),t)}function Ud(e,t,n){let r=Dd(e,t.environment.env,t.envAssignments),o=r.blockedReason?A(b("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((ku(t.envAssignments)||Ld(e,t.environment.env,t.envAssignments))&&SE(i))return b("git.ssh-env",CE);let s=Fd(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=$d(e,s,t);if(!a)return s;return n?.(a),null}function Hd(e,t){let n=null;return{match:Ud(e.map(w),t,(o)=>{n=o}),relaxation:n}}function SE(e){let{subcommand:t,rest:n}=ze(e),r=t?.toLowerCase();if(!r)return!1;if(bE.has(r))return!0;if(r==="archive")return ce(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&vE(n)}function vE(e){return e.find((t)=>!EE(t))?.toLowerCase()==="update"}function EE(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as rR}from"node:path";function jd(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Do(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Vd="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",RE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",xE="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",qd="rm -rf targeting root or home directory is extremely dangerous and always blocked.",_E="rm -rf in home directory is dangerous. Change to a project directory first.",Kd={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:qd},git_metadata_target:{id:"rm.git-metadata",reason:Pe},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:xE},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:_E},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Vd},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:RE},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Vd}};function Lo(e,t){let n=Wt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Ge(r),i=Od(r),s=PE(e);for(let a of s){let l=rr(a.word);if(o&&l.unsafeBraceExpansion){let c=A(nr({kind:"outside_anchored_cwd"},n,t.policy,Kd),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let f=Ce(c),d={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(f,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return b("rm.git-metadata",Pe);if(i&&!o){let u=We(f,n,d);if(u.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",qd);if(u.kind==="git_metadata_target")return b("rm.git-metadata",Pe);continue}if(!o)continue;for(let u of wE(f,n,d)){let m=nr(u,n,t.policy,Kd),p=A(m,t.policy);if(p)return p}}}return null}function wE(e,t,n){let r=We(e,t,n);if(r.kind==="cwd_self_target")return[r,We(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=We(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,We(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function PE(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},Bt={kind:"dynamic"},AE=new Set(["<","<<","<<-","<<<","<&","<>"]),Zd=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,TE=/^(?:[0-9]+|[@*])$/,IE=dt.maxWords,kE=dt.maxInputLength;function Xd(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`||e===";"||e==="&"||e==="|"}function an(e){return e==="|"||e===";"}function co(e,t,n){let r=Ls(e,n);if(t==="rm")return sC(r);if(t==="dd")return lC(r);return Ru(r,!0)}function uo(e,t,n){let r=Ls(e,n);if(t==="rm")return cC(r);if(t==="reset-hard")return Eu(r,"--ha","rd");if(t==="reset-merge")return Eu(r,"--me","rge");if(t==="clean")return fC(r);if(t==="checkout")return gC(r);if(t==="push-force")return hC(r);if(t==="push-refspec")return yC(r);if(t==="push-delete")return CC(r);if(t==="branch")return bC(r);if(t==="tag")return EC(r);if(t==="restore")return xC(r);return Ru(r,!1)}function sC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Ke(e,i,"rm")&&H(l)&&l!==`
+`)t=!0,i++;continue}let a=aC(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=bu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=bu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function aC(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function bu(e,t,n){if(Su(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Su(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Su(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function lC(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(C(e,n))){t=!1;continue}if(Ke(e,n,"dd")){t=!0,n++;continue}if(!t||!Ke(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function cC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=C(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=dC(e,o);if(s>=0){if(uC(e,s))return!0;let a=s,l=!1;while(H(C(e,a)))l||=C(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(C(e,o-1)))&&(!C(e,o+2)||H(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&qe(e,o+11)||Gs(e,o,"recursive"),r||=j(e,o,"--force")&&qe(e,o+7)||Gs(e,o,"force"),n&&r)return!0;o++}return!1}function Gs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&qe(e,t+r+2)}function uC(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(C(e,n)))n++;let i=n;while(n<Y(e)&&!H(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=vu(e,i,"recursive"),a=vu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=mC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function vu(e,t,n){return j(e,t,`--${n}`)&&qe(e,t+n.length+2)||Gs(e,t,n)}function dC(e,t){if(t>0&&kt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!H(C(e,n+1)))return-1;return n+1}function mC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=C(e,c)??"",m=(u==="r"||u==="f")&&qe(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Eu(e,t,n){return Kn(e,"reset",an,!0,(r)=>C(e,r)==="-"&&ln(e,r,t,n)?!0:r)}function fC(e){return Kn(e,"clean",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(ln(e,t,"--fo","rce"))return!0;let n=Vn(e,t,an);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function mo(e,t,n){if(!Ke(e,t,"git"))return null;let r=t+3;if(!H(C(e,r)))return{commandEnd:-1,next:r};while(H(C(e,r)))r++;while(r<Y(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=Vn(e,r,oe);if(Ke(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=pC(e,r,o);r=o;while(H(C(e,r)))r++;if(i)return{commandEnd:Ke(e,r,n)?r+n.length:-1,next:Vn(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=Vn(e,r,oe);while(H(C(e,r)))r++}return{commandEnd:-1,next:r}}function pC(e,t,n){for(let r of be)if(n-t===r.length&&j(e,t,r))return!0;return!1}function gC(e){return xu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function hC(e){return Kn(e,"push",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!kt(C(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=_u(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function yC(e){return Kn(e,"push",oe,!1,(t)=>{if(H(C(e,t))&&C(e,t+1)==="+"&&t+2<Y(e)&&!oe(C(e,t+2))&&!H(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function CC(e){return Kn(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&ln(e,t,"--de","lete"))return!0;if(H(C(e,t))&&C(e,t+1)===":"&&t+2<Y(e)&&!H(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function bC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=mo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=Vn(e,o,oe),s=SC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function SC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(ln(e,i,"--de","lete"))r=!0;if(ln(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&vC(C(e,s))){let u=C(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!qe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function vC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function EC(e){return xu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function xu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=mo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(ln(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&qe(e,r+1))return!0;if(an(o))i.outerActive=!1}return!1}function Kn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=mo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(C(e,u)))i=!1;s=c}if(l)i=!1}return!1}function xC(e){let t=!1;for(let n=0;n<Y(e);n++){if(Ws(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=mo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Ru(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=C(e,r),i=t?Ws(o):oe(o);if(n&&H(o)&&C(e,r+1)==="-"&&Ke(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Ke(e,r,"find"))n=!0,r+=3}return!1}function Vn(e,t,n){let r=t;while(r<Y(e)&&!H(C(e,r))&&!n(C(e,r)))r++;return r}function _u(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return qe(e,o)?o:-1}function ln(e,t,n,r){return _u(e,t,n,r)>=0}function Ye(e,t){jn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&uo(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var RC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;jn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Au(t.nodes,r,i)}function Au(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Au(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return _C(r,t,n)})}function _C(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!RC.test(o.text));return e.words.every((o,i)=>o===t||wu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||wu(o.target.raw,n.anchored,!0)))}function wu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as wC,resolve as Tu}from"node:path";function qn(e,t,n,r){let o=wC(e)?Tu(e):t?Tu(t,e):void 0;if(!o)return;try{return F(o,n,r)}catch{return o}}function Iu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var cn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Yn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Fs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),PC=new Set(["-p","--print"]),AC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),TC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),IC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),kC=new Map([["python",new Set(["m"])]]),OC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),MC=new Set(["always","default","never"]),NC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),DC=/\\\r?\n/g,LC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Ou(e){return po(e).code}function fo(e){return po(e).sources}function Mu(e){return LC.get(Bs(e))??[]}function po(e){let t=Bs(e[0]??"");if(!Fs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&PC.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(GC(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(FC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=WC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(OC.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&NC.has(s))||t==="python"&&!MC.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(kC.get(t)?.has(d)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(AC.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(TC.get(t)?.has(d)){if(m+1===s.length)i++;break}if(IC.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function WC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function zs(e,t){return Bs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Bs(e){let t=k(e).toLowerCase();return Dr.test(t)?"python":t}function GC(e,t){return Fs.get(e)?.has(t)??!1}function FC(e){return Fs.get(e)?.has("--eval")??!1}function Zn(e,t){let n=$C(e,t);if(!ku(n,t))return!1;Ee(t,n);let r=BC(n);if(ku(r,t))return!0;return Ee(t,r),zC.test(r)}var zC=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function BC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function ku(e,t){if(co(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(co(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(co(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>uo(o,r))))}function $C(e,t){return Ee(t,e),e.replace(DC,"")}import{isAbsolute as id,relative as sd}from"node:path";import{isAbsolute as zu,parse as JC}from"node:path";import{dirname as UC,isAbsolute as HC,parse as jC,sep as VC}from"node:path";function mt(e,t,n){if(at(t))throw Error("Unsupported Windows namespace path");let r=HC(t)?jC(t).root:"",o=r||e;for(let i of qC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=UC(o);continue}let s=KC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function KC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${VC}${t}`}function qC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var $s=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],YC=new Set($s),ZC=1024,Nu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Du=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),XC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function go(e){return YC.has(e)}function Us(e){return go(e)||Nu.has(e)||Du.has(e)||Nn(e)}function Ze(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Lu(e,t){let n=Ze("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=ZC?{state:"valid",count:r}:{state:"invalid"}}function ho(e,t,n){let o=e.match(XC)?.[1];if(!o||!Us(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ze(o,t,n)??""}${e.slice(i+1)}`}}function Wu(e){return Fu(e,Du)}function Gu(e){return Fu(e,Nu)}function Fu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var $u=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!$u.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function yo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Uu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Ot(e,t,n,r){if(!Uu(un(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let d=Bu(i),f=yo(i);for(let[h,g]of f.envAssignments)s.set(h,g),a.set(h,g);if(i=f.words,i.length===0)break;while(i.length>0&&un(i).includes("=")&&!eb(i)){let h=tb(un(i),a,t.env)??ho(un(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=un(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=rb(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=sb(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=ab(i);if(p==="builtin")i=i.slice(De(i,1)==="--"?2:1);if(Bu(i)===d)break}let u=yo(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:QC(u.words,o)}}function QC(e,t){return e.some((n)=>!t.has(n))}function Bu(e){return e.map(w).join(" ")}function un(e){let t=e[0];return t?w(t):""}function De(e,t){let n=e[t];return n?w(n):void 0}function eb(e){return $u.test(un(e))}function tb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var nb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function rb(e,t,n){let r=1,o=n;while(r<e.length){let i=De(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=De(e,r+1);o=s?Xn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Xn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Xn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(nb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var ob=new Set(["-i","-0","--null"]),ib=new Set(["-u","--unset","-C","--chdir","-P"]);function sb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=De(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(ob.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=De(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:De(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(ib.has(c)){if(c==="-C"||c==="--chdir"){let m=De(e,a+1);s=m?Xn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Xn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(De(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(De(e,a)==="--")a++;return l(a)}return l(a)}function Xn(e,t,n){if(t==="")return null;if(!e&&!zu(t))return null;let r=zu(t)?JC(t).root:n.realpath(e??"/");if(r===null)return null;try{return mt(r,t,n)}catch{return null}}function ab(e){if(De(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=De(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var lb=/['"\\$`{}#]/;function Co(e,t){if(e.some((r)=>lb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function ft(e,t,n){return bo(e,t,n).tokens}function cb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Mt(e,t,n,r=0){let o=bo(e,t,n),i=(o.envSplitValues??[]).flatMap(cb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Mt(s,t,n,r+1)}function bo(e,t,n,r){if(!Uu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Ot(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Ks=Symbol("adopt-as-operand"),ub=new Set(["env","sudo","command","builtin"]),db=new Set(["&&","||","|&","|","&",";"]),mb=new Set(["<<","<<<",">|"]),fb=new Set(["|","|&"]),pb=/[*@#?$!_-]/,gb=/^\w+(?::\w+)*/,hb=Object.freeze([]),Jn=Object.freeze({kind:"scope",edge:"enter"}),Qn=Object.freeze({kind:"scope",edge:"exit"}),yb=Object.freeze([]),Cb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),er=new Set(["bash","sh","zsh","dash","ksh"]),bb=256,qu=new WeakMap;function Yu(e,t){let n=t.status==="complete"?new Set(Vs(t)):new Set,r=Eb(e,n);if(Wr(r))return So("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Nt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return So("structural-limit",r,t);if(o.invalid)return So("invalid",r,t);let s=So("complete",r,t,o.assignmentFallbacks);return qu.set(s,Object.freeze(i)),s}function Eo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of Zu(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=Sb(a,s,n,r),c=a.length>0&&fb.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===Ks){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function xo(e){return Zu(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function fe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:fe(i,t);return a?fe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function Sb(e,t,n,r){let o=tr(e)?new Map([...t.variables,...vb(e,t.variables)]):t.variables,i=ft([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(fe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function vb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],fe(o,t)]]:[]})}function Zu(e){return qu.get(e)??hb}function Eb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function So(e,t,n,r=yb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Nt(e,t){return e.nodes.flatMap((n,r)=>xb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function xb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Le(Ab(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Le(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[vo("{"),...Nt(e.body,a),...s?[vo("}")]:[]]:[Jn,Le("("),...Nt(e.body,a),...s?[Le(")")]:[],Qn]}]}let o=Ob(e,r.functions);if(o){if(r.depth>=dt.maxDepth||++r.flags.expansions>bb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Hu(e,r),vo(";"),...Nt(o,{...r,depth:r.depth+1}),vo(";")]},...ju(e,t,n,r)]}return[{start:e.span.start,events:Hu(e,r)},...ju(e,t,n,r)]}function Hu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Ju(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:Rb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function Rb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Ju(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[qs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:Tb(r),targetOrder:mb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:ed(t)}:{}}),...s===void 0?o:o.slice(1)]}function ju(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[qs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Le(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...Xu(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?_b(t,n,r):[]]}function _b(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:Xu(n.source.slice(r.span.end,e.span.end),n)}]}function Xu(e,t){if(t.depth>=dt.maxDepth)return t.flags.limited=!0,[];let n=Me(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Nt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Ju(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Le("glob"):s!==""||e.quoted&&o.length===0?qs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of Hs(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Le(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=Hs(f,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=u?Nt(u,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(Jn,...p,Qn);continue}let m=u?Nt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Jn,...m,Qn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Le("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Jn,...m,...c.raw.endsWith(")")?[Le(")")]:[],Qn);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>Le("(")),...d===1?[Jn]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>Le(")")):[],...d===1?[Qn]:[])}return l(),o}function Hs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Vu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Vu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Vu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=Pb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return wb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&pb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?gb:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function wb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Hs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function Pb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Ab(e){return/^[\r\n]+$/.test(e)?";":e}function Le(e){return Object.freeze({kind:"operator",operator:e,boundary:db.has(e)})}function vo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function qs(e){return Object.freeze({kind:"word",text:e})}function Tb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function nr(e){return Cb.has(e)||/^python\d/.test(e)}var Ib=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Qu(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=Ib.get(e)?.has(n)??!1;return Qu(e,t.slice(r?2:1))}function js(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return js(e.slice(1));if(!ub.has(t))return[...e];return js(Qu(t,e.slice(1)))}function ed(e){let t=$n(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return js(n<0?[]:e.words.slice(n).map((r)=>r.text))}function kb(e){let t=ed(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return nr(n)&&!er.has(n)}function Vs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Vs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Vs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(kb(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!Nb(t))return r;return[...r,...o]})}function Ob(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function pt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function Mb(e){if(pt(e.words[0],"git"))return pt(e.words[1],"commit");if(!pt(e.words[0],"gh")||!pt(e.words[2],"create"))return!1;return pt(e.words[1],"pr")||pt(e.words[1],"issue")}function Nb(e){return(pt(e.words[0],"cat")||pt(e.words[0],"tee")||Mb(e))&&!e.words.some(Ku)&&!e.redirections.some((n)=>Ku(n.target))}function Ku(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var td=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),nd=new Set([...td,"glob"]),Db=new Set([...nd,"pattern"]);class We extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function rr(e){let t=Lb(),n=Tn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:Wb(e),store:t}}function pe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Xe(e,t){if(!e.includes("$"))return e;return Ei(e,t)}function Lb(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Me(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=Yu(i,a);return e.set(i,c),c},getCommandProgram:r}}function Wb(e){let t=e.route.kind==="grep"?nd:e.route.kind==="glob"?Db:td;return[...El(e.input,t),...e.route.kind==="patch"?_l(e.input):[]]}var Gb=new Set(["-S","--suffix"]);function dn(e,t,n,r,o){if(e.status==="structural-limit")throw new We;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Eo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(fe(i.target,s.variables),s)?i.target:null})}function Ro(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Gb.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Ae="Git metadata and hooks are protected. Ask the user before modifying them.";function ad(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Pr(e.invocation.toolName))return null;let a=e.paths.find((l)=>rd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=pe(e,"input-candidate");if(!i)return null;let s=dn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>$b(a,l,t,n,r),isRedirectionTarget:(a,l)=>rd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=wo(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Ys(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?_o(m,l):Fb(m,l);if(n.markerFiles.some(u))return!0;return r&&od(n).some(u)}if(Ys(a,n))return!0;return r&&od(n).some((c)=>_o(c,a))}function Fb(e,t){let n=sd(t,e);if(n===""||n.startsWith("..")||id(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function zb(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function Bb(e,t,n,r,o){if(!n)return!1;return Ys(wo(se(e,t,r,o)),n)}function rd(e,t,n,r,o,i){let s=wo(se(e,t,r,o));return i.includes(s)||cd(s,n)}function ld(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>_o(i,wo(se(s,t,r,o)))))}function Ys(e,t){return t.entries.includes(e)||t.directories.includes(e)||cd(e,t)}function cd(e,t){return t.hooksDirectories.some((n)=>_o(e,n))}function od(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function _o(e,t){let n=sd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!id(n)}function wo(e){return process.platform==="win32"?e.toLowerCase():e}function $b(e,t,n,r,o){if(tr(e))return null;let i=Mt([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=Ro(i.slice(1)),a=s.sources.find((l)=>zb(fe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&Bb(fe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as ko,normalize as Zb,parse as Xb,posix as yd,resolve as Wt,sep as Qs}from"node:path";import{isAbsolute as Ub,join as ud,normalize as fd,parse as Hb,sep as dd}from"node:path";var jb=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Vb=` 	
