cc-safety-net 2.4.4 → 2.4.5

package/dist/openclaw/cc-safety-net/index.js

@@ -1,48 +1,48 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.4.4
-var al={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Ci="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",$e="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",xn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var yi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Rn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...yi},processedCandidateBytes:{cap:4194304,...yi},pathEnvironmentExpansion:{cap:64,...yi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Rn},trackedHeredocFiles:{cap:64,...Rn},controlFlowStates:{cap:64,...Rn},wrapperPeelIterations:{cap:20,...Rn},derivedCommandShape:Rn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function ye(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var pp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function st(e){return gp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function gp(e){return pp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var hp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function yp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,hp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+// version: 2.4.5
+var al={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Ci="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",$e="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",_n="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var yi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Rn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...yi},processedCandidateBytes:{cap:4194304,...yi},pathEnvironmentExpansion:{cap:64,...yi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Rn},trackedHeredocFiles:{cap:64,...Rn},controlFlowStates:{cap:64,...Rn},wrapperPeelIterations:{cap:20,...Rn},derivedCommandShape:Rn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function ye(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var pp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function st(e){return gp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function gp(e){return pp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var hp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function yp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,hp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function ll(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function _n(e={}){return{reason:xn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function cl(e){return yp({...e,redact:st})}function ul(e){return st(e instanceof Error?e.message:String(e))}import{isAbsolute as Ol,relative as jp,resolve as Vp,sep as Kp}from"node:path";import{basename as ml,dirname as Cp,isAbsolute as bp,join as Sp,normalize as vp,resolve as dl}from"node:path";var Ep=256,xr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function at(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ei(e,t){return bi(e,0,t)}function bi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Si(e,o+2),a=Rp(e,o,t);if(a===null){if(xr.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=xp(l,t,n),o=a+1;continue}let i=Si(e,o+1);if(!i){r+="$",o++;continue}r+=vi(i,n)??`$${i}`,o+=i.length+1}return r}function Rp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function xp(e,t,n){let r=e.slice(2,-1),o=Si(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return vi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(xr.has(o))throw new N("pathEnvironmentExpansion");return e}if(!xr.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=vi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":bi(i.slice(s.length),t+1,n);return l?bi(i.slice(s.length),t+1,n):""}function Si(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function vi(e,t){if(!xr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function F(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){pl(n,i);let s=t.realpath(i);if(s!==null)return fl(n,e,s,o);let a=Cp(i);if(a===i||o.length>=Ep)return fl(n,e,i,o);o.push(ml(i)),i=a}}function fl(e,t,n,r){let o=r.length===0?n:Sp(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function _p(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;pl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function pl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=hl(e,t,n);if(!o)return"";return F(o,n.paths,r).replace(/\\/g,"/")}function gl(e,t,n,r,o){let i=hl(e,t,n);if(!i)return null;if(o(ml(i)))return F(i,n.paths,r).replace(/\\/g,"/");let s=_p(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function hl(e,t,n){let r=n.home,o=Ei(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?dl(r,o.slice(2)):o,s=Ce(i);return vp(bp(s)?s:dl(t,s))}import{types as wp}from"node:util";var Pp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Ap=new Set(["command","diff","input","patch","patchtext"]),yl=new TextEncoder,Tp=new TextDecoder,Ip=/\s/,kp=64;class Ve extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var wn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Op(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function wr(e){return Pp.has(Op(e))}function An(e){if(!e||typeof e!=="object")return;Al(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ue();return}if(t.get||t.set)Ue();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function El(e,t){return Rl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Rl(e,t,n,r){let o=Pl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Rl(a,t,n,r+1);return typeof a==="string"&&t.has(xl(s))?[a]:l});return n.ancestors.delete(o.object),i}function xl(e){return e.replace(/-/g,"_").toLowerCase()}function _l(e){return wl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Np)}function wl(e,t,n,r){let o=Pl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>wl(a,o.array?t:Ap.has(xl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Mp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>wn.maxDepth||t.nodes>wn.maxNodes)Ue();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>wn.maxStringBytes||t.stringBytes>wn.maxAggregateStringBytes)Ue()}function Pl(e,t,n){if(Mp(e,t,n),!e||typeof e!