+`;function or(e,t){if(gt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Zs(e.get("TMPDIR")??"",t)}function Lt(e,t){if(e.has("TMPDIR"))return Zs(e.get("TMPDIR")??"",t);let n=Xs(e,t);if(n===void 0)return!0;return Zs(n,t)}function Xs(e,t){return gd(e,t,"TMPDIR")}function Zs(e,t){if(!e)return!1;if(qb(e))return!1;return mn(e,t)}function gt(e,t){let n=gd(e,t,"IFS");return n!==void 0&&n!==""&&n!==Vb}function mn(e,t){let n=Po(e,t.paths);if(n===null)return!1;return pd(t).some((r)=>Io(n,r))}function To(e,t){let n=Po(e,t.paths);if(n===null)return!1;return pd(t).some((r)=>Ao(r)===Ao(n))}var md=new WeakMap;function pd(e){let t=md.get(e);if(t)return t;let n=Kb(e);return md.set(e,n),n}function Kb(e){let t=jb.map((r)=>Po(r,e.paths)??fd(r)),n=Po(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&Yb(n))return[...t,n];return t}function qb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function gd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function Yb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Po(e,t){try{let n=fd(e);if(!Ub(n))return n;let r=Hb(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=ud(i,o[s]??"");if(t.entryKind(a)==="missing")return ud(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Io(e,t){let n=Ao(e),r=Ao(t);if(n===r)return!0;let o=r.endsWith(dd)?r:`${r}${dd}`;return n.startsWith(o)}function Ao(e){return process.platform==="win32"?e.toLowerCase():e}var Jb=process.platform==="win32",hd=64,Qb=16384;function ir(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return b(o.id,o.reason)}function sr(e){let t=au(e,hd,hd,Qb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:eS(e)}}function eS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>tS(e.raw,n.span.start-e.span.start))}function tS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Gt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??ye();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:aS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&cS(e))return{kind:"outside_anchored_cwd"};let o=!r&&bd(e,t.posixShell);if(at(e))return{kind:"outside_anchored_cwd"};if(ea(e,r))return{kind:"root_or_home_target"};if(rS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(oS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(lS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&fS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>pS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(gS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(nS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function nS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(ko(r)||r.startsWith("~"))return!1;if(ta(r))return!1;if(Sd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return mn(Wt(t.resolvedCwd,r),t.environment)}function Cd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(sS(i))return!1;if(To(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Sd(r??i,s,t.environment.paths,t.budget))}function ea(e,t=!1){let n=e.trim(),r=yd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function rS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=ko(o)?o:t.resolvedCwd?Wt(t.resolvedCwd,o):null;if(!i)return!1;let s=ge(F(i,t.environment.paths,t.budget));if(s===Xb(s).root)return!0;return s===ge(F(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function ge(e){let t=Zb(e);if(Jb){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function oS(e,t,n,r,o,i,s,a){let l=e.trim();if(ta(l))return!1;if(!r&&mn(l,a))return!0;return(t||i&&s)&&n&&!o&&iS(l,n)}function iS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!bd(e.slice(n.length+1),t)})}function sS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return yd.normalize(`/${t[1]??""}`)==="/"}function ta(e){return e.split(/[\\/]+/).includes("..")}function aS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Fn(o.trim(),t);if(!ko(i))return[];try{let s=F(i,n,r);if(zn(s,F(t,n,r)))return[];return[ge(s)]}catch{return[]}})}function lS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(ta(r))return!1;let o=n?r:Fn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=ko(o)?o:i?Wt(i,o):null;if(!s)return!1;try{let a=ge(F(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Qs)?l:`${l}${Qs}`))}catch{return!1}}function cS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function bd(e,t=!1){return e.includes("$")||e.includes("`")||uS(e)||t&&dS(e)}function uS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function dS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&mS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function mS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function fS(e,t,n,r){try{return ge(F(e,n,r))===ge(F(t,n,r))}catch{try{return ge(e)===ge(t)}catch{return!1}}}function pS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return ge(F(Wt(t,e),n,r))===ge(F(o,n,r))}catch{try{return ge(Wt(t,e))===ge(o)}catch{return!1}}}function gS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Js(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Js(Wt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Js(Wt(a,e),t,i,s)}catch{return!1}}function Js(e,t,n,r){try{return vd(F(e,n,r),F(t,n,r))}catch{return!1}}function Sd(e,t,n,r){if(!t)return!1;try{return vd(F(t,n,r),F(e,n,r))}catch{return!0}}function vd(e,t){let n=ge(e),r=ge(t);return n.startsWith(`${r}${Qs}`)||n===r}var hS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Ed="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",yS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",xd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Rd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",CS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",bS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",SS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Rd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Ae},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:xd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:CS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Ed},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:yS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Ed}};function _d(e,t,n,r=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return vS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function vS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=xS(o),s=o[i];if(!s||!hS.has(OS(s.text)))return null;let a=ES(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",bS);for(let l of a.targets)if(!at(l.text)&&ea(ra(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Rd);for(let l of a.targets)if(n.resolvedCwd&&Dt(ra(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return b("powershell.remove-item-git-metadata",Ae);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",xd);for(let l of a.targets){let c=ir(Ge(ra(l.text),n),n,r,SS);if(c)return c}return null}function ES(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(RS(l))continue;if(s){t.push(na(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=wS(l.text);if(!c){t.push(na(l)),i=i||l.dynamic;continue}if(PS(c.name)){let u=c.value?_S(c.value,l):e[++a];if(u?.kind==="word"){t.push(na(u)),i=i||u.dynamic;continue}i=!0;continue}if(AS(c.name)){n=!0;continue}if(TS(c.name)){r=!0;continue}if(IS(c.name))o=kS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function xS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function na(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function RS(e){return e.kind==="word"&&e.text===","}function ra(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function _S(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function wS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function PS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function AS(e){return"recurse".startsWith(e)}function TS(e){return e.length>=2&&"force".startsWith(e)}function IS(e){return e==="wi"||"whatif".startsWith(e)}function kS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function OS(e){return e.toLowerCase()}var fn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Oo="Unsupported heredoc syntax",wd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var MS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),NS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),DS=new Set(["-o","--output","--query","--subscription"]),LS=new Set;function Pd(e){if(e==="aws")return MS;if(e==="gcloud")return NS;if(e==="az")return DS;return LS}var WS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),GS=new Set;function Ad(e){if(e==="git")return be;if(e==="docker")return WS;return GS}function Je(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=de(e);for(let o of t){if(!BS(n,o.command))continue;if(o.match){if(FS(n,e,o.match))return Td(o);continue}if(!$S(n,e,o.subcommand))continue;if(HS(e,new Set(o.block_args),r))return Td(o)}return null}function Td(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function FS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return zS(r,n.command_path,Pd(e))}function zS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function BS(e,t){return e===M(t)}function $S(e,t,n){if(!n)return!0;return Id(t,1,n,Ad(e))}function Id(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&US(e,i,n,r))return!0;continue}return s===n}return!1}function US(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Id(e,t+2,n,r)}function HS(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var jS=new Set(["-e","--source"]),VS=new Set(["-F","-v","--assign","--field-separator"]),kd=new Set(["-f","--file"]),KS=new Set(["print","printf","return"]),Od=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],qS="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Md(e,t,n){let r=!1;for(let o of YS(e)){let i=ZS(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",qS):null}function ia(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&jS.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(VS.has(a)||kd.has(a))){let l=e[s+1];if(i&&=l!==void 0,kd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function lr(e){return ia(e).sources}function YS(e){return lr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function ZS(e,t){Ee(t,e);let n=e.includes("system")?sa(e,t):null,r=XS(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function sa(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=No(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Nd(e,i+1);continue}if(s==="/"&&Dd(e,i)){i=Ld(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,ar(e[a-1])||ar(e[i]))continue;let l=Mo(e,i);if(e[l]!=="(")continue;l=Mo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=No(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Mo(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function XS(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=No(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=Nd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Dd(e,i)){let f=Ld(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(oa(e,i,"print")||oa(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=Mo(e,m);if(oa(e,d,"getline")){o=!0;let f=ev(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(nv(s,a)){o=!0;let f=QS(e,d);if(!f){r=!0,c=m,i=m;continue}if(!JS(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function ar(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Mo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function JS(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function No(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=tv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function QS(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return No(e,t,n)}function ev(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function tv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function oa(e,t,n){return e.startsWith(n,t)&&!ar(e[t-1])&&!ar(e[t+n.length])}function nv(e,t){return t!==null&&t>=e}function Nd(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Dd(e,t){let n=rv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(ar(e[r-1]))r--;return KS.has(e.slice(r,n+1))}function rv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Ld(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var ov=new Set(["sudo","env","command","builtin"]);function Do(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=iv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function iv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&sv(a,r);if(l)i.push(s);if(!l&&Lr.has(M(a)))break;if(o)break}return i}function sv(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||Xi.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Oe(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return ov.has(e.toLowerCase())}function zt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Fe(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Lo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Lo(e,t,n,r,o,i,s,a,l){let c=bo(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=Co(c.envSplitValues,u);if(!f)throw new N("derivedCommandShape");aa(a),yield*Lo(f,t,m,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new N("wrapperPeelIterations");let d=Do(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])aa(a),yield*Lo(f===d.childIndex?d.tokens:[...u.slice(f)],t,m,r,new Map(o),new Map(i),s,a,!0);return}if(lv(u)){aa(a),yield*Lo([...u.slice(1)],t,m,r,o,i,s,a,l);return}yield av(u,m,r,o,i,l)}function av(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function aa(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function lv(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function la(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function ze(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||ca(r,"recursive")){t=!0;continue}if(r==="-f"||ca(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Wd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>ca(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function ca(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var cv="find -delete permanently removes files. Use -print first to preview.",uv="find -exec rm -rf is dangerous. Use explicit file list instead.",dv=new Set(["-exec","-execdir","-ok","-okdir"]),mv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Gd(e,t){let n=e.map(w),r=fv(e,n,t);if(r)return r;if(Go(n,1)&&!gv(e,n,t)){let s=A(b("find.delete",cv),t.policy);if(s)return s}let o=t.budget??ye(),i=0;while(i<n.length){let s=n[i],a=ht(s??"");if(a>0){i+=a+1;continue}if(!Qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=cr(n,i);i=l.nextIndex;let c=yv(l.tokens,t.environment);if(c){let f=A(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=m?.id.startsWith("custom.")?m:A(m,t.policy);if(d)return d}return null}function fv(e,t,n){if(!Go(t,1)&&!ua(t,n.environment))return null;let o=Wo(e)??K(["."]),i=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=sr(s);for(let l of a.expandedTargets??[w(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Ae)}}if(pv(t)&&i.resolvedCwd&&ld(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return b("find.delete-git-metadata",Ae);return null}function ua(e,t){let n=0;while(n<e.length){if(!Qe(e[n])){n++;continue}let r=cr(e,n),o=Mt([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function pv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function gv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Wo(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Xs(o,n.environment),s=n.trustedTmpdirValue??Lt(o,n.environment),a=n.allowTmpdirVar??!or(o,n.environment),l=Gt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??gt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=sr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((m)=>Cd(m,l,{containmentTarget:hv(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function hv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Wo(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function yv(e,t){let n=ft([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&ze(n))return b("find.exec-rm-recursive-force",uv);return null}function cr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Go(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Qe(r)){n=cr(e,n).nextIndex;continue}let o=ht(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ht(e){return mv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Qe(e){return e!==void 0&&dv.has(e)}import{resolve as UE}from"node:path";function ur(e){let t=Me(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Cv=5,da="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function zd(e,t,n){let r=Fo(e,t,n),o=bv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Cv;a++){let{subcommand:l,rest:c}=xe(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=Rv(m);if(d===null||d.length===0)return{blockedReason:da,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:da,expanded:!0,tokens:i}}function Bd(e,t,n){return Fo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function xe(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=be.has(o)?2:1}return{subcommand:null,rest:[]}}function bv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Fo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=vv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Sv(e,t,n)]}}function Sv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=ma(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=ma(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Fd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Fd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(be.has(i)){o+=2;continue}o++}return r}function vv(e,t){let n=Ev(e,t),r=xv(e,t);return{blockedReason:n===null||r===null?da:null,entries:[...n??[],...r??[]]}}function Ev(e,t){let n=Ze("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=ur(n);if(!o)return null;for(let i of o){let s=ma(i);if(!s)return null;r.push(s)}return r}function xv(e,t){let n=Lu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ze(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ze(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function ma(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Fd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ze(e.slice(r+1),t,n)}}function Rv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return ur(t)}var _v="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",wv="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",Pv="git checkout --force discards uncommitted changes. Use 'git stash' first.",Av="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Tv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Iv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",kv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Ov="git switch --force discards uncommitted changes. Use 'git stash' first.",Mv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Nv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Dv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Lv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Wv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Gv="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Fv="git push --force destroys remote history. Use --force-with-lease for safer force push.",zv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",Bv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",$v="git branch -D force-deletes without merge check. Use -d for safe delete.",Uv="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",Hv="git merge --abort discards merge conflict resolutions. Use 'git status' first.",jv="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Vv="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Kv="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",qv="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Yv="git worktree remove --force can delete uncommitted changes. Remove --force flag.",Zv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Xv=new Set(["--recurse-submodules","--track","-t"]),fa=new Set(["-b","-B","-U"]),pa=new Set(["-c","-C"]),Jv=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var pn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Ud(e,t){let{subcommand:n,rest:r}=xe(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return yt(Qv(r,t));case"switch":return yt(tE(r));case"restore":return yt(rE(r));case"reset":return iE(r);case"clean":return yt(aE(r));case"rm":return yt(lE(r));case"push":return Bt(cE(r));case"branch":return Bt(mE(r));case"stash":return Bt(yE(r));case"worktree":return Bt(CE(r));case"rebase":return yt(fE(r));case"merge":return yt(pE(r));case"tag":return Bt(gE(r));case"reflog":return Bt(hE(r));default:return null}}function yt(e){return e?{...e,localDiscard:!0}:null}function Bt(e){return e?{...e,localDiscard:!1}:null}function Qv(e,t){let{index:n,before:r}=ie(e),o=de(r,{shortOptsWithValue:fa});if(r.some((a)=>O(a,"--force"))||o.has("-f"))return b("git.checkout-force",Pv);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(O(a,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",Tv)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return b("git.checkout-ref-path",Av);return b("git.checkout-double-dash",_v)}let i=nE(e);if(i.length>=2)return b("git.checkout-ambiguous",Iv);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>O(a,"--detach")||O(a,"--track")))return null;if(eE(s)||t(s))return b("git.checkout-double-dash",wv);return null}function eE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function tE(e){let{before:t}=ie(e);if(t.some((r)=>O(r,"--discard-changes")))return b("git.switch-discard-changes",kv);let n=de(t,{shortOptsWithValue:pa});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return b("git.switch-force",Ov);return null}function nE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(Zv.has(r)){n+=2;continue}if(Xv.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function rE(e){let t=oE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",Nv):b("git.restore-unstaged",Mv)}function oE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(Jv.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function iE(e){let t=null;for(let n of e){if(O(n,"--hard")){t=b("git.reset-hard",Dv);break}if(O(n,"--merge")){t=b("git.reset-merge",Lv);break}}if(!t)return null;return sE(e)?Bt(t):yt(t)}function sE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function aE(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return b("git.clean-force",Wv);return null}function lE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",Gv):null}function cE(e){let{before:t,after:n}=ie(e),r=de(t);if(t.some((s)=>O(s,"--mirror")))return b("git.push-mirror",Bv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||$d(t,n).some(uE))return b("git.push-force",Fv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||$d(t,n).some(dE))return b("git.push-delete",zv);return null}function $d(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function uE(e){return e.startsWith("+")||e.includes(":+")}function dE(e){return e.length>1&&e.startsWith(":")}function mE(e){let{before:t}=ie(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return b("git.branch-force-delete",$v);return null}function fE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.rebase-abort",Uv):null}function pE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.merge-abort",Hv):null}function gE(e){let{before:t}=ie(e);return de(t).has("-d")||t.some((r)=>O(r,"--delete"))?b("git.tag-delete",jv):null}function hE(e){return e[0]==="delete"?b("git.reflog-delete",Vv):null}function yE(e){for(let t of e){if(t==="drop")return b("git.stash-drop",Kv);if(t==="clear")return b("git.stash-clear",qv)}return null}function CE(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",Yv);return null}import{dirname as GE,isAbsolute as FE,join as om,resolve as zE}from"node:path";var ha="TMPDIR",ya="IFS",jd=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Vd=/^[A-Za-z_][A-Za-z0-9_]*$/,Kd=new Set(["export","typeset","declare","readonly"]),bE=new Set(["builtin","command","time"]),qd=new Set(["do","then","else"]),SE=new Set(["do","then","case"]),Hd=new Set(["done","fi","esac"]),vE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Yd(e,t){return e.map((n)=>n.provenance==="variable"&&tm(n.text)?dr(n.text,t.shellAssignments):w(n))}function dr(e,t){return e.replace(vE,(n,r,o)=>t.get(r??o??"")??n)}function Zd(e,t){return{env:e,effectiveEnvAssignments:_E(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Xd(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ca(e,t){let n=Qd(e,t),r=e[0]??"";if(SE.has(r))t.bodyDepth+=1;if(r==="elif"||Hd.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(Hd.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);ba(t,a)});let o=n.commandIndex;if(o!==-1&&Kd.has(e[o]??""))e.filter((a)=>Vd.test(a)&&ga(a)).forEach((a)=>{wE(t,a)});let i=o===-1?-1:em(e,o);if(i===-1||e[i]!=="unset")return;let s=AE(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(qd.has(r)){t.shellAssignments.set(a,"");return}PE(t,a)})}function Jd(e,t){let n=Qd(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Qd(e,t){let n=qd.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!tm(a)),o=r!==-1&&Kd.has(e[em(e,r)]??""),i=RE(t);return{assignments:e.flatMap((a,l)=>{let c=EE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!go(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function em(e,t){let n=t;while(bE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function tm(e){return Pe(e)!==null||jd.test(e)}function EE(e,t,n){return Pe(e)??xE(e,t,n)}function xE(e,t,n){let r=ho(e,n,t);if(r)return r;let o=e.match(jd)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function ga(e){return e===ha||e===ya||Us(e)}function RE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function _E(e,t){let n=[ha,ya].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ba(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function wE(e,t){ba(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function PE(e,t){if(!ga(t)&&!Vd.test(t))return;if(e.shellAssignments.set(t,""),go(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!ga(t)||t===ha||t===ya||Nn(t)){ba(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function AE(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as TE}from"node:path";function zo(e,t){return $s.some((n)=>t?.has(n)||e.has(n))}function gn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(TE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=nm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=nm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=be.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function nm(e,t,n){try{let r=mt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function rm(e,t,n){if(!t.localDiscard||!n.worktreeMode||zo(n.environment.env,n.envAssignments))return null;let r=gn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Sa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Sa(e,t,n){let{subcommand:r,rest:o}=xe(e),i=r?.toLowerCase();if(t.dynamicArguments||IE(o)||DE(e,t.environment.env,t.envAssignments,n)||ME(o)||kE(i,o))return!0;return i==="clean"&&NE(o)>1}function IE(e){return e.some((t)=>/[$*?[]/.test(t))}function kE(e,t){if(e==="checkout"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:fa}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:pa}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||OE(s))||r.has("-C");return o&&i}return!1}function OE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function ME(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function NE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function DE(e,t,n,r){if(Ze("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Fo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>WE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||LE(s.value);if(Gu(n))return!0;return r.recursiveSubmodules}function LE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function WE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function im(e,t,n){let r=e.map(w),o=n.environment.paths,i=gn(r,n.cwd,o),s=n.originalCwd?o.realpath(zE(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||zo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?$E(e,n.shellAssignments,o):sm(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!BE(a,r,t,n)||!mn(a,n.environment)||To(a,n.environment)||Io(s,a)||Io(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function BE(e,t,n,r){let o=r.environment.paths,i=om(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!Sa(t,r,s)}function $E(e,t,n){let r=xe(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?dr(a,t??new Map):a;if(!FE(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function sm(e,t){if(t.entryKind(om(e,".git"))!=="missing")return e;let n=GE(e);return n===e?null:sm(n,t)}var HE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",jE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Bo(e,t){return am(e,t)}function am(e,t,n){let r=e.map(w),o=zd(r,t.environment.env,t.envAssignments),i=o.blockedReason?A(b("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Wu(t.envAssignments)||Bd(r,t.environment.env,t.envAssignments))&&VE(s))return b("git.ssh-env",HE);let a=Ud(s,(c)=>{let u=gn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(UE(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=rm(r,a,t)??im(e,a,t);if(!l)return a;return n?.(l),null}function lm(e,t){let n=null;return{match:am(e,t,(o)=>{n=o}),relaxation:n}}function VE(e){let{subcommand:t,rest:n}=xe(e),r=t?.toLowerCase();if(!r)return!1;if(jE.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&KE(n)}function KE(e){return e.find((t)=>!qE(t))?.toLowerCase()==="update"}function qE(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as Tx}from"node:path";function cm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function $o(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var um="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",YE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ZE="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",mm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",XE="rm -rf in home directory is dangerous. Change to a project directory first.",dm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:mm},git_metadata_target:{id:"rm.git-metadata",reason:Ae},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:ZE},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:XE},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:um},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:YE},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:um}};function Uo(e,t){let n=Gt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=ze(r),i=Wd(r),s=QE(e);for(let a of s){let l=sr(a.word);if(o&&l.unsafeBraceExpansion){let c=A(ir({kind:"outside_anchored_cwd"},n,t.policy,dm),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=Ce(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return b("rm.git-metadata",Ae);if(i&&!o){let d=Ge(u,n,m);if(d.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",mm);if(d.kind==="git_metadata_target")return b("rm.git-metadata",Ae);continue}if(!o)continue;for(let d of JE(u,n,m)){let f=ir(d,n,t.policy,dm),p=A(f,t.policy);if(p)return p}}}return null}function JE(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function QE(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},$t={kind:"dynamic"},ex=new Set(["<","<<","<<-","<<<","<&","<>"]),pm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,tx=/^(?:[0-9]+|[@*])$/,nx=dt.maxWords,rx=dt.maxInputLength;function gm(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Wo(e){let t=lr(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(Go))return Bt;return{kind:"literal",source:n.map(w).join(" ")}}function Jd(e){let t=lr(e[1])==="--"?2:1,n=e[t],r=lr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!Go(n))return Bt;return{kind:"literal",source:r}}function Fo(e,t){let n=ME(e);if(n===-1)return Ct;let r=NE(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=LE(s,e,n,r.ifs);if(!a)return Bt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>IE||i>kE)return Bt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(FE)].filter((s)=>s!==null).join(" ")}}function Qd(e,t,n,r){if(!Se(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&AE.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Bt;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?Bt:{kind:"literal",source:r}}function et(e){let t=Se(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=lr(n);return io(n,r)?{kind:"literal",source:r}:Bt}var OE=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ma(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||we(s)!==null)return!1;let a=k(M(s));return!OE.has(a)&&!J.has(a)&&!Ft(a)}function ME(e){return Se(e.map(w)).commandIndex??-1}function NE(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(DE);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function DE(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function LE(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?ua(o):WE(o,r);if(e.parameter==="*"){let a=ua(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:da(l,r)}let i=t[n+1+e.parameter];if(i&&!Go(i))return;let s=lr(i);return e.quoted?[s]:da(s,r)}function ua(e){return e.every(Go)?e.map(w):void 0}function WE(e,t){let n=ua(e);if(!n)return;let r=n.map((o)=>da(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function da(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Ho(e){let t=mr(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(Vo))return $t;return{kind:"literal",source:n.map(w).join(" ")}}function hm(e){let t=mr(e[1])==="--"?2:1,n=e[t],r=mr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!Vo(n))return $t;return{kind:"literal",source:r}}function jo(e,t){let n=ix(e);if(n===-1)return Ct;let r=sx(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=lx(s,e,n,r.ifs);if(!a)return $t;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>nx||i>rx)return $t;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(ux)].filter((s)=>s!==null).join(" ")}}function ym(e,t,n,r){if(!Se(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&ex.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return $t;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?$t:{kind:"literal",source:r}}function et(e){let t=Se(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=mr(n);return lo(n,r)?{kind:"literal",source:r}:$t}var ox=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Ra(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=k(M(s));return!ox.has(a)&&!J.has(a)&&!Ft(a)}function ix(e){return Se(e.map(w)).commandIndex??-1}function sx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(ax);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function ax(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function lx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?va(o):cx(o,r);if(e.parameter==="*"){let a=va(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Ea(l,r)}let i=t[n+1+e.parameter];if(i&&!Vo(i))return;let s=mr(i);return e.quoted?[s]:Ea(s,r)}function va(e){return e.every(Vo)?e.map(w):void 0}function cx(e,t){let n=va(e);if(!n)return;let r=n.map((o)=>Ea(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ea(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Go(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function lr(e){return e?w(e):""}function FE(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function pa(e,t){return fa(Oe(e,"posix"),t)}function ur(e){return pa(e,new Set(Array.from(e.matchAll(Zd)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function fa(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(fa(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>fa(o,n))||ef(r.words,n))return!0;UE(r,n)}return!1}function ef(e,t){let n=e.findIndex((s)=>we(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(cr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Yd(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Se(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Yd(s[l],t)}let i=GE(e,n,t);if(i===null)return!1;if(i===-1)return!0;return ef(e.slice(i),t)}function GE(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return zE(e,t+1);if(r==="exec")return BE(e,t+1);if(r==="env")return $E(e,t+1,n);return null}function zE(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function BE(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function $E(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return cr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return cr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(we(i))continue;return r}return null}function UE(e,t){if(!e.words.every((n)=>we(n.text)!==null))return;for(let n of e.words){let r=we(n.text);if(!r)continue;if(cr(n,t))t.add(r.name)}}function cr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Zd)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(TE.test(o)||t.has(o))}))}function Yd(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||cr(e,t))}var HE=["--init-file","--rcfile"],jE=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function tt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return tf(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=tf(e,t,!1);if(r!==null)return r}}return null}function nt(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Se(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function tf(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function nf(e){let t=k(e[0]??"").toLowerCase(),n=VE(e,t),r=jE.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function VE(e,t){let n=Se(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?HE.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let d=l.split("=",1)[0]??l;if(t==="bash"&&Ui.has(d)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Hi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var ga="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ha="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",KE="__CC_SAFETY_NET_XARGS_INPUT__",zo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Bo="rm",qE=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,YE=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,ZE=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,XE=/^(?:[0-9]+|[@*])$/;function sf(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=$t(n),i=n.slice(r),s=b("xargs.shell-dynamic",ha);if(QE(i,o,t)&&A(s,t.policy))return A(s,t.policy);for(let a of Fe(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?A(s,t.policy):null;if(c)return c;let f=df(l,o,a.wrapperEnvAssignments),d=a.head==="rm"&&o!==null&&cf(l,o),u=t.analyzeChild(l,{...Gt(a,t),dynamicInput:f,dynamicSourceInput:d||lf(l,a.head,o,a.wrapperEnvAssignments,f,t.environment),dynamicRmInput:d,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",ga)});if(u)return u;let m=JE(l,o,t.policy?.rules??[],A(s,t.policy));if(m)return m;if(a.head==="git"){let h=o===null?[...l,KE]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...Gt(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=Je(l,t.policy?.rules??[]);if(p)return p}return null}function JE(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function af(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=jd(e,r,t.length,n);return o===null?[]:[o]}function lf(e,t,n,r,o,i){if(J.has(t)){if(nt(e))return!1;if(n!==null&&eR(e,n))return!0;let s=tt(e);if(!s){let a=et(K(e));if(a.kind==="literal")return n!==null&&a.source.includes(n);return a.kind==="none"&&o}if(n!==null&&s.includes(n))return!0;if(Ye(s))return!0;return tR(s,n,r)}if(ke(t))return rf(e,n,uo,Pu(t));if(_e.has(t))return rf(e,n,ea,Pd);if(t==="eval"){let s=Wo(K(e));if(s.kind==="dynamic")return!0;if(n!==null)return s.kind==="literal"&&s.source.includes(n);return o}if(t==="find")return nR(e,n,i);if(t==="git"){let s=ze(e);return n===null?s.subcommand===null:(s.subcommand?.includes(n)??!1)||s.subcommand!==null&&mn.has(s.subcommand.toLowerCase())&&uf(s.rest,n).some((a)=>a.includes(n))}return!1}function rf(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,zo]).sources.some((a)=>a.value===zo);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${zo}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${zo}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>af(l,t,a))));return Do(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function QE(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Fe(e,n),(i)=>i.head)),o=t===null?[...e,Bo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Bo));return Array.from(Fe(o,n)).some((i)=>i.head===Bo&&!r.has(Bo))}function cf(e,t){return uf(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function uf(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function df(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function eR(e,t){let n=Se(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return af(i,t,o).some((l)=>{let c=e.map((d,u)=>u===s?d.replaceAll(t,l):d),f=Se(c);if(f.commandIndex===null&&f.scriptIndex===null)return!1;if(n.commandIndex===null&&f.commandIndex!==null)return!0;if(n.scriptIndex===null&&f.scriptIndex!==null)return!0;if(f.commandIndex!==null&&(c[f.commandIndex]??"").includes(l))return!0;return f.scriptIndex!==null&&(c[f.scriptIndex]??"").includes(l)})}))}function tR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(qE))if(of(o,r))return!0;for(let o of e.matchAll(YE))for(let i of(o[1]??"").matchAll(ZE))if(of(i,r))return!0;return pa(e,r)}function of(e,t){let n=e[1]??e[2];return n!==void 0&&(XE.test(n)||t.has(n))}function nR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Qe(s)){let l=sr(e,i);i=l.nextIndex-1;for(let c of Fe(l.tokens,{environment:n,cwd:void 0})){let f=df(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&cf(c.tokens,t)||lf(c.tokens,c.head,t,c.wrapperEnvAssignments,f,n))return!0}continue}let a=ht(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function $t(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var dr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",fr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",oR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",iR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Uo=/\{[^{}\s]*\}/g,ff=/\{\}|\{-?\d+\}/g,sR=["e","f","source","file","-e","-f","--source","--file"],aR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],lR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),cR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),mf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),uR=new Set(["--workdir","--wd"]),pf="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ae(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function bf(e){return Ae([...e],(t)=>Ye(t))}function Sf(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=pn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Tf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:f,dryRun:d}=o;if(c){let p=pn(t);if(p)return p;let h=bf(t.envAssignments?.values()??[]);if(h)return h}if(l){let p=hR(t);if(p)return p}if(f!==void 0&&a){let p=pn(t);if(p)return p}let u=yR(f,t.cwd,t.environment.paths);if(u===null){let p=pn(t);if(p)return p}let m=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(d){if([...Fe(i,m)].flatMap((h)=>[...h.envAssignments.values()]).some(ba)){let h=pn(t);if(h)return h}return null}if(i.length===0){let p=s.map((g)=>g[0]??"");t.budget.charge("derivedTokens",p.length);let h=xf(m.envAssignments,m.cwd,a);return Ae(p,(g)=>t.analyzeNested(g,h))}return Ae(Fe(i,m),(p)=>dR(p,o,t,m))}function dR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(Pf)){let g=pn(n);if(g)return g}let f=bf(c);if(f)return f;let d=c.some(F),u=i||d,m=a&&u,p=xf(e.envAssignments,e.wrapperCwd,s||m);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Ae(o,(E)=>n.analyzeChild($o(l,E,n.budget),Gt(e,r)))};if(nt(l))return g();let y=tt(l);if(y){if(Af(y)){let R=bt(n);if(R)return R;if(o.length===0)return null;return Ae(o,(P)=>n.analyzeNested(yf(y,P,n.budget),p))}if(F(y)){if(o.length>0)return Ae(o,(q)=>n.analyzeNested(yf(y,q,n.budget),p));let R=ar(y);if(R?.[0]&&M(R[0])==="rm"&&Ge(R)){let q=hf(n);if(q)return q}let P=R?n.analyzeChild(R,{...Gt(e,r),dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",fr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",dr)}):null;if(P)return P;return n.analyzeNested(y,p)}let E=!d&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((R)=>Fo(K(R===void 0?l:i?l.map((P)=>_f(P,R)):[...l,...R]),y)):[];if(E.some((R)=>R.kind==="dynamic")){let R=bt(n);if(R)return R}let S=E.flatMap((R)=>R.kind==="literal"?[R.source]:[]);if(S.length>0)return n.budget.charge("derivedTokens",S.length),Ae(S,(R)=>n.analyzeNested(R,p));if(ur(y)){let R=bt(n);if(R)return R}let T=n.analyzeNested(y,p);if(T)return T;if(u)return bt(n);return null}let v=et(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&F(v.source))return bt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=bt(n);if(E)return E;let S=g();if(S)return S;if(i)return null;let T=o.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return n.budget.charge("derivedTokens",T.length),Ae(T,(R)=>n.analyzeNested(R,p))}if(u||a)return bt(n)??g();return null}if(e.head==="rm"&&Ge(l)){if(i&&o.length>0)return Ae(o,(y)=>ya($o(l,y,n.budget,ff),e.cwd,r));if(o.length>0)return Ae(o,(y)=>ya(Cf(l,y,n.budget),e.cwd,r));let g=ya(l.flatMap((y,v)=>{if(v===0||!F(y))return[y];return y.startsWith("-")?[y.replace(ff,"")]:[]}),e.cwd,r);if(g)return g;return hf(n)}let h=o.length>0?o:[void 0];return Ae(h,(g)=>{let y=g===void 0?l:i?$o(l,g,n.budget):Cf(l,g,n.budget),v=b("parallel.shell-dynamic",fr),E=a&&e.head==="find"?gR(y,r):null,S=Ef(y,a,n)??E?.customResult??null,T=M(e.head),R=a&&(T==="rm"&&Ca(y)||T==="xargs"&&Rf(y)||E?.rmOptions===!0),P=a&&(R||E?.executedSource===!0||E===null&&vf(y,T)),q=n.analyzeChild(y,{...Gt(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:R,dynamicSourceInput:S!==null||P,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",dr)});if(P){let Z=A(v,n.policy);if(Z)return Z}return q??S??Je(y,n.policy?.rules??[])})}function vf(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return pR(e);if(t==="git")return fR(e);if(t==="find")return!0;if(_e.has(t))return gf(e,sR,ir);if(ke(t))return gf(e,aR,co);return!1}function Ca(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||Af(o)))}function fR(e){if(mR(e))return!0;let t=ze(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!mn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function mR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function pR(e){if(nt(e))return!1;let t=tt(e);if(t!==null)return F(t);let n=et(K(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function gf(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,pf]).some((o)=>o.value===pf);return Do(r,t,(o)=>n(e.map((i)=>_f(i,[o]))))}function Ef(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return bt(n);return Ae(o,(i)=>Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function gR(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of Fe(i,t))n.executedSource||=vf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ca(a.tokens)||a.head==="xargs"&&Rf(a.tokens),n.customResult??=Ef(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Qe(a)){i=[],n.executedSource||=F(a);continue}let l=ht(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function Rf(e){let t=e.slice($t(e).childStart);return M(t[0]??"")==="rm"&&Ca(t)}function Ho(e,t){return(n)=>A(b(e,t),n.policy)}var bt=Ho("parallel.shell-dynamic",fr),hR=Ho("parallel.command-stream-dynamic",oR),pn=Ho("parallel.command-stream-dynamic",iR),hf=Ho("parallel.rm-recursive-force-dynamic",dr);function ya(e,t,n){return A(Lo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Lt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function xf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function _f(e,t){return e.replace(Uo,(n)=>wf(n,t))}function $o(e,t,n,r=Uo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=wf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function yf(e,t,n){return $o([e],t,n)[0]??""}function Cf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function wf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(Uo)!==-1}function Pf(e){if(ba(e))return!0;for(let t of e.matchAll(Uo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function ba(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Af(e){return/^\{[^{}\s]*\}$/.test(e)}function yR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!rR(e))return null;try{return ft(t??e,e,n)}catch{return null}}function Tf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ra(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ra(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||cR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(mf.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=mf.has(p)?2:1;continue}if(uR.has(y)){c=!0;let E=v??h;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(lR.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?ba:Pf);let f=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){f.push(p),p=[];continue}if(g!==void 0)p.push(g)}f.push(p)}c||=f.length>1;let d=CR(f),u=n.some(F),m=n.length===0&&o===-1;return{template:n,jobs:d,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:m,unsupported:c,workdir:a,dryRun:l}}function CR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function If(e){return Tf(e).childStart}var bR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",jo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function va(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Sa(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Of(e,t,n,r,o=!1,i){let a=(Fn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",bR):null;return A(a,i)??Mf(e,t,n,o,i)}function Mf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>va(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=on(e,t),l=vR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((d)=>d<=l))return A(b("shell.dynamic-structure",jo),o);if(A(No(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),f=a.findIndex((d,u)=>u>l&&w(d)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&mn.has(c)&&i.some((d)=>d>l&&(f===-1||d<f)))return A(b("shell.dynamic-structure",jo),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&ER(t)?A(b("shell.dynamic-structure",jo),o):null;if(s==="rm"){let a=t.findIndex((c,f)=>f>0&&w(c)==="--"),l=Ge(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?A(b("shell.dynamic-structure",jo),o):null}if(s==="xargs")return kf(e,t.slice($t(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return kf(e,t.slice(If(t.map(w))),"parallel",n,r,o);return null}function kf(e,t,n,r,o,i){if(t.length===0)return null;let s=SR(t,r);if(Fn(e,s)){let l=A(b(`${n}.shell-dynamic`,n==="xargs"?ha:fr),i);if(l)return l}let a=Mf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>va(l)&&Sa(l)))return A(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?ga:dr),i);return null}function SR(e,t){let n=Ot(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function vR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(be.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function ER(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=va(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Sa(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Sa(s)))return!0;continue}if(t=!0,a)return!0;let l=ht(s.text);if(l>0){n=l;continue}if(Qe(s.text))o=!0,r=!0}return!1}function Ea(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!io(t[n.tokenIndex],n.value)})}var RR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",xR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",_R="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Nf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",RR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",xR);if(e==="shred"&&n.length>0)return b("shred.target",_R);return null}var Lf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Lo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>No(e.words,Ra(e))},{heads:new Set(["find"]),analyze:(e)=>Md(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>sf(e.words,{...Df(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Sf(e.words,{...Df(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})}];function Df(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ut(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Ra(e){return{environment:e.options.environment,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var zf="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function Bf(e){return Lf.find((t)=>t.heads.has(e))?.analyze}function hn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,f=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,d=s?s.originalCwd:c?void 0:n.cwd,u=po(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let m=Ot(u.words,n.environment,f,new Map([...n.envAssignments??[],...u.envAssignments])),p=m.envSplitValues??[];if(p.length>0){let x=[...p,...i(m.words)].join(" "),I=Ye(x);if(I)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:I.reason}),ue(I);if(n.strict)return he(r);let L=go(p,i(m.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:m.cwd===void 0?n.effectiveCwd:m.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments])});if(te)return te}}let h=m.rewritten?K(i(m.words)):on(o,m.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>h.length){let x=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments]),E=g[0];if(!E)return null;if(Ft(E))throw new N("wrapperPeelIterations");let S=M(E),T=m.cwd===null?void 0:m.cwd??f,R=m.cwd===null?void 0:d,P=m.cwd===void 0?n.effectiveCwd:m.cwd,q=s?s.allowTmpdirVar:!tr(v,n.environment),Z=Of(o,m.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),ue(Z);let ee=To(g,n.policy);if(ee){for(let x of[ee.childIndex,...ee.alternativeChildIndices]){Wf(y.wrapperNormalizationBudget);let I=h.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=hn(I,t,{...y,effectiveCwd:P,envAssignments:v});if(L)return L}return null}let X=l?void 0:S==="eval"?Wo(h):S==="trap"&&!a?Jd(h):void 0;if(a&&s&&S==="eval"){if(X?.kind==="dynamic")return gn(s,n.policy);if(X?.kind==="literal"){let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v});if(x)return x}return yn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!ma(n.commandView)))return he(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:S==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?J.has(S):Uf(E,S)){if(nt(g))return null;if(a&&s){let x=tt(g);if(x){if(s.dynamicSourceInput??s.dynamicInput){let L=gn(s,n.policy);if(L)return L}if(ur(x)){let L=gn(s,n.policy);if(L)return L}return n.analyzeNested(x,{effectiveCwd:P,envAssignments:v})}let I=et(h);if(I.kind==="dynamic")return gn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?gn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?gn(s,n.policy):null}if(l){let x=tt(g),I=x?n.analyzeNested(x,{effectiveCwd:P,envAssignments:v}):et(h).kind==="dynamic"?he(r):null;if(I)return I}if(s===void 0){let x=TR(g,v,P,n,r,t);if(x)return x;let I=tt(g);if(I){let Kt=Fo(h,I);if(Kt.kind==="dynamic")return he(r);let ui=Kt.kind==="literal"?Kt.source:I,Qa=IR(ui);r?.recordSegment({type:"shell-wrapper",wrapper:S,innerCommand:Qa}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Qa,depth:t+1});let el=n.analyzeNested(ui,{effectiveCwd:P,envAssignments:v});if(el)return el;return ur(ui)?he(r):null}let L=et(h);if(L.kind==="dynamic")return he(r);if(L.kind==="literal")return Ko(L.source,P,v,n,r,t);let te=Qd(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return he(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:P,envAssignments:v})}}if(!s&&(S==="source"||S===".")){let x=g[1]==="-p"?2:null;if(x!==null){let Kt=n.commandView?h[x]:void 0;if(!Kt)return null;if(Kt.provenance!=="literal")return he(r)}let I=x===null?1:3,L=g[I]==="--"?I+1:I,te=n.commandView?h[L]:void 0;if(!te)return null;if(te.provenance==="literal")return Ko(te.text,P,v,n,r,t);if(n.strict||!n.commandView||!ma(n.commandView))return he(r)}if(_e.has(S)&&!l){if(!s&&n.strict&&Ea(ir(g),h))return he(r);let x=Ad(g,(L)=>Ut(n.analyzeNested(L,{effectiveCwd:P,envAssignments:v}))),I=A(x,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),ue(I)}if(ke(S)&&!l){if(!s&&n.strict&&Ea(co(g),h))return he(r);let x=wu(g);if(a&&s)return PR(S,x,P,v,n,s);if(x){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:S,codeArg:x,paranoidBlocked:I}),I){let te=A(b("interpreter.one-liner-paranoid",Vn),n.policy);if(te)return ue(te)}if(Ns(S,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let L=n.analyzeNested(x,{effectiveCwd:P,envAssignments:v});if(L&&!$f(L,x))return L;if(Kn(x)){let te=A(b("interpreter.dangerous-command",ln),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:ln}),ue(te)}r=void 0}}if(S==="busybox"&&g.length>1)return Wf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),hn(h.slice(1),t,{...y,effectiveCwd:P,envAssignments:v});let D=s?null:A(Nf(S,g),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),ue(D);let le=r===y.trace?y:{...y,trace:r},xe={words:h,head:S,cwd:T,originalCwd:R,envAssignments:v,allowTmpdirVar:q,dynamicArguments:m.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:P,options:le,analyzeChildTokens:(x,I)=>a&&s?xa(x,t,le,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ut(hn(K(x),t+1,{...le,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:v}))??Je(x,le.policy.rules),analyzeChild:(x,I)=>xa(x,t,le,I)},je=s&&(S==="xargs"||S==="parallel")?void 0:Bf(S);if(S==="rm"||S==="xargs"||S==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let Te=r&&S==="git"?Hd(xe.words,Ra(xe)):void 0,li=Ff(Te?Te.match:je?.(xe)??null,n.policy);if(r)kR(xe,li,Te?.relaxation??null);if(li)return ue(li);if(a&&s&&(S==="rm"||S==="rmdir")){if(!(S==="rm"&&(Ge(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?yn(s,n.policy):null)??AR(s,n.policy)}let Xa=je!==void 0,Ja=!s&&!Xa&&!Mr.has(S),ci=r&&Ja?[]:void 0;if(Ja)for(let x=1;x<g.length;x++){let I=g[x];if(!I)continue;ci?.push(I);let L=Ff(wR(g,x,t,le,T,R,P,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:ci??[],embeddedCommandFound:M(I)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:ci??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&Xa)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let vr=Je(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!vr,reason:vr?.reason}),vr)return ue(vr);return a&&s?yn(s,n.policy):null}function xa(e,t,n,r){return Ut(hn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function wR(e,t,n,r,o,i,s,a){for(let l of Fe(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let f=M(c);if(Uf(c,f)||Bf(f)!==void 0&&f!=="xargs"&&f!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=xa(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!tr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function PR(e,t,n,r,o,i){if(!t)return yn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=A(b("interpreter.one-liner-paranoid",Vn),o.policy);if(a)return ue(a)}if(Ns(e,t))return yn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!$f(s,t))return s;if(Kn(t)){let a=A(b("interpreter.dangerous-command",ln),o.policy);if(a)return ue(a)}return yn(i,o.policy)}function $f(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(wo)||e.reason===fn)&&!Nr(t)}function gn(e,t){let n=e.shellDynamicMatch?A(e.shellDynamicMatch,t):null;return n?ue(n):null}function yn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?A(e.dynamicSourceMatch,t):null;return n?ue(n):null}function AR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?A(e.rmDynamicMatch,t):null;return n?ue(n):null}function TR(e,t,n,r,o,i){let s=nf(e);if(s.argvSource?.kind==="absent")return he(o);if(s.argvSourceApplies&&s.argvSource){let l=Ko(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Ko(a,n,t,r,o,i,!0)}function Ko(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return he(o);let a=jn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?he(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function IR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function kR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function Wf(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function he(e){return e?.recordSegment({type:"error",message:zf}),ue(OR())}function OR(){return{id:"",reason:zf,intent:"stop_and_explain"}}function Uf(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function Ff(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:A(e,t)}var MR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,NR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function DR(e,t){let n=Vf(e,t);if(n.length===0)return!1;let r=n[jf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return MR.test(e.join(" "))}function Hf(e,t,n,r){if(e.dialect==="powershell"){let a=LR(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return Gf(zR(a.target),t,n.paths)}let o=e.words.map(w);if(!DR(o,n))return;if(!t)return null;let i=Vf(o,n,t),s=jf(i);if(s===-1||i[s]!=="cd")return null;return Gf(i[s+1],t,n.paths)}function Gf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return BR(ft(t,e,n),t,n)?t:null}catch{return null}}function LR(e,t){let n=WR(e[0])?1:0,r=e[n];if(!FR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!NR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return GR(e.slice(n+1),t)}function WR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function FR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function GR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function zR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function jf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Vf(e,t,n){let r=$R(e);return mt([...r],t,n)}function BR(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return Vo(e)===Vo(t);return Vo(r)===Vo(o)}function $R(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var wa="TMPDIR",Pa="IFS",Kf=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,qf=/^[A-Za-z_][A-Za-z0-9_]*$/,Yf=new Set(["export","typeset","declare","readonly"]),UR=new Set(["builtin","command","time"]);function Zf(e,t){return{env:e,effectiveEnvAssignments:qR(e,t),shellAssignments:new Map}}function Xf(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function Aa(e,t){let n=Qf(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),Ta(t,s)});let r=n.commandIndex;if(r!==-1&&Yf.has(e[r]??""))e.filter((s)=>qf.test(s)&&_a(s)).forEach((s)=>{YR(t,s)});let o=r===-1?-1:em(e,r);if(o===-1||e[o]!=="unset")return;let i=XR(e,o);if(i===null)return;e.slice(i).forEach((s)=>{ZR(t,s)})}function Jf(e,t){let n=Qf(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Qf(e,t){let n=e.findIndex((s)=>!HR(s)),r=n!==-1&&Yf.has(e[em(e,n)]??""),o=KR(t);return{assignments:e.flatMap((s,a)=>{let l=jR(s,o,t.env);if(!l)return[];if(n!==-1&&a>n&&!r&&!fo(l.name))return[];return o.set(l.name,l.value),[{...l,persists:n===-1||r}]}),commandIndex:n}}function em(e,t){let n=t;while(UR.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function HR(e){return we(e)!==null||Kf.test(e)}function jR(e,t,n){return we(e)??VR(e,t,n)}function VR(e,t,n){let r=mo(e,n,t);if(r)return r;let o=e.match(Kf)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function _a(e){return e===wa||e===Pa||Ws(e)}function KR(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function qR(e,t){let n=[wa,Pa].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Ta(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function YR(e,t){Ta(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function ZR(e,t){if(!_a(t)&&!qf.test(t))return;if(e.shellAssignments.set(t,""),fo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!_a(t)||t===wa||t===Pa||kn(t)){Ta(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function XR(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var JR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Ht="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Na(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Oe(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((f)=>f.code.includes("heredoc"));if(c){if(!n.strict)return Ma(e,n);let f=`${wo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:f}),{reason:f,segment:e,intent:"stop_and_explain"}}return sm(e,n),{reason:fn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return sm(e,n),{reason:fn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Ma(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Zf(n.environment.env,n.envAssignments);return Zo(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function Zo(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let f=e.nodes[l+1],d=f?.kind==="connector"?f.operator:void 0,u=QR(e,l,c,a,d),m=a==="&&"||a==="||",p=m?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=m||bn(d);if(c.kind==="function"){let Z=h.flatMap((X)=>{let U=mr(X);return U.functionDefinitions.set(c.name,c.body),Ia(X,[U],u,d==="&",bn(d))}),ee=ka(Z,[],g,y,a,d);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of h){let D=Zo(c.body,t,n,r,[mr(U)]);if(D.result)return D;if(Z.push(...Ia(U,D.states,u,d==="&",bn(d))),v)ee.push(U,...u?D.states.map((le)=>qo(U,le)):D.states)}let X=ka(Z,ee,g,y,a,d);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),S=e.nodes[l-2],T=Xo(a)&&S?.kind==="command"?Xd(S)??tx(S):void 0,R=[],P=[];for(let Z of h){let ee=nx(c,t,n,r,[mr(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>qo(Z,U));for(let U of X){let D=mr(U),le=ix(c,t,n.trace?{...n,trace:am(n.trace,E)}:n,r,D,Xo(a),T);if(le)return{result:le,states:i};let xe=Cx(c,D.functionDefinitions);if(xe)n.budget.charge("derivedTokens",Jo(xe));let je=xe?t+1>=V.recursionDepth.cap?Oa(c.displayText,n,[D]):Zo(xe,t+1,n,r,[D]):{result:null,states:[D]};if(je.result)return je;if(R.push(...Ia(Z,je.states,u,d==="&",bn(d))),v)P.push(Z),P.push(...je.states.map((Te)=>u?qo(Z,Te):Te))}}let q=ka(R,P,g,y,a,d);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function QR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(Xo(r)||Xo(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&ex(e,t)}function Ia(e,t,n,r,o){let i=n?t.map((a)=>qo(e,a)):[...t],s=o?i.flatMap((a)=>Cn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function qo(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function ex(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(rx(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Xo(e){return e==="|"||e==="|&"}function tx(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function bn(e){return e==="&&"||e==="||"}function ka(e,t,n,r,o,i){let s={success:Yo([...n,...e]),failure:Yo([...r,...t])},a=bn(i)?s:void 0;return{states:bn(o)||a?Yo([...s.success,...s.failure]):s.success,conditionalStates:a}}function am(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function nx(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=ox(e);if(s){if(t+1>=V.recursionDepth.cap)return Oa(s,n,o);let a=Oe(s,"powershell");if(a.status==="limited")return Oa(s,n,o);if(a.status!=="complete")return tm(i,n,r,o);n.budget.charge("derivedTokens",Jo(a)),i.push({program:a,depth:t+1})}}return tm(i,n,r,o)}function rx(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function tm(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=Zo(i.program,i.depth,t,n,[mr(a)]);if(l.result)return l;s.push(...l.states)}o=Yo(s)}return{result:null,states:o}}function ox(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function Jo(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+Jo(o),0):n.kind==="group"||n.kind==="function"?Jo(n.body):0),0)}function Oa(e,t,n){return t.trace?.recordSegment({type:"error",message:$e}),{result:{reason:$e,segment:e,intent:"stop_and_explain"},states:[...n]}}function ix(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=fx(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};lm(e,o,"before-consumer",a.environment.paths,a.budget);let c=on(e.dialect,e.words).map(w),f=e.displayText,d=Jf(c,o.shellGitContextState);if(e.dialect==="powershell"){let p=A(Sd(e,i,Sx(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!p,reason:p?.reason}),p)return bx(f,p)}if(c.length===1&&c[0]?.includes(" ")&&!Fn(e.dialect,e.words)){let p=A(Ye(c[0]),a.policy),h=p!==null&&!a.strict&&vu(e,a.rootProgram);if(p&&!h)return a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!0,reason:p.reason}),{reason:p.reason,segment:f,ruleId:p.id,intent:p.intent};a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!1});let g=nm(e,l,o,d,s,a);if(g)return g;return Aa(c,o.shellGitContextState),null}let u=hn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:d,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(p,h)=>{let g=h&&Object.hasOwn(h,"effectiveCwd")?h.effectiveCwd:o.effectiveCwd,y=Na(p,t+1,{...a,effectiveCwd:g,envAssignments:h?.envAssignments??d,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:h?.functionDefinitions,worktreeMode:h?.worktreeMode??a.worktreeMode,trace:a.trace?am(a.trace,a.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(u)return{...u,segment:f};let m=nm(e,l,o,d,s,a);if(m)return m;return Aa(c,o.shellGitContextState),null}function nm(e,t,n,r,o,i){let s=mx(e,t,n,r??new Map,i);if(s)return s;return lm(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),lx(e,t,n,i.environment.paths,i.budget),hx(e,n,o,i.environment,i.trace),null}var sx=new Set([">>","<>"]);function lm(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?ax(s):sx.has(s.operator)))continue;rm(s.target,t,r,o)}if(n!=="before-consumer"||!Re(e.words[0],"tee"))return;let i=cm(e.words.slice(1));if(!i)return;for(let s of i.operands)rm(s,t,r,o)}function ax(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function rm(e,t,n,r){let o=e?.provenance==="literal"?jn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function lx(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!Qo(i))return;for(let s of cx(e)){let a=jn(s.text,n.effectiveCwd,r,o);if(!a||!xu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function cx(e){let t=dx(e.redirections)?.target,n=om(t)?[t]:[];if(Re(e.words[0],"cat"))return ux(e.words)?n:[];if(!Re(e.words[0],"tee"))return[];let r=cm(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(om))return[];return[...r.operands,...n]}function ux(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function dx(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function cm(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&Re(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function om(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function Re(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Qo(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function fx(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return Ht;let n=t[0];if(!n?.heredoc)return Ht;if(!Qo(n.heredoc))return JR;if(n.fd!==void 0&&n.fd!==0)return Ht;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return Ht;let r=e.redirections.some((s)=>s!==n&&im(s.target));if(Re(e.words[0],"cat"))return r?Ht:void 0;if(Re(e.words[0],"tee"))return r||e.words.slice(1).some(im)?Ht:void 0;let o=e.words[0],i=e.words[1];if(Re(o,"git")&&(Re(i,"apply")||Re(i,"commit")))return;if(Re(o,"gh")&&(Re(i,"pr")||Re(i,"issue"))&&Re(e.words[2],"create"))return;return Ht}function im(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function mx(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(gx(e,i,n,r,o))return null;let a=px(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Ma(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function px(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Qo(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!ke(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=A(b("interpreter.one-liner-paranoid",Vn),n.policy);if(c)return c}if(!Kn(s))return null;let l=A(b("interpreter.dangerous-command",ln),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function gx(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Qo(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Ot(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return nt(a)}function hx(e,t,n,r,o){let i=Hf(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function mr(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Xf(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function Yo(e){let t=[];for(let n of e){if(!t.some((r)=>yx(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function yx(e,t){return e.effectiveCwd===t.effectiveCwd&&Cn(e.shellGitContextState.env,t.shellGitContextState.env)&&Cn(e.literalHeredocFiles,t.literalHeredocFiles)&&Cn(e.functionDefinitions,t.functionDefinitions)&&Cn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Cn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function Cn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function Cx(e,t){let n=Gn(e);return n===void 0?void 0:t.get(n)}function bx(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function Sx(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Ma(e,t){let n=A(Ye(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function sm(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:fn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var vx=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function um(e,t,n,r){let o=Na(e,0,{...t,...Uc(t),budget:t.budget??ye(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function dm(e,t,n){try{return{decision:e()}}catch(r){let o=Ex(r,t,n);if(!o)throw r;return o}}function Ex(e,t,n){if(!(e instanceof N)||!vx.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var Rx=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),La=new Set(["cc-safety-net","ccsn"]),xx=new Set(["bunx","npx","pnpx"]),_x=new Set(["pnpm","yarn"]),wx=new Set(["npm","pnpm","yarn"]),Px=new Set(["bun","node"]);function ti(e,t,n={}){if(La.has(e))return 0;if(xx.has(e)){if(n.broad)return Da(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return ei(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&wx.has(e)&&n.broad&&t[r]==="exec"){let o=Da(t.slice(r+1));return o===null?null:r+1+o}if(_x.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&ei(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Da(t.slice(r+1));return o===null?null:r+1+o}if(Px.has(e)){let o=n.broad&&r!==-1?r:0;if(fm(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&fm(t[o+1]))return o+2}return null}function Da(e){let t=e.findIndex((r)=>ei(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!ei(r))break;n++}return n}function ei(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return La.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return La.has(e.slice(0,t))}function fm(e){let t=e?.replaceAll("\\","/");return[...Rx].some((n)=>t===n||t?.endsWith(`/${n}`))}var mm="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function pm(e,t,n){let r=pe(e,"input-candidate");if(!r)return null;let o=un(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>Ax(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function Ax(e,t){let n=mt([...e],t),r=n.slice(1),o=ti(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ni}from"node:path";var Cm="This path contains the protected policy config and you must not modify or delete it.",Tx=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function bm(e,t,n){let r=Dx(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return gm(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=pe(e,"input-candidate");if(e.invocation.route.kind==="command")return o?hm(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=hm(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return gm(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||xr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function gm(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>pr(a,n,r,o,i));return s?{target:s}:null}function hm(e,t,n,r,o){let i=un(e,t,r,o,{findSegmentTarget:(s,a)=>Ix(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>pr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>Nx(s,t,n,r,o)?.target??null});return i?{target:i}:null}function Ix(e,t,n,r,o){if(Jn(e))return null;let i=Mt([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&kx(a)){let l=Ox(a).find((c)=>ym(me(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Oo(i,1)||ia(i,r)){let c=(ko(K(i))??K(["."])).find((f)=>{let d=me(f.text,t.variables);return pr(d,t.cwd,n,r,o)||ym(d,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=vo(a).sources.find((c)=>Lx(me(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(Mx(i,s))return null;for(let l of[...e,...i])for(let c of Sm(l))if(pr(me(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function kx(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function Ox(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function Mx(e,t){if(!Tx.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function Nx(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Sm(i))if(pr(s,t,n,r,o))return{target:s};return null}function Sm(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function Dx(e,t,n){let r=(a)=>gr(ie(a,e.executionCwd,t,n)),o=r(Jt(t)),i=[r(Mn(e.executionCwd)),r(Mn(e.configCwd))],s=new Set(i.map((a)=>ni(a)));for(let a=ni(o);;a=ni(a))if(s.add(a),ni(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function pr(e,t,n,r,o){let i=cl(e,t,r,o,(s)=>gr(s)===kr);return i!==null&&n.files.has(gr(i))}function ym(e,t,n,r,o){return n.directoriesAndAncestors.has(gr(ie(e,t,r,o)))}function Lx(e,t,n,r,o){let i=gr(ie(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function gr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ri,posix as Wx,resolve as ii,win32 as Fx}from"node:path";import{fileURLToPath as Gx}from"node:url";var Im="Access to a sensitive path is not allowed.",km=new Set(["echo","printf"]),zx=new Set(["find"]),Bx=new Set(["-exec","-execdir"]),$x=new Set([";","+"]),Ux=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),Hx=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Om=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),jx=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),Vx=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Mm=new Set(["-c","-e","-r","-E","--eval","--exec"]),Kx=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),qx=new Set(["grep","rg"]),vm=new Set(["jq","gojq","jaq"]),Em="f",Rm="file",Yx="files",Zx=new Set(["e","f"]),Xx=new Set(["regexp","file"]),Jx=new Set(["e","f","A","B","C","m"]),Qx=new Set(["regexp","file","after-context","before-context","context","max-count"]),Wa="__CC_SAFETY_NET_PIPE_INPUT__",Ga=/[\w./~@+-]*[./~][\w./~@+-]*/g,e_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,t_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,n_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,r_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,o_=/\b(?:system|exec)\s*$/,i_=/\b(?:eval|exec)\s*\(/g,s_=/\b(?:eval|exec)\s*$/,a_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function xm(e,t,n,r,o,i){for(let s of e){let a=s.target;if(iw(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=rw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&sw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Nm(e,t,n,r,o={}){let i=_m(e,n,r),s=xm(i,t,e.invocation.context.configCwd,n,r);if(s===null)return null;let a=s.ruleId!=="secret.deny-path"&&o.strict===!1?_m(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:xm(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&l_(e,n))return null;return l}function l_(e,t){let n=pe(e,"input-candidate")??pe(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of So(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(Xe(a.text,t))}let o=St(r);if(o.length===0)return!1;let i=it(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>Ux.has(a))}function _m(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=pe(e,"input-candidate");return[...s?Sn(s.shell,e.store,r,t,o,n,c_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function c_(e){return e.program.dialect==="powershell"}function Sn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Le;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...G_(Xe(e.source,r),t,n,r,o,i)],l=(c)=>Xe(S_(c,s),r);return bo(e,o,r,i,{word:l,segment:(c,f,d,u,m)=>{if(c.length===0)return null;if(a.push(...si(c,t,n,r,f.cwd,i,m)),d!==null)a.push(...d_(d,c,t,n,r,f.cwd,i));return null},redirection:(c,f)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Dm(c.consumer,[c.body],t,n,r,f.cwd,i,(d)=>f_(c.consumer??[],d,t,n,r,f.cwd,i)));if(c.targetOrder==="legacy-segment")return Bs;return a.push({target:l(c.target),cwd:f.cwd}),null}}),a}function za(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Le;return s.status==="complete"?Sn(s,t,n,r,o,i):null}function si(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(vm.has(it(St(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...si(p,t,n,r,o,i)]}let l=b_(e).map(a),c=St(e);if(c.length===0)return l;let f=c[0]??"",d=it(f).toLowerCase(),u=c.slice(1),m=u_(f,d,u);if(m)return[...l,...m.map(a)];if(km.has(d))return n.capturedOutput===!0?[...l,...Lm(e).map(a)]:l;if(d==="eval")return[...l,...za(u.join(" "),t,n,r,o,i)??u.map(a)];if(d==="export")return[...l,...u.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:ot(d,p)).map(a)];if(d==="git")return[...l,...E_(u).map(a)];if(vm.has(d))return[...l,...v_(u).map(a)];if(qx.has(d))return[...l,...K_(u).map(a)];if(zx.has(d))return[...l,...w_(u,t,n,r,o,i).map(a)];if(_e.has(d))return[...l,...u.flatMap((p)=>ot("awk",p)).map(a),...u.flatMap((p)=>A_(p,t,n,r,o,i)),...u.flatMap(T_).map(a)];if(d==="curl")return[...l,...u.flatMap((p)=>ot(d,p)).map(a),...R_(u).map(a)];if(Qn(d)){let p=Xn.has(d)?Se([d,...u]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new Le;if(h.status==="complete")return[...l,...Sn(h,t,n,r,o,i),...u.slice(p.commandIndex).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...P_(d,u,t,n,r,o,i)]}return[...l,...u.flatMap((p)=>ot(d,p)).map(a)]}function u_(e,t,n){let r=ti(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function d_(e,t,n,r,o,i,s){if(h_(t,n,r,o,i,s))return Lm(e).map((a)=>({target:a,cwd:i}));return Dm(t,m_(e),n,r,o,i,s,()=>[])}function f_(e,t,n,r,o,i,s){let a=St(e);if(!Qn(it(a[0]??"").toLowerCase()))return[];return za(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Dm(e,t,n,r,o,i,s,a){let l=y_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>Xn.has(l)?Sn(n.getShellSyntax(c),n,r,o,i,s):oi(l,c,n,r,o,i,s))}function Lm(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase();if(!km.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Ba(r.replaceAll("%%","%"))];return t.slice(1)}function m_(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return p_(r);return[]}function p_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ba(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>g_(t,r.slice(i*n,(i+1)*n)))}function g_(e,t){let n=0;return Ba(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ba(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function h_(e,t,n,r,o,i){let s=St(e);if(s.length===0||it(s[0]??"").toLowerCase()!=="xargs")return!1;let a=$t(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,f=c===null?[...l,Wa]:l.map((d)=>d.split(c).join(Wa));return si(f,t,n,r,o,i).some((d)=>d.target.includes(Wa))}function y_(e){let t=St(e);if(t.length===0)return null;let n=it(t[0]??"").toLowerCase();if(!Qn(n))return null;return C_(n,t.slice(1))?n:null}function C_(e,t){let n=$a(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Mm.has(o)||Wm(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(a_.get(n)?.has(o))r++;continue}return!1}return!0}function $a(e){return/^python\d/.test(e)?"python":e}function b_(e){let t=[];for(let n of e){if(Gm(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var wm=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function S_(e,t){if(!t||!wm.test(e))return e;return`~${e.replace(wm,"").replace(/\\/g,"/")}`}function ot(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function v_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>ot("jq",i))}return e.flatMap((r,o)=>o===t?[]:ot("jq",r))}function E_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>ot("git",i))];if(t.push(...ot("git",r)),!be.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:ot("git",o)),n++}return t}function R_(e){return e.flatMap((t,n)=>{let r=__(t);if(r!==null)return Pm(r.flag,r.value);let o=x_(e[n-1]);return o===null?[]:Pm(o,t)})}function Pm(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Fa(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Fa(t.slice(n+1))}return t.startsWith("@")?Fa(t.slice(1)):[]}function x_(e){if(e===void 0)return null;if(Om.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function __(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Om.has(r)?{flag:r,value:e.slice(n+1)}:null}function Fa(e){return e===""||e==="-"?[]:[e]}function w_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!Bx.has(e[l]??""))continue;let c=e.slice(l+1),f=c.findIndex((m)=>$x.has(m)),d=f===-1?c:c.slice(0,f),u=si(d,t,n,r,o,i).map((m)=>m.target);if(a.push(...u.filter((m)=>m!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,h)=>{if(!Hx.has(m))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function P_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Mm.has(c)||Wm(e,c)){let d=t[l+1];if(d!==void 0)a.push(...oi(e,d,n,r,o,i,s)),l++;continue}let f=/^--(?:eval|exec)=(.*)$/.exec(c);if(f!==null&&f[1]!==void 0){a.push(...oi(e,f[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Wm(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return Kx.get(t[t.length-1]??"")?.has($a(e))??!1}function A_(e,t,n,r,o,i){if(!e.includes("system"))return[];return ta(e)?.commands.flatMap((s)=>Sn(t.getShellSyntax(s),t,n,r,o,i))??[]}function T_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function I_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Ua),...e.match(Ga)??[]]}function oi(e,t,n,r,o,i,s){let a=(m)=>({target:m,cwd:i}),l=O_(t,k_(e));if(l===null)return I_(t).map(a);let c=l.masked.match(r_)!==null||l.literals.some((m)=>o_.test(l.masked.slice(0,m.start))),f=l.masked.match(i_)!==null||l.literals.some((m)=>s_.test(l.masked.slice(0,m.start))),d=r.refineInlineData===!0&&!Xn.has(e),u=d&&!(L_(l.masked)||c||f)?[]:l.literals;return[...u.map((m)=>m.text).filter((m)=>m!=="").map(a),...u.flatMap((m)=>Ua(m.text)).map(a),...d?[]:l.literals.flatMap((m)=>m.text.match(Ga)??[]).map(a),...c?l.literals.flatMap((m)=>za(m.text,n,r,o,i,s)??[a(m.text)]):[],...f?l.literals.flatMap((m)=>oi(e,m.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
-`:h),n,r,o,i,s)):[],...(l.masked.match(Ga)??[]).map(a)]}function k_(e){let t=$a(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function O_(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(t_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&D_(e,o))return null;let a=t==="python"?M_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,f=N_(e,c,l);if(f===null)return null;let d=e.slice(c,f);if(/[fF]/.test(a)&&d.includes("{"))return null;if(t==="simple"&&s==='"'&&n_.test(d))return null;r.push({start:c,text:d});for(let u=o;u<f+l.length;u++)n[u]=" ";o=f+l.length-1}return{masked:n.join(""),literals:r}}function M_(e,t){return e_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function N_(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function D_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function L_(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(jx.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>Vx.has(i)))continue;if(o.length>1)return!0;if(W_(e,r)===".")return!0;if(F_(e,r+n.length)==="(")return!0}return!1}function W_(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function F_(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function G_(e,t,n,r,o,i){return H_(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Sn(a,t,{...n,capturedOutput:!0},r,o,i),...z_(a,r)?B_(a,r).map((l)=>({target:l,cwd:o})):[]]})}function z_(e,t){let n=So(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||it(Xe(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Xe(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function B_(e,t){return So(e).flatMap((n)=>n.kind==="word"?[Xe(n.text,t)]:n.kind==="redirection"&&n.target?[Xe(n.target,t)]:[]).flatMap(Ua)}function Ua(e){let t=U_(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||$_(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function $_(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function U_(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function H_(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Nn(o,n))continue;if(Fm(e,r,n)){let i=j_(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=V_(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function j_(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Nn(i,n))continue;if(Fm(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function V_(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Fm(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function K_(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let f=/^--([^=]+)(?:=(.*))?$/.exec(c);if(f!==null){let d=f[1]??"",u=f[2];if(d===Yx)o=!0;if(Xx.has(d))r=!0;if(u!==void 0){if(d===Rm)t.push(u);continue}if(Qx.has(d)){let m=e[l+1];if(d===Rm&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let d=c.slice(1),u="",m="";for(let h=0;h<d.length;h++){let g=d[h]??"";if(Zx.has(g))r=!0;if(Jx.has(g)){u=g,m=d.slice(h+1);break}}if(u==="")continue;if(m.length>0){if(u===Em)t.push(m);continue}let p=e[l+1];if(u===Em&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function St(e){let t=e.findIndex((n)=>!Gm(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Gm(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var q_=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Y_=".env.",Z_=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),X_=[".env.example.",".env.sample."];function J_(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Q_(e){return e.length>0&&!/\s/.test(e)}function ew(e,t,n,r){try{let o=Cr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof N)throw o;return!1}}var tw=new Set(["node_modules","__pycache__"]),nw=[["vendor","bundle"],["vendor","cache"]];function rw(e,t,n,r,o){if(J_(e))return null;let i=He(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>Q_(s)||ew(e,t,r,o);if(Z_.has(s)||X_.some((u)=>s.startsWith(u)))return null;let c=B(cw(e,t,r,o));for(let u of Qi){let m=`~/${u.suffixParts.join("/")}`;if((Tm(a,m)||Tm(c,m))&&rt(u.id,n))return u.id}let f=ow(i,t,n,r,o);if(f)return f;if(q_.has(s))return null;for(let u of Ji)if(s===u.basename&&rt(u.id,n))return u.id;if(s.startsWith(Y_)&&rt(Fr.id,n)&&l())return Fr.id;for(let u of es)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let m=s.slice(u.prefix.length)[0];if((m==="-"||m==="_")&&rt(u.id,n)&&l())return u.id}for(let u of ts)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&rt(u.id,n))return u.id}if(aw(a))return null;if(!s.includes(".")&&Dn.pattern.test(s)&&rt(Dn.id,n))return Dn.id;let d=lw(s,n);if(d)return d;return null}function ow(e,t,n,r,o){return Gr.find((i)=>{if(!rt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||yr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,He("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||hr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ae(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ae(z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ae(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?yr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,He(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||hr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||hr(e,s,["credentials"])||hr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ae(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((f)=>yr(e,f,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?z(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ae(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ae(z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?yr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((f)=>W(e,He(f,t,r,o),l))}case"secret.cli.pi":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=He("~",t,r,o);return[ae(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ae(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||hr(e,ae(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ae(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ae(He("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((f)=>W(e,f,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?yr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ae(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ae(z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,He("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&jt(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,He("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Am=new WeakMap;function z(e,t,n,r,o){let i=Am.get(o)??new Map;Am.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=He(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>zm(e,ae(t,r)))}function hr(e,t,n){return n.some((r)=>jt(B(e),B(ae(t,r))))}function yr(e,t,n,r,o){return zm(e,He(t,n,r,o))}function zm(e,t){return B(e)===B(t)}function ae(e,...t){return Be([e,...t].filter(Boolean).join("/"))}function iw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Cr(e,t,o,i));return n.some((a)=>jt(s,B(Cr(a,r,o,i))))}function sw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Cr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Be(G(Ce(a),o.paths,i)):"",c=B(l),f=o.env.get("CC_SAFETY_NET_HOME"),d=B(f?Be(G(ii(Ce(f)),o.paths,i)):l&&Be(G(`${l}/.cc-safety-net`,o.paths,i)));if(d&&jt(s,d))return!1;return n.some((u)=>{let m=B(Cr(u,r,o,i));if(!m)return!1;if(c&&(c===m||c.startsWith(m.endsWith("/")?m:`${m}/`)))return!1;return jt(s,m)})}function aw(e){let t=e.split("/");return t.some((n)=>tw.has(n))||nw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function lw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ns)if(r===o.extension&&rt(o.id,t))return o.id;for(let o of rs)if(o.pattern.test(r)&&rt(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function rt(e,t){return!t?.disabledRules?.includes(e)}function He(e,t,n,r){let{home:o,normalized:i}=Ha(e,n,r);if(!i)return"";if(!o)return i;let s=ja(i,o),a=ri(s)?s:Be(ii(t,s)),l=Be(G(a,n.paths,r));if(!jt(l,o)){if(ri(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Tm(e,t){return e===t||e.startsWith(`${t}/`)}function cw(e,t,n,r){let{home:o,normalized:i}=Ha(e,n,r);if(!i||!o)return"";let s=ja(i,o),a=Wx.normalize(ri(s)?s:Be(ii(t,s))),l=Be(Ce(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,f=[o,l].find((u)=>u!==""&&jt(c(a),c(u)));if(f===void 0)return"";let d=a.slice(f.length);return d?`~${d}`:"~"}function Cr(e,t,n,r){let{home:o,normalized:i}=Ha(e,n,r);if(!i)return"";let s=o?ja(i,o):i;return Be(G(ri(s)?s:ii(t,s),n.paths,r))}function Ha(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Be(G(Ce(r),t.paths,n)):"",i=Be(Ce(uw(Xe(e,t))));return{home:o,normalized:i}}function uw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return Gx(e)}catch{return e}}function ja(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ae(t,e.slice(2));return e}function dw(e){if(process.platform==="win32")return!0;return Fx.parse(e).root.length>1}function Be(e){let t=e.trim(),n=(t.includes("\\")&&dw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function it(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Vt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var fw={findPolicyMutation:bm,findGitMetadataMutation:td,resolveGitMetadata:mw,loadPolicySnapshot:$c,findSensitiveTarget:Nm,analyzeCommand:um,getModes:Pi};function Bm(e,t){let n={...fw,...t.dependencies},r=hw(e),o=br(e)?e.command:r,i=vt("policy-protection",o,()=>er(e)),s=pe(i,"input-candidate"),a=pe(i,"declared-command");if(br(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:$e,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:vd,intent:"stop_and_explain"}};let l=ye(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),f=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(f){let E=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Cm,intent:"hard_stop",evidence:{command:E,segment:f.target}}}}let d=vt("policy-protection",o,()=>pm(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:mm,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let u=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Pe,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...pw(m)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:br(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:Im,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!br(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Va("command-validation",o),...g};let v=vt("command-analysis",o,()=>dm(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},gw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function mw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function pw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function gw(e){return pe(e,"declared-command")?.program}function hw(e){try{return wn(e.input)}catch(t){let n=br(e)?e.command:void 0;throw new Vt("policy-protection",Va("policy-protection",t instanceof Ve?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Vt(e,Va(e,r instanceof Ve?void 0:t,r),r)}}function Va(e,t,n){let r=n instanceof N||n instanceof Le;return{stage:e,decision:{kind:"deny",reason:r?fi:En,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function br(e){return e.route.kind==="command"}import{appendFileSync as Tw,mkdirSync as Iw}from"node:fs";import{isAbsolute as kw,join as Ya}from"node:path";import{lstatSync as Um,readdirSync as yw,readFileSync as Cw,rmdirSync as bw,statSync as Hm,unlinkSync as Sw,utimesSync as vw,writeFileSync as Ew}from"node:fs";import{join as Sr}from"node:path";function $m(e,t={}){return Kr(Jt(e,t),e.home).policy.audit.retention_days}var qa=86400000,Rw=".last-prune",xw=/^\d{4}-\d{2}$/,_w=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,jm=(e)=>Math.floor(e/qa);function Km(e,t,n=()=>new Date){try{let r=n().getTime();if(!Hm(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Sr(t,Rw),i=Hm(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&jm(i)===jm(r))return;let s=r-$m(e)*qa,a=new Date(r).toISOString().slice(0,7);for(let l of Ka(t)){if(l.isDirectory()){ww(Sr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))Pw(Sr(t,l.name),s)}Ew(o,"",{mode:384}),vw(o,r/1000,r/1000)}catch{}}function ww(e,t,n){for(let r of Ka(e)){if(!r.isDirectory()||!xw.test(r.name))continue;let o=Sr(e,r.name);for(let i of Ka(o)){if(!i.isFile())continue;let s=_w.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+qa;if(!Number.isFinite(a)||a>=t)continue;qm(Sr(o,i.name))}if(r.name!==n)Vm(o)}Vm(e)}function Pw(e,t){try{let n=Um(e);if(n.mtimeMs>=t)return;let r=Cw(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(Aw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Um(e).mtimeMs!==n.mtimeMs)return;qm(e)}catch{}}function Aw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Ka(e){try{return yw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function qm(e){try{Sw(e)}catch{}}function Vm(e){try{bw(e)}catch{}}var Ow="2.4.3",Mw=1e4,Nw=2000,Dw=256,Lw=32768;function Ww(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function Fw(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Za(e,t,n,r,o,i,s={}){let a=Ww(t);if(!a)return;let l=zw(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),f=ai(st(n),s.failureStage?Number.POSITIVE_INFINITY:Mw),d=ai(st(r),Nw),u=s.toolName?ai(st(s.toolName),Dw):void 0,m=i===null?void 0:ai(st(i),Lw),p=Ya(l,Fw(m?.value??null),c.slice(0,7));Iw(p,{recursive:!0,mode:448});let h=Ya(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Ti)(),v:Ow,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:f.value,segment:d.value,...f.truncated||d.truncated||u?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};Tw(h,`${JSON.stringify(g)}
-`,{encoding:"utf-8",mode:384}),Km(e,l,s.now)}catch{}}function ai(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function Gw(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&kw(n)?n:null}function zw(e){let t=Gw(e);return t?Ya(t,".cc-safety-net","logs"):null}function Zm(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Ym(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Ym(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Ym(e){return"command"in e?e.command??"":""}function Xm(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Za(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Jm(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Za(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function ep(e,t,n){try{let r=Bm(t,{environment:e,...n.guard});return Qm(e,t,r,n),r}catch(r){if(!(r instanceof Vt))throw r;throw Qm(e,t,r.evaluation,n,!(r.cause instanceof Ve),{stage:r.stage,errorCode:Bw(r.cause)}),r}}function Qm(e,t,n,r,o=!0,i){Xm(e,Zm(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function Bw(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Ve)return"tool-input-limit";if(e instanceof Le)return"structural-shell-syntax-limit";return"unexpected-error"}function Et(e,t={}){return{malformed:!0,denial:Rn(t),cwd:e}}function tp(e,t={}){return(n,r)=>{try{return $w(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Rn())}}}function $w(e,t,n,r){let o=Ml();if(n.cancelled?.(t))return n.block(Rn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Jm(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let f=nl(l,{includeEvidence:c});return f?n.block(f):n.allow};try{let l=ep(o,i,{guard:{auditAllowed:Nl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Vt))throw l;if(xt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${ol(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var np="exec",Uw=new Set(["auto","gateway"]);function rp(e){e.on("before_tool_call",Hw(e),{matcher:[np],priority:50})}function Hw(e,t={}){return tp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>jw(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>qw(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function jw(e,t,n,r){if(!e||typeof e!=="object")return Et(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Et(null);if(o!==np)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Et(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Et(null,{toolName:o});if(s.host!==void 0&&!Uw.has(s.host))return Et(null,{command:a,toolName:o});let l=Vw(n,t.agentId,r);if(!l)return Et(null,{command:a,toolName:o});let c=Kw(l,s,r);if(!c)return Et(l,{command:a,segment:typeof s.workdir==="string"?s.workdir:void 0,toolName:o});return Pn(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function Vw(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return Si(".",[r],n)}catch{return}}function Kw(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return Si(r,[e],n)}function qw(e){return{block:!0,blockReason:rl(e)}}var HD={...tl,register:rp};export{HD as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Vo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function mr(e){return e?w(e):""}function ux(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function _a(e,t){return xa(Me(e,"posix"),t)}function pr(e){return _a(e,new Set(Array.from(e.matchAll(pm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function xa(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(xa(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>xa(o,n))||Cm(r.words,n))return!0;gx(r,n)}return!1}function Cm(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(fr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return fm(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Se(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&fm(s[l],t)}let i=dx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Cm(e.slice(i),t)}function dx(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return mx(e,t+1);if(r==="exec")return fx(e,t+1);if(r==="env")return px(e,t+1,n);return null}function mx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function fx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function px(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return fr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return fr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function gx(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(fr(n,t))t.add(r.name)}}function fr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(pm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(tx.test(o)||t.has(o))}))}function fm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||fr(e,t))}var hx=["--init-file","--rcfile"],yx=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function tt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return bm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=bm(e,t,!1);if(r!==null)return r}}return null}function nt(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Se(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function bm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Sm(e){let t=k(e[0]??"").toLowerCase(),n=Cx(e,t),r=yx.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Cx(e,t){let n=Se(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?hx.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Yi.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Zi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var wa="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Pa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",bx="__CC_SAFETY_NET_XARGS_INPUT__",Ko="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",qo="rm",Sx=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,vx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Ex=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,xx=/^(?:[0-9]+|[@*])$/;function xm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Ut(n),i=n.slice(r),s=b("xargs.shell-dynamic",Pa);if(_x(i,o,t)&&A(s,t.policy))return A(s,t.policy);for(let a of Fe(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?A(s,t.policy):null;if(c)return c;let u=Am(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&wm(l,o),d=t.analyzeChild(l,{...zt(a,t),dynamicInput:u,dynamicSourceInput:m||_m(l,a.head,o,a.wrapperEnvAssignments,u,t.environment),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",wa)});if(d)return d;let f=Rx(l,o,t.policy?.rules??[],A(s,t.policy));if(f)return f;if(a.head==="git"){let h=o===null?[...l,bx]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...zt(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=Je(l,t.policy?.rules??[]);if(p)return p}return null}function Rx(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Rm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=cm(e,r,t.length,n);return o===null?[]:[o]}function _m(e,t,n,r,o,i){if(J.has(t)){if(nt(e))return!1;if(n!==null&&wx(e,n))return!0;let s=tt(e);if(!s){let a=et(K(e));if(a.kind==="literal")return n!==null&&a.source.includes(n);return a.kind==="none"&&o}if(n!==null&&s.includes(n))return!0;if(Ye(s))return!0;return Px(s,n,r)}if(Oe(t))return vm(e,n,po,Mu(t));if(we.has(t))return vm(e,n,ia,Od);if(t==="eval"){let s=Ho(K(e));if(s.kind==="dynamic")return!0;if(n!==null)return s.kind==="literal"&&s.source.includes(n);return o}if(t==="find")return Ax(e,n,i);if(t==="git"){let s=xe(e);return n===null?s.subcommand===null:(s.subcommand?.includes(n)??!1)||s.subcommand!==null&&pn.has(s.subcommand.toLowerCase())&&Pm(s.rest,n).some((a)=>a.includes(n))}return!1}function vm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Ko]).sources.some((a)=>a.value===Ko);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Ko}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Ko}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Rm(l,t,a))));return $o(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function _x(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Fe(e,n),(i)=>i.head)),o=t===null?[...e,qo]:e.map((i,s)=>s===0?i:i.replaceAll(t,qo));return Array.from(Fe(o,n)).some((i)=>i.head===qo&&!r.has(qo))}function wm(e,t){return Pm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Pm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Am(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function wx(e,t){let n=Se(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return Rm(i,t,o).some((l)=>{let c=e.map((m,d)=>d===s?m.replaceAll(t,l):m),u=Se(c);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(n.commandIndex===null&&u.commandIndex!==null)return!0;if(n.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(c[u.commandIndex]??"").includes(l))return!0;return u.scriptIndex!==null&&(c[u.scriptIndex]??"").includes(l)})}))}function Px(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Sx))if(Em(o,r))return!0;for(let o of e.matchAll(vx))for(let i of(o[1]??"").matchAll(Ex))if(Em(i,r))return!0;return _a(e,r)}function Em(e,t){let n=e[1]??e[2];return n!==void 0&&(xx.test(n)||t.has(n))}function Ax(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Qe(s)){let l=cr(e,i);i=l.nextIndex-1;for(let c of Fe(l.tokens,{environment:n,cwd:void 0})){let u=Am(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&wm(c.tokens,t)||_m(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=ht(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Ut(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var gr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",hr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Ix="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",kx="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Zo=/\{[^{}\s]*\}/g,Tm=/\{\}|\{-?\d+\}/g,Ox=["e","f","source","file","-e","-f","--source","--file"],Mx=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Nx=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Dx=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Im=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Lx=new Set(["--workdir","--wd"]),km="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Te(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Lm(e){return Te([...e],(t)=>Ye(t))}function Wm(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=hn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Vm(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=hn(t);if(p)return p;let h=Lm(t.envAssignments?.values()??[]);if(h)return h}if(l){let p=$x(t);if(p)return p}if(u!==void 0&&a){let p=hn(t);if(p)return p}let d=Ux(u,t.cwd,t.environment.paths);if(d===null){let p=hn(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...Fe(i,f)].flatMap((h)=>[...h.envAssignments.values()]).some(Ia)){let h=hn(t);if(h)return h}return null}if(i.length===0){let p=s.map((g)=>g[0]??"");t.budget.charge("derivedTokens",p.length);let h=Bm(f.envAssignments,f.cwd,a);return Te(p,(g)=>t.analyzeNested(g,h))}return Te(Fe(i,f),(p)=>Wx(p,o,t,f))}function Wx(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(Hm)){let g=hn(n);if(g)return g}let u=Lm(c);if(u)return u;let m=c.some(G),d=i||m,f=a&&d,p=Bm(e.envAssignments,e.wrapperCwd,s||f);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Te(o,(E)=>n.analyzeChild(Yo(l,E,n.budget),zt(e,r)))};if(nt(l))return g();let y=tt(l);if(y){if(jm(y)){let x=bt(n);if(x)return x;if(o.length===0)return null;return Te(o,(P)=>n.analyzeNested(Nm(y,P,n.budget),p))}if(G(y)){if(o.length>0)return Te(o,(q)=>n.analyzeNested(Nm(y,q,n.budget),p));let x=ur(y);if(x?.[0]&&M(x[0])==="rm"&&ze(x)){let q=Mm(n);if(q)return q}let P=x?n.analyzeChild(x,{...zt(e,r),dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",hr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",gr)}):null;if(P)return P;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>jo(K(x===void 0?l:i?l.map((P)=>$m(P,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=bt(n);if(x)return x}let S=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(S.length>0)return n.budget.charge("derivedTokens",S.length),Te(S,(x)=>n.analyzeNested(x,p));if(pr(y)){let x=bt(n);if(x)return x}let T=n.analyzeNested(y,p);if(T)return T;if(d)return bt(n);return null}let v=et(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&G(v.source))return bt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=bt(n);if(E)return E;let S=g();if(S)return S;if(i)return null;let T=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",T.length),Te(T,(x)=>n.analyzeNested(x,p))}if(d||a)return bt(n)??g();return null}if(e.head==="rm"&&ze(l)){if(i&&o.length>0)return Te(o,(y)=>Aa(Yo(l,y,n.budget,Tm),e.cwd,r));if(o.length>0)return Te(o,(y)=>Aa(Dm(l,y,n.budget),e.cwd,r));let g=Aa(l.flatMap((y,v)=>{if(v===0||!G(y))return[y];return y.startsWith("-")?[y.replace(Tm,"")]:[]}),e.cwd,r);if(g)return g;return Mm(n)}let h=o.length>0?o:[void 0];return Te(h,(g)=>{let y=g===void 0?l:i?Yo(l,g,n.budget):Dm(l,g,n.budget),v=b("parallel.shell-dynamic",hr),E=a&&e.head==="find"?Bx(y,r):null,S=Fm(y,a,n)??E?.customResult??null,T=M(e.head),x=a&&(T==="rm"&&Ta(y)||T==="xargs"&&zm(y)||E?.rmOptions===!0),P=a&&(x||E?.executedSource===!0||E===null&&Gm(y,T)),q=n.analyzeChild(y,{...zt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:x,dynamicSourceInput:S!==null||P,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",gr)});if(P){let Z=A(v,n.policy);if(Z)return Z}return q??S??Je(y,n.policy?.rules??[])})}function Gm(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return zx(e);if(t==="git")return Gx(e);if(t==="find")return!0;if(we.has(t))return Om(e,Ox,lr);if(Oe(t))return Om(e,Mx,fo);return!1}function Ta(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||jm(o)))}function Gx(e){if(Fx(e))return!0;let t=xe(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!pn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function Fx(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function zx(e){if(nt(e))return!1;let t=tt(e);if(t!==null)return G(t);let n=et(K(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function Om(e,t,n){let r=n(e);if(r.some((o)=>G(o.value)))return!0;if(!e.some(G))return n([...e,km]).some((o)=>o.value===km);return $o(r,t,(o)=>n(e.map((i)=>$m(i,[o]))))}function Fm(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(G))return bt(n);return Te(o,(i)=>Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function Bx(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of Fe(i,t))n.executedSource||=Gm(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ta(a.tokens)||a.head==="xargs"&&zm(a.tokens),n.customResult??=Fm(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Qe(a)){i=[],n.executedSource||=G(a);continue}let l=ht(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function zm(e){let t=e.slice(Ut(e).childStart);return M(t[0]??"")==="rm"&&Ta(t)}function Xo(e,t){return(n)=>A(b(e,t),n.policy)}var bt=Xo("parallel.shell-dynamic",hr),$x=Xo("parallel.command-stream-dynamic",Ix),hn=Xo("parallel.command-stream-dynamic",kx),Mm=Xo("parallel.rm-recursive-force-dynamic",gr);function Aa(e,t,n){return A(Uo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Lt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Bm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function $m(e,t){return e.replace(Zo,(n)=>Um(n,t))}function Yo(e,t,n,r=Zo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Um(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Nm(e,t,n){return Yo([e],t,n)[0]??""}function Dm(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Um(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function G(e){return e.search(Zo)!==-1}function Hm(e){if(Ia(e))return!0;for(let t of e.matchAll(Zo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Ia(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function jm(e){return/^\{[^{}\s]*\}$/.test(e)}function Ux(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Tx(e))return null;try{return mt(t??e,e,n)}catch{return null}}function Vm(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=la(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=la(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||Dx.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(Im.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=Im.has(p)?2:1;continue}if(Lx.has(y)){c=!0;let E=v??h;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(Nx.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Ia:Hm);let u=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){u.push(p),p=[];continue}if(g!==void 0)p.push(g)}u.push(p)}c||=u.length>1;let m=Hx(u),d=n.some(G),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function Hx(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function Km(e){return Vm(e).childStart}var jx="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Jo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Oa(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function ka(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Ym(e,t,n,r,o=!1,i){let a=(Bn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",jx):null;return A(a,i)??Zm(e,t,n,o,i)}function Zm(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Oa(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=sn(e,t),l=Kx(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return A(b("shell.dynamic-structure",Jo),o);if(A(Bo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&pn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return A(b("shell.dynamic-structure",Jo),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&qx(t)?A(b("shell.dynamic-structure",Jo),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=ze(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?A(b("shell.dynamic-structure",Jo),o):null}if(s==="xargs")return qm(e,t.slice(Ut(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return qm(e,t.slice(Km(t.map(w))),"parallel",n,r,o);return null}function qm(e,t,n,r,o,i){if(t.length===0)return null;let s=Vx(t,r);if(Bn(e,s)){let l=A(b(`${n}.shell-dynamic`,n==="xargs"?Pa:hr),i);if(l)return l}let a=Zm(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Oa(l)&&ka(l)))return A(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?wa:gr),i);return null}function Vx(e,t){let n=Ot(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function Kx(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(be.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function qx(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Oa(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||ka(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||ka(s)))return!0;continue}if(t=!0,a)return!0;let l=ht(s.text);if(l>0){n=l;continue}if(Qe(s.text))o=!0,r=!0}return!1}function Ma(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!lo(t[n.tokenIndex],n.value)})}var Yx="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",Zx="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",Xx="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Xm(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",Yx);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",Zx);if(e==="shred"&&n.length>0)return b("shred.target",Xx);return null}var Qm=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Uo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Bo(e.words,Na(e))},{heads:new Set(["find"]),analyze:(e)=>Gd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>xm(e.words,{...Jm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Wm(e.words,{...Jm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})}];function Jm(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ht(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Na(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var rf="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function of(e){return Qm.find((t)=>t.heads.has(e))?.analyze}function Cn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=yo(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=Ot(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let R=[...p,...i(f.words)].join(" "),I=Ye(R);if(I)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:I.reason}),ue(I);if(n.strict)return he(r);let L=Co(p,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(te)return te}}let h=f.rewritten?K(i(f.words)):sn(o,f.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>h.length){let R=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),E=g[0];if(!E)return null;if(Ft(E))throw new N("wrapperPeelIterations");let S=M(E),T=f.cwd===null?void 0:f.cwd??u,x=f.cwd===null?void 0:m,P=f.cwd===void 0?n.effectiveCwd:f.cwd,q=s?s.allowTmpdirVar:!or(v,n.environment),Z=Ym(o,f.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),ue(Z);let ee=Do(g,n.policy);if(ee){for(let R of[ee.childIndex,...ee.alternativeChildIndices]){ef(y.wrapperNormalizationBudget);let I=h.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=Cn(I,t,{...y,effectiveCwd:P,envAssignments:v});if(L)return L}return null}let X=l?void 0:S==="eval"?Ho(h):S==="trap"&&!a?hm(h):void 0;if(a&&s&&S==="eval"){if(X?.kind==="dynamic")return yn(s,n.policy);if(X?.kind==="literal"){let R=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v});if(R)return R}return bn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!Ra(n.commandView)))return he(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:S==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let R=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?J.has(S):af(E,S)){if(nt(g))return null;if(a&&s){let R=tt(g);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=yn(s,n.policy);if(L)return L}if(pr(R)){let L=yn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:P,envAssignments:v})}let I=et(h);if(I.kind==="dynamic")return yn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?yn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?yn(s,n.policy):null}if(l){let R=tt(g),I=R?n.analyzeNested(R,{effectiveCwd:P,envAssignments:v}):et(h).kind==="dynamic"?he(r):null;if(I)return I}if(s===void 0){let R=tR(g,v,P,n,r,t);if(R)return R;let I=tt(g);if(I){let qt=jo(h,I);if(qt.kind==="dynamic")return he(r);let hi=qt.kind==="literal"?qt.source:I,il=nR(hi);r?.recordSegment({type:"shell-wrapper",wrapper:S,innerCommand:il}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:il,depth:t+1});let sl=n.analyzeNested(hi,{effectiveCwd:P,envAssignments:v});if(sl)return sl;return pr(hi)?he(r):null}let L=et(h);if(L.kind==="dynamic")return he(r);if(L.kind==="literal")return Qo(L.source,P,v,n,r,t);let te=ym(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return he(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:P,envAssignments:v})}}if(!s&&(S==="source"||S===".")){let R=g[1]==="-p"?2:null;if(R!==null){let qt=n.commandView?h[R]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return he(r)}let I=R===null?1:3,L=g[I]==="--"?I+1:I,te=n.commandView?h[L]:void 0;if(!te)return null;if(te.provenance==="literal")return Qo(te.text,P,v,n,r,t);if(n.strict||!n.commandView||!Ra(n.commandView))return he(r)}if(we.has(S)&&!l){if(!s&&n.strict&&Ma(lr(g),h))return he(r);let R=Md(g,(L)=>Ht(n.analyzeNested(L,{effectiveCwd:P,envAssignments:v}))),I=A(R,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),ue(I)}if(Oe(S)&&!l){if(!s&&n.strict&&Ma(fo(g),h))return he(r);let R=Ou(g);if(a&&s)return Qx(S,R,P,v,n,s);if(R){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:S,codeArg:R,paranoidBlocked:I}),I){let te=A(b("interpreter.one-liner-paranoid",Yn),n.policy);if(te)return ue(te)}if(zs(S,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:P,envAssignments:v});if(L&&!sf(L,R))return L;if(Zn(R)){let te=A(b("interpreter.dangerous-command",cn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:cn}),ue(te)}r=void 0}}if(S==="busybox"&&g.length>1)return ef(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),Cn(h.slice(1),t,{...y,effectiveCwd:P,envAssignments:v});let D=s?null:A(Xm(S,g),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),ue(D);let ce=r===y.trace?y:{...y,trace:r},_e={words:h,head:S,cwd:T,originalCwd:x,envAssignments:v,allowTmpdirVar:q,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:P,options:ce,analyzeChildTokens:(R,I)=>a&&s?Da(R,t,ce,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ht(Cn(K(R),t+1,{...ce,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:v}))??Je(R,ce.policy.rules),analyzeChild:(R,I)=>Da(R,t,ce,I)},je=s&&(S==="xargs"||S==="parallel")?void 0:of(S);if(S==="rm"||S==="xargs"||S==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let Ie=r&&S==="git"?lm(_e.words,Na(_e)):void 0,pi=tf(Ie?Ie.match:je?.(_e)??null,n.policy);if(r)rR(_e,pi,Ie?.relaxation??null);if(pi)return ue(pi);if(a&&s&&(S==="rm"||S==="rmdir")){if(!(S==="rm"&&(ze(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?bn(s,n.policy):null)??eR(s,n.policy)}let rl=je!==void 0,ol=!s&&!rl&&!Lr.has(S),gi=r&&ol?[]:void 0;if(ol)for(let R=1;R<g.length;R++){let I=g[R];if(!I)continue;gi?.push(I);let L=tf(Jx(g,R,t,ce,T,x,P,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[],embeddedCommandFound:M(I)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&rl)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let Rr=Je(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Rr,reason:Rr?.reason}),Rr)return ue(Rr);return a&&s?bn(s,n.policy):null}function Da(e,t,n,r){return Ht(Cn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function Jx(e,t,n,r,o,i,s,a){for(let l of Fe(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=M(c);if(af(c,u)||of(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=Da(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!or(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function Qx(e,t,n,r,o,i){if(!t)return bn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=A(b("interpreter.one-liner-paranoid",Yn),o.policy);if(a)return ue(a)}if(zs(e,t))return bn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!sf(s,t))return s;if(Zn(t)){let a=A(b("interpreter.dangerous-command",cn),o.policy);if(a)return ue(a)}return bn(i,o.policy)}function sf(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Oo)||e.reason===fn)&&!Wr(t)}function yn(e,t){let n=e.shellDynamicMatch?A(e.shellDynamicMatch,t):null;return n?ue(n):null}function bn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?A(e.dynamicSourceMatch,t):null;return n?ue(n):null}function eR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?A(e.rmDynamicMatch,t):null;return n?ue(n):null}function tR(e,t,n,r,o,i){let s=Sm(e);if(s.argvSource?.kind==="absent")return he(o);if(s.argvSourceApplies&&s.argvSource){let l=Qo(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Qo(a,n,t,r,o,i,!0)}function Qo(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return he(o);let a=qn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?he(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function nR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function rR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function ef(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function he(e){return e?.recordSegment({type:"error",message:rf}),ue(oR())}function oR(){return{id:"",reason:rf,intent:"stop_and_explain"}}function af(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function tf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:A(e,t)}var iR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,sR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function aR(e,t){let n=uf(e,t);if(n.length===0)return!1;let r=n[cf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return iR.test(e.join(" "))}function lf(e,t,n,r,o){if(e.dialect==="powershell"){let g=cR(e.words,o);if(g.kind==="none")return;if(!t||g.kind==="unknown")return null;return nf(fR(g.target),t,n.paths)}let i=e.words.map(w),s=i.some((g)=>/^CDPATH\+?=/.test(g));if(!aR(i,n))return s?null:void 0;if(!t)return null;let a=uf(i,n,t),l=cf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((g)=>g.length<=1||!g.startsWith("-")||g==="--");if((u===-1?c:c.slice(0,u)).some((g)=>!/^-[LP]+$/.test(g)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length!==1)return null;let p=f[0]??"",h=e.words.some((g)=>g.provenance==="variable"&&g.text===p)?lR(p,r):p;if(h===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(h)&&(s||n.env.has("CDPATH")))return null;return nf(h,t,n.paths)}function lR(e,t){let n=dr(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function nf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return mt(t,e,n)}catch{return null}}function cR(e,t){let n=uR(e[0])?1:0,r=e[n];if(!dR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!sR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return mR(e.slice(n+1),t)}function uR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function dR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function mR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function fR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function cf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function uf(e,t,n){let r=pR(e);return ft([...r],t,n)}function pR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var gR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",jt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function za(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Me(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Fa(e,n);let u=`${Oo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return hf(e,n),{reason:fn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return hf(e,n),{reason:fn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Fa(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Zd(n.environment.env,n.envAssignments);return ni(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ni(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,d=hR(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=f||vn(m);if(c.kind==="function"){let Z=h.flatMap((X)=>{let U=En(X);return U.functionDefinitions.set(c.name,c.body),La(X,[U],d,m==="&",vn(m))}),ee=Wa(Z,[],g,y,a,m);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of h){let D=ni(c.body,t,n,r,[En(U)]);if(D.result)return D;if(Z.push(...La(U,D.states,d,m==="&",vn(m))),v)ee.push(U,...d?D.states.map((ce)=>ei(U,ce)):D.states)}let X=Wa(Z,ee,g,y,a,m);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),S=e.nodes[l-2],T=ri(a)&&S?.kind==="command"?gm(S)??CR(S):void 0,x=[],P=[];for(let Z of h){let ee=bR(c,t,n,r,[En(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ei(Z,U));for(let U of X){let D=En(U),ce=ER(c,t,n.trace?{...n,trace:yf(n.trace,E)}:n,r,D,ri(a),T);if(ce)return{result:ce,states:i};let _e=GR(c,D.functionDefinitions);if(_e)n.budget.charge("derivedTokens",oi(_e));let je=_e?t+1>=V.recursionDepth.cap?Ga(c.displayText,n,[D]):ni(_e,t+1,n,r,[D]):{result:null,states:LR(c,D)};if(je.result)return je;if(x.push(...La(Z,je.states,d,m==="&",vn(m))),v)P.push(Z),P.push(...je.states.map((Ie)=>d?ei(Z,Ie):Ie))}}let q=Wa(x,P,g,y,a,m);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function hR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ri(r)||ri(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&yR(e,t)}function La(e,t,n,r,o){let i=n?t.map((a)=>ei(e,a)):[...t],s=o?i.flatMap((a)=>Sn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ei(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function yR(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(SR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ri(e){return e==="|"||e==="|&"}function CR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function vn(e){return e==="&&"||e==="||"}function Wa(e,t,n,r,o,i){let s={success:ti([...n,...e]),failure:ti([...r,...t])},a=vn(i)?s:void 0;return{states:vn(o)||a?ti([...s.success,...s.failure]):s.success,conditionalStates:a}}function yf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function bR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=vR(e);if(s){if(t+1>=V.recursionDepth.cap)return Ga(s,n,o);let a=Me(s,"powershell");if(a.status==="limited")return Ga(s,n,o);if(a.status!=="complete")return df(i,n,r,o);n.budget.charge("derivedTokens",oi(a)),i.push({program:a,depth:t+1})}}return df(i,n,r,o)}function SR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function df(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ni(i.program,i.depth,t,n,[En(a)]);if(l.result)return l;s.push(...l.states)}o=ti(s)}return{result:null,states:o}}function vR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function oi(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+oi(o),0):n.kind==="group"||n.kind==="function"?oi(n.body):0),0)}function Ga(e,t,n){return t.trace?.recordSegment({type:"error",message:$e}),{result:{reason:$e,segment:e,intent:"stop_and_explain"},states:[...n]}}function ER(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=TR(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Cf(e,o,"before-consumer",a.environment.paths,a.budget);let c=sn(e.dialect,e.words),u=c.map(w),m=e.displayText,d=Yd(c,o.shellGitContextState),f=Jd(d,o.shellGitContextState);if(e.dialect==="powershell"){let g=A(_d(e,i,zR(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!g,reason:g?.reason}),g)return FR(m,g)}if(u.length===1&&u[0]?.includes(" ")&&!Bn(e.dialect,e.words)){let g=A(Ye(u[0]),a.policy),y=g!==null&&!a.strict&&Pu(e,a.rootProgram);if(g&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:g.reason}),{reason:g.reason,segment:m,ruleId:g.id,intent:g.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let v=mf(e,l,o,f,s,a);if(v)return v;return Ca(d,o.shellGitContextState),null}let p=Cn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(g,y)=>{let v=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=za(g,t+1,{...a,effectiveCwd:v,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?yf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:m};let h=mf(e,l,o,f,s,a);if(h)return h;return Ca(d,o.shellGitContextState),null}function mf(e,t,n,r,o,i){let s=IR(e,t,n,r??new Map,i);if(s)return s;return Cf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),_R(e,t,n,i.environment.paths,i.budget),MR(e,n,o,i.environment,i.trace),null}var xR=new Set([">>","<>"]);function Cf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?RR(s):xR.has(s.operator)))continue;ff(s.target,t,r,o)}if(n!=="before-consumer"||!Re(e.words[0],"tee"))return;let i=bf(e.words.slice(1));if(!i)return;for(let s of i.operands)ff(s,t,r,o)}function RR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function ff(e,t,n,r){let o=e?.provenance==="literal"?qn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function _R(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!ii(i))return;for(let s of wR(e)){let a=qn(s.text,n.effectiveCwd,r,o);if(!a||!Iu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function wR(e){let t=AR(e.redirections)?.target,n=pf(t)?[t]:[];if(Re(e.words[0],"cat"))return PR(e.words)?n:[];if(!Re(e.words[0],"tee"))return[];let r=bf(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(pf))return[];return[...r.operands,...n]}function PR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function AR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function bf(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&Re(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function pf(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function Re(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function ii(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function TR(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return jt;let n=t[0];if(!n?.heredoc)return jt;if(!ii(n.heredoc))return gR;if(n.fd!==void 0&&n.fd!==0)return jt;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return jt;let r=e.redirections.some((s)=>s!==n&&gf(s.target));if(Re(e.words[0],"cat"))return r?jt:void 0;if(Re(e.words[0],"tee"))return r||e.words.slice(1).some(gf)?jt:void 0;let o=e.words[0],i=e.words[1];if(Re(o,"git")&&(Re(i,"apply")||Re(i,"commit")))return;if(Re(o,"gh")&&(Re(i,"pr")||Re(i,"issue"))&&Re(e.words[2],"create"))return;return jt}function gf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function IR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(OR(e,i,n,r,o))return null;let a=kR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Fa(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function kR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!ii(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Oe(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=A(b("interpreter.one-liner-paranoid",Yn),n.policy);if(c)return c}if(!Zn(s))return null;let l=A(b("interpreter.dangerous-command",cn),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function OR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!ii(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Ot(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return nt(a)}function MR(e,t,n,r,o){let i=lf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var NR=/^[A-Za-z_][A-Za-z0-9_]*$/,DR=8;function LR(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!NR.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=DR&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=En(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function En(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Xd(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ti(e){let t=[];for(let n of e){if(!t.some((r)=>WR(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function WR(e,t){return e.effectiveCwd===t.effectiveCwd&&Sn(e.shellGitContextState.env,t.shellGitContextState.env)&&Sn(e.literalHeredocFiles,t.literalHeredocFiles)&&Sn(e.functionDefinitions,t.functionDefinitions)&&Sn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Sn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function Sn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function GR(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function FR(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function zR(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Fa(e,t){let n=A(Ye(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function hf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:fn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var BR=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Sf(e,t,n,r){let o=za(e,0,{...t,...Yc(t),budget:t.budget??ye(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function vf(e,t,n){try{return{decision:e()}}catch(r){let o=$R(r,t,n);if(!o)throw r;return o}}function $R(e,t,n){if(!(e instanceof N)||!BR.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var UR=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),$a=new Set(["cc-safety-net","ccsn"]),HR=new Set(["bunx","npx","pnpx"]),jR=new Set(["pnpm","yarn"]),VR=new Set(["npm","pnpm","yarn"]),KR=new Set(["bun","node"]);function ai(e,t,n={}){if($a.has(e))return 0;if(HR.has(e)){if(n.broad)return Ba(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return si(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&VR.has(e)&&n.broad&&t[r]==="exec"){let o=Ba(t.slice(r+1));return o===null?null:r+1+o}if(jR.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&si(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ba(t.slice(r+1));return o===null?null:r+1+o}if(KR.has(e)){let o=n.broad&&r!==-1?r:0;if(Ef(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Ef(t[o+1]))return o+2}return null}function Ba(e){let t=e.findIndex((r)=>si(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!si(r))break;n++}return n}function si(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return $a.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return $a.has(e.slice(0,t))}function Ef(e){let t=e?.replaceAll("\\","/");return[...UR].some((n)=>t===n||t?.endsWith(`/${n}`))}var xf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Rf(e,t,n){let r=pe(e,"input-candidate");if(!r)return null;let o=dn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>qR(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function qR(e,t){let n=ft([...e],t),r=n.slice(1),o=ai(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as li}from"node:path";var Af="This path contains the protected policy config and you must not modify or delete it.",YR=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Tf(e,t,n){let r=t_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return _f(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=pe(e,"input-candidate");if(e.invocation.route.kind==="command")return o?wf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=wf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return _f(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Pr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function _f(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>yr(a,n,r,o,i));return s?{target:s}:null}function wf(e,t,n,r,o){let i=dn(e,t,r,o,{findSegmentTarget:(s,a)=>ZR(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>yr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>e_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function ZR(e,t,n,r,o){if(tr(e))return null;let i=Mt([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&XR(a)){let l=JR(a).find((c)=>Pf(fe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Go(i,1)||ua(i,r)){let c=(Wo(K(i))??K(["."])).find((u)=>{let m=fe(u.text,t.variables);return yr(m,t.cwd,n,r,o)||Pf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Ro(a).sources.find((c)=>n_(fe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(QR(i,s))return null;for(let l of[...e,...i])for(let c of If(l))if(yr(fe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function XR(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function JR(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function QR(e,t){if(!YR.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function e_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of If(i))if(yr(s,t,n,r,o))return{target:s};return null}function If(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function t_(e,t,n){let r=(a)=>Cr(se(a,e.executionCwd,t,n)),o=r(Qt(t)),i=[r(Ln(e.executionCwd)),r(Ln(e.configCwd))],s=new Set(i.map((a)=>li(a)));for(let a=li(o);;a=li(a))if(s.add(a),li(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function yr(e,t,n,r,o){let i=gl(e,t,r,o,(s)=>Cr(s)===Nr);return i!==null&&n.files.has(Cr(i))}function Pf(e,t,n,r,o){return n.directoriesAndAncestors.has(Cr(se(e,t,r,o)))}function n_(e,t,n,r,o){let i=Cr(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Cr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ci,posix as r_,resolve as di,win32 as o_}from"node:path";import{fileURLToPath as i_}from"node:url";var zf="Access to a sensitive path is not allowed.",Bf=new Set(["echo","printf"]),s_=new Set(["find"]),a_=new Set(["-exec","-execdir"]),l_=new Set([";","+"]),c_=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),u_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),$f=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),d_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),m_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Uf=new Set(["-c","-e","-r","-E","--eval","--exec"]),f_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),p_=new Set(["grep","rg"]),kf=new Set(["jq","gojq","jaq"]),Of="f",Mf="file",g_="files",h_=new Set(["e","f"]),y_=new Set(["regexp","file"]),C_=new Set(["e","f","A","B","C","m"]),b_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Ua="__CC_SAFETY_NET_PIPE_INPUT__",ja=/[\w./~@+-]*[./~][\w./~@+-]*/g,S_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,v_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,E_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,x_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,R_=/\b(?:system|exec)\s*$/,__=/\b(?:eval|exec)\s*\(/g,w_=/\b(?:eval|exec)\s*$/,P_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Nf(e,t,n,r,o,i){for(let s of e){let a=s.target;if(_w(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=xw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&ww(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Hf(e,t,n,r,o={}){let i=Df(e,n,r),s=Nf(i,t,e.invocation.context.configCwd,n,r);if(s===null)return null;let a=s.ruleId!=="secret.deny-path"&&o.strict===!1?Df(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:Nf(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&A_(e,n))return null;return l}function A_(e,t){let n=pe(e,"input-candidate")??pe(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of xo(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(Xe(a.text,t))}let o=St(r);if(o.length===0)return!1;let i=it(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>c_.has(a))}function Df(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=pe(e,"input-candidate");return[...s?xn(s.shell,e.store,r,t,o,n,T_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function T_(e){return e.program.dialect==="powershell"}function xn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new We;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...iw(Xe(e.source,r),t,n,r,o,i)],l=(c)=>Xe(z_(c,s),r);return Eo(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...mi(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...k_(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...jf(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>O_(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return Ks;return a.push({target:l(c.target),cwd:u.cwd}),null}}),a}function Va(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new We;return s.status==="complete"?xn(s,t,n,r,o,i):null}function mi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(kf.has(it(St(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...mi(p,t,n,r,o,i)]}let l=F_(e).map(a),c=St(e);if(c.length===0)return l;let u=c[0]??"",m=it(u).toLowerCase(),d=c.slice(1),f=I_(u,m,d);if(f)return[...l,...f.map(a)];if(Bf.has(m))return n.capturedOutput===!0?[...l,...Vf(e).map(a)]:l;if(m==="eval")return[...l,...Va(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:ot(m,p)).map(a)];if(m==="git")return[...l,...$_(d).map(a)];if(kf.has(m))return[...l,...B_(d).map(a)];if(p_.has(m))return[...l,...fw(d).map(a)];if(s_.has(m))return[...l,...V_(d,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...d.flatMap((p)=>ot("awk",p)).map(a),...d.flatMap((p)=>q_(p,t,n,r,o,i)),...d.flatMap(Y_).map(a)];if(m==="curl")return[...l,...d.flatMap((p)=>ot(m,p)).map(a),...U_(d).map(a)];if(nr(m)){let p=er.has(m)?Se([m,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new We;if(h.status==="complete")return[...l,...xn(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...K_(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>ot(m,p)).map(a)]}function I_(e,t,n){let r=ai(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function k_(e,t,n,r,o,i,s){if(L_(t,n,r,o,i,s))return Vf(e).map((a)=>({target:a,cwd:i}));return jf(t,M_(e),n,r,o,i,s,()=>[])}function O_(e,t,n,r,o,i,s){let a=St(e);if(!nr(it(a[0]??"").toLowerCase()))return[];return Va(t,n,r,o,i,s)??[{target:t,cwd:i}]}function jf(e,t,n,r,o,i,s,a){let l=W_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>er.has(l)?xn(n.getShellSyntax(c),n,r,o,i,s):ui(l,c,n,r,o,i,s))}function Vf(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase();if(!Bf.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Ka(r.replaceAll("%%","%"))];return t.slice(1)}function M_(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return N_(r);return[]}function N_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ka(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>D_(t,r.slice(i*n,(i+1)*n)))}function D_(e,t){let n=0;return Ka(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ka(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function L_(e,t,n,r,o,i){let s=St(e);if(s.length===0||it(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Ut(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Ua]:l.map((m)=>m.split(c).join(Ua));return mi(u,t,n,r,o,i).some((m)=>m.target.includes(Ua))}function W_(e){let t=St(e);if(t.length===0)return null;let n=it(t[0]??"").toLowerCase();if(!nr(n))return null;return G_(n,t.slice(1))?n:null}function G_(e,t){let n=qa(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Uf.has(o)||Kf(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(P_.get(n)?.has(o))r++;continue}return!1}return!0}function qa(e){return/^python\d/.test(e)?"python":e}function F_(e){let t=[];for(let n of e){if(Yf(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Lf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function z_(e,t){if(!t||!Lf.test(e))return e;return`~${e.replace(Lf,"").replace(/\\/g,"/")}`}function ot(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function B_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>ot("jq",i))}return e.flatMap((r,o)=>o===t?[]:ot("jq",r))}function $_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>ot("git",i))];if(t.push(...ot("git",r)),!be.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:ot("git",o)),n++}return t}function U_(e){return e.flatMap((t,n)=>{let r=j_(t);if(r!==null)return Wf(r.flag,r.value);let o=H_(e[n-1]);return o===null?[]:Wf(o,t)})}function Wf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ha(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ha(t.slice(n+1))}return t.startsWith("@")?Ha(t.slice(1)):[]}function H_(e){if(e===void 0)return null;if($f.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function j_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return $f.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ha(e){return e===""||e==="-"?[]:[e]}function V_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!a_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>l_.has(f)),m=u===-1?c:c.slice(0,u),d=mi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,h)=>{if(!u_.has(f))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function K_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Uf.has(c)||Kf(e,c)){let m=t[l+1];if(m!==void 0)a.push(...ui(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...ui(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Kf(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return f_.get(t[t.length-1]??"")?.has(qa(e))??!1}function q_(e,t,n,r,o,i){if(!e.includes("system"))return[];return sa(e)?.commands.flatMap((s)=>xn(t.getShellSyntax(s),t,n,r,o,i))??[]}function Y_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function Z_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Ya),...e.match(ja)??[]]}function ui(e,t,n,r,o,i,s){let a=(f)=>({target:f,cwd:i}),l=J_(t,X_(e));if(l===null)return Z_(t).map(a);let c=l.masked.match(x_)!==null||l.literals.some((f)=>R_.test(l.masked.slice(0,f.start))),u=l.masked.match(__)!==null||l.literals.some((f)=>w_.test(l.masked.slice(0,f.start))),m=r.refineInlineData===!0&&!er.has(e),d=m&&!(nw(l.masked)||c||u)?[]:l.literals;return[...d.map((f)=>f.text).filter((f)=>f!=="").map(a),...d.flatMap((f)=>Ya(f.text)).map(a),...m?[]:l.literals.flatMap((f)=>f.text.match(ja)??[]).map(a),...c?l.literals.flatMap((f)=>Va(f.text,n,r,o,i,s)??[a(f.text)]):[],...u?l.literals.flatMap((f)=>ui(e,f.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
+`:h),n,r,o,i,s)):[],...(l.masked.match(ja)??[]).map(a)]}function X_(e){let t=qa(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function J_(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(v_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&tw(e,o))return null;let a=t==="python"?Q_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=ew(e,c,l);if(u===null)return null;let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&E_.test(m))return null;r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function Q_(e,t){return S_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function ew(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function tw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function nw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(d_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>m_.has(i)))continue;if(o.length>1)return!0;if(rw(e,r)===".")return!0;if(ow(e,r+n.length)==="(")return!0}return!1}function rw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function ow(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function iw(e,t,n,r,o,i){return uw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...xn(a,t,{...n,capturedOutput:!0},r,o,i),...sw(a,r)?aw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function sw(e,t){let n=xo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||it(Xe(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Xe(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function aw(e,t){return xo(e).flatMap((n)=>n.kind==="word"?[Xe(n.text,t)]:n.kind==="redirection"&&n.target?[Xe(n.target,t)]:[]).flatMap(Ya)}function Ya(e){let t=cw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||lw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function lw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function cw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function uw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Wn(o,n))continue;if(qf(e,r,n)){let i=dw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=mw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function dw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Wn(i,n))continue;if(qf(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function mw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function qf(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function fw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===g_)o=!0;if(y_.has(m))r=!0;if(d!==void 0){if(m===Mf)t.push(d);continue}if(b_.has(m)){let f=e[l+1];if(m===Mf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let h=0;h<m.length;h++){let g=m[h]??"";if(h_.has(g))r=!0;if(C_.has(g)){d=g,f=m.slice(h+1);break}}if(d==="")continue;if(f.length>0){if(d===Of)t.push(f);continue}let p=e[l+1];if(d===Of&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function St(e){let t=e.findIndex((n)=>!Yf(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Yf(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var pw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),gw=".env.",hw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),yw=[".env.example.",".env.sample."];function Cw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function bw(e){return e.length>0&&!/\s/.test(e)}function Sw(e,t,n,r){try{let o=vr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof N)throw o;return!1}}var vw=new Set(["node_modules","__pycache__"]),Ew=[["vendor","bundle"],["vendor","cache"]];function xw(e,t,n,r,o){if(Cw(e))return null;let i=He(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>bw(s)||Sw(e,t,r,o);if(hw.has(s)||yw.some((d)=>s.startsWith(d)))return null;let c=B(Tw(e,t,r,o));for(let d of is){let f=`~/${d.suffixParts.join("/")}`;if((Ff(a,f)||Ff(c,f))&&rt(d.id,n))return d.id}let u=Rw(i,t,n,r,o);if(u)return u;if(pw.has(s))return null;for(let d of os)if(s===d.basename&&rt(d.id,n))return d.id;if(s.startsWith(gw)&&rt(Br.id,n)&&l())return Br.id;for(let d of ss)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&rt(d.id,n)&&l())return d.id}for(let d of as)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&rt(d.id,n))return d.id}if(Pw(a))return null;if(!s.includes(".")&&Gn.pattern.test(s)&&rt(Gn.id,n))return Gn.id;let m=Aw(s,n);if(m)return m;return null}function Rw(e,t,n,r,o){return $r.find((i)=>{if(!rt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Sr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,He("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||br(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Sr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,He(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||br(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||br(e,s,["credentials"])||br(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>Sr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?z(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?Sr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,He(u,t,r,o),l))}case"secret.cli.pi":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=He("~",t,r,o);return[le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),le(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||br(e,le(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),le(He("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Sr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=le(z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,He("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&Vt(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,He("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Gf=new WeakMap;function z(e,t,n,r,o){let i=Gf.get(o)??new Map;Gf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=He(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>Zf(e,le(t,r)))}function br(e,t,n){return n.some((r)=>Vt(B(e),B(le(t,r))))}function Sr(e,t,n,r,o){return Zf(e,He(t,n,r,o))}function Zf(e,t){return B(e)===B(t)}function le(e,...t){return Be([e,...t].filter(Boolean).join("/"))}function _w(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(vr(e,t,o,i));return n.some((a)=>Vt(s,B(vr(a,r,o,i))))}function ww(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(vr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Be(F(Ce(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=B(u?Be(F(di(Ce(u)),o.paths,i)):l&&Be(F(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Vt(s,m))return!1;return n.some((d)=>{let f=B(vr(d,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return Vt(s,f)})}function Pw(e){let t=e.split("/");return t.some((n)=>vw.has(n))||Ew.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Aw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ls)if(r===o.extension&&rt(o.id,t))return o.id;for(let o of cs)if(o.pattern.test(r)&&rt(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function rt(e,t){return!t?.disabledRules?.includes(e)}function He(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i)return"";if(!o)return i;let s=Xa(i,o),a=ci(s)?s:Be(di(t,s)),l=Be(F(a,n.paths,r));if(!Vt(l,o)){if(ci(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Ff(e,t){return e===t||e.startsWith(`${t}/`)}function Tw(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i||!o)return"";let s=Xa(i,o),a=r_.normalize(ci(s)?s:Be(di(t,s))),l=Be(Ce(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Vt(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function vr(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i)return"";let s=o?Xa(i,o):i;return Be(F(ci(s)?s:di(t,s),n.paths,r))}function Za(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Be(F(Ce(r),t.paths,n)):"",i=Be(Ce(Iw(Xe(e,t))));return{home:o,normalized:i}}function Iw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return i_(e)}catch{return e}}function Xa(e,t){if(e==="~")return t;if(e.startsWith("~/"))return le(t,e.slice(2));return e}function kw(e){if(process.platform==="win32")return!0;return o_.parse(e).root.length>1}function Be(e){let t=e.trim(),n=(t.includes("\\")&&kw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Vt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function it(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Kt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Ow={findPolicyMutation:Tf,findGitMetadataMutation:ad,resolveGitMetadata:Mw,loadPolicySnapshot:qc,findSensitiveTarget:Hf,analyzeCommand:Sf,getModes:Mi};function Xf(e,t){let n={...Ow,...t.dependencies},r=Lw(e),o=Er(e)?e.command:r,i=vt("policy-protection",o,()=>rr(e)),s=pe(i,"input-candidate"),a=pe(i,"declared-command");if(Er(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:$e,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:wd,intent:"stop_and_explain"}};let l=ye(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Af,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=vt("policy-protection",o,()=>Rf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:xf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ae,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let f=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...Nw(f)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:Er(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:zf,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!Er(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Ja("command-validation",o),...g};let v=vt("command-analysis",o,()=>vf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Dw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function Mw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Nw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Dw(e){return pe(e,"declared-command")?.program}function Lw(e){try{return Tn(e.input)}catch(t){let n=Er(e)?e.command:void 0;throw new Kt("policy-protection",Ja("policy-protection",t instanceof Ve?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Kt(e,Ja(e,r instanceof Ve?void 0:t,r),r)}}function Ja(e,t,n){let r=n instanceof N||n instanceof We;return{stage:e,decision:{kind:"deny",reason:r?Ci:_n,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Er(e){return e.route.kind==="command"}import{appendFileSync as Yw,mkdirSync as Zw}from"node:fs";import{isAbsolute as Xw,join as tl}from"node:path";import{lstatSync as Qf,readdirSync as Ww,readFileSync as Gw,rmdirSync as Fw,statSync as ep,unlinkSync as zw,utimesSync as Bw,writeFileSync as $w}from"node:fs";import{join as xr}from"node:path";function Jf(e,t={}){return Zr(Qt(e,t),e.home).policy.audit.retention_days}var el=86400000,Uw=".last-prune",Hw=/^\d{4}-\d{2}$/,jw=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,tp=(e)=>Math.floor(e/el);function rp(e,t,n=()=>new Date){try{let r=n().getTime();if(!ep(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=xr(t,Uw),i=ep(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&tp(i)===tp(r))return;let s=r-Jf(e)*el,a=new Date(r).toISOString().slice(0,7);for(let l of Qa(t)){if(l.isDirectory()){Vw(xr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))Kw(xr(t,l.name),s)}$w(o,"",{mode:384}),Bw(o,r/1000,r/1000)}catch{}}function Vw(e,t,n){for(let r of Qa(e)){if(!r.isDirectory()||!Hw.test(r.name))continue;let o=xr(e,r.name);for(let i of Qa(o)){if(!i.isFile())continue;let s=jw.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+el;if(!Number.isFinite(a)||a>=t)continue;op(xr(o,i.name))}if(r.name!==n)np(o)}np(e)}function Kw(e,t){try{let n=Qf(e);if(n.mtimeMs>=t)return;let r=Gw(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(qw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Qf(e).mtimeMs!==n.mtimeMs)return;op(e)}catch{}}function qw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Qa(e){try{return Ww(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function op(e){try{zw(e)}catch{}}function np(e){try{Fw(e)}catch{}}var Jw="2.4.5",Qw=1e4,eP=2000,tP=256,nP=32768;function rP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function oP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function nl(e,t,n,r,o,i,s={}){let a=rP(t);if(!a)return;let l=sP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=fi(st(n),s.failureStage?Number.POSITIVE_INFINITY:Qw),m=fi(st(r),eP),d=s.toolName?fi(st(s.toolName),tP):void 0,f=i===null?void 0:fi(st(i),nP),p=tl(l,oP(f?.value??null),c.slice(0,7));Zw(p,{recursive:!0,mode:448});let h=tl(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Di)(),v:Jw,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Yw(h,`${JSON.stringify(g)}
+`,{encoding:"utf-8",mode:384}),rp(e,l,s.now)}catch{}}function fi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function iP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&Xw(n)?n:null}function sP(e){let t=iP(e);return t?tl(t,".cc-safety-net","logs"):null}function sp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=ip(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?ip(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function ip(e){return"command"in e?e.command??"":""}function ap(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;nl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function lp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;nl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function up(e,t,n){try{let r=Xf(t,{environment:e,...n.guard});return cp(e,t,r,n),r}catch(r){if(!(r instanceof Kt))throw r;throw cp(e,t,r.evaluation,n,!(r.cause instanceof Ve),{stage:r.stage,errorCode:aP(r.cause)}),r}}function cp(e,t,n,r,o=!0,i){ap(e,sp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function aP(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Ve)return"tool-input-limit";if(e instanceof We)return"structural-shell-syntax-limit";return"unexpected-error"}function Et(e,t={}){return{malformed:!0,denial:wn(t),cwd:e}}function dp(e,t={}){return(n,r)=>{try{return lP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(wn())}}}function lP(e,t,n,r){let o=Fl();if(n.cancelled?.(t))return n.block(wn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return lp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=ll(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=up(o,i,{guard:{auditAllowed:zl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Kt))throw l;if(Rt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${ul(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var mp="exec",cP=new Set(["auto","gateway"]);function fp(e){e.on("before_tool_call",uP(e),{matcher:[mp],priority:50})}function uP(e,t={}){return dp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>dP(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>pP(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function dP(e,t,n,r){if(!e||typeof e!=="object")return Et(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Et(null);if(o!==mp)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Et(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Et(null,{toolName:o});if(s.host!==void 0&&!cP.has(s.host))return Et(null,{command:a,toolName:o});let l=mP(n,t.agentId,r);if(!l)return Et(null,{command:a,toolName:o});let c=fP(l,s,r);if(!c)return Et(l,{command:a,segment:typeof s.workdir==="string"?s.workdir:void 0,toolName:o});return In(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function mP(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return wi(".",[r],n)}catch{return}}function fP(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return wi(r,[e],n)}function pP(e){return{block:!0,blockReason:cl(e)}}var EL={...al,register:fp};export{EL as default};