=="object")return null;let r=Al(e);if(t.ancestors.has(e))Ue();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>wn.maxKeys)Ue();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ue();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Al(e){if(wp.isProxy(e))Ue();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ue();return t}function Ue(){throw new Ve}function Np(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Dp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ri(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ri(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(..._i(_r(c.slice(4),!0),_r(u.slice(4),!0))),l++;continue}if(!r)t.push(...Ri(c))}return t}function Dp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ri(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return vl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return vl(n[1]);if(e.startsWith("diff --git "))return Lp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Sl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Sl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Up(i[1]);return[]}function Lp(e){let t=Wp(e);if(t.length===2&&t[0]&&t[1])return _i(t[0],t[1]);let n=Gp(e);return n?_i(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Wp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Rt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Rt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Tl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Rt(e[n]))n++;return n===e.length?t:[]}function Gp(e){let t=0;while(t<e.length&&Rt(e[t]))t++;let n=e.length;while(n>t&&Rt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Rt(e[o])){o++;continue}let i=o;while(o<n&&Rt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>kp)Ue();if(Fp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Fp(e,t,n,r,o){if(xi(e,t,n,r,o))return!0;let i=Cl(e,"/",t,n),s=Cl(e,"/",r,o);if(i<=t||s<=r)return!1;if(xi(e,t,i,r,s))return!1;return xi(e,i+1,n,s+1,o)}function xi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Cl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Rt(e){return e!==void 0&&Ip.test(e)}function Tl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Tp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...yl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...yl.encode(zp(s[0]??""))),o+=2}return null}function zp(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function Bp(e){return Pn(Hp(e))}function _i(e,t){if(e==="/dev/null")return bl(t);if(t==="/dev/null")return bl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Pn);let n=$p(e,t)??(e===t?Il(e):null);return[e,t,...n?[n]:[]].flatMap(Pn)}function bl(e){let t=Il(e);return[e,...t?[t]:[]].flatMap(Pn)}function Il(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function $p(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Sl(e){return Bp(_r(e,!0))}function Up(e){return Pn(_r(e,!1))}function _r(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Tl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Hp(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Pn(e){return e===""||e==="/dev/null"?[]:[e]}function vl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function wi(e,t,n){if(at(e))return;let r=t.flatMap((i)=>kl(i,n));if(!r[0])return;let o=kl(Ol(e)?e:Vp(r[0],e),n)[0];if(!o)return;return r.some((i)=>qp(o,i))?o:void 0}function kl(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function qp(e,t){let n=jp(t,e);return n===""||n!==".."&&!n.startsWith(`..${Kp}`)&&!Ol(n)}function Tn(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Eg,realpathSync as Rg,statSync as xg}from"node:fs";import{homedir as _g,tmpdir as wg}from"node:os";import{statSync as bg}from"node:fs";import{join as Sg}from"node:path";import{spawnSync as Yp}from"node:child_process";import{existsSync as kn,lstatSync as Zp,readFileSync as On,realpathSync as Yt,statSync as In}from"node:fs";import{dirname as Pi,isAbsolute as Ai,join as Zt,resolve as Pr}from"node:path";var Xp=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Jp=5000;function Nl(e,t=gg(),n=Jp){let r=Qp(e),o=r===null?null:eg(r);if(r===null||o===null)return null;let i=mg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Qp(e){try{let t=Yt(Pr(e));return In(t).isDirectory()?t:null}catch{return null}}function eg(e){let t=fg(e);if(!t)return null;try{let n=Zp(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Ti(t);if(!r?.commonDir)return null;if(!rg(r.gitDir,t))return null;return og(r.gitDir,Pi(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Ti(e){try{let t=tg(e);if(!t)return null;let n=Yt(Ai(t)?t:Pr(Pi(e),t));if(!In(n).isDirectory())return null;return{gitDir:n,commonDir:ng(n)}}catch{return null}}function tg(e){let t=On(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function ng(e){try{let t=On(Zt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Yt(Ai(t)?t:Pr(e,t));return In(n).isDirectory()?n:null}catch{return null}}function rg(e,t){let n=ig(e);return n===null?!1:Dl(e,n,t)}function og(e,t){let n=sg(e);return n===null?!0:Dl(e,n,t)}function ig(e){let t=Zt(e,"gitdir");if(!kn(t))return null;let n=On(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function sg(e){let t=Zt(e,"config.worktree");return kn(t)?lg(t):null}function Dl(e,t,n){try{return ag(Ai(t)?t:Pr(e,t),n)}catch{return!1}}function ag(e,t){try{let n=In(e),r=In(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Ml(Yt.native(e))===Ml(Yt.native(t))}function Ml(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function lg(e){let t=On(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=cg(s[1]??"")}return r}function cg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return dg(t.slice(1,-1))}var ug={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function dg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:ug[n]??t)}function fg(e){try{return Ii(Yt(e))}catch{return null}}function Ii(e){let t=e;while(!0){let n=Zt(t,".git");if(kn(n))return n;let r=Pi(t);if(r===t)return null;t=r}}function mg(e,t,n,r){if(pg(t))return!0;if(n===null)return!0;let o=Yp(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:hg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Ll(o.stdout.trim())}function pg(e){return[Zt(e.commonDir,"config"),Zt(e.gitDir,"config.worktree")].filter((t)=>kn(t)).some((t)=>yg(t))}function gg(){return Xp.find((e)=>kn(e))??null}function Mn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function hg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Mn(t)))}function yg(e){let t;try{t=On(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Cg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Ll(c)}return r}function Cg(e){return e==="include"||e.startsWith("includeif ")}function Ll(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Wl(e,t){if(e==="")return null;let n=ye(),r=Ii(se(e,e,t,n)),o=r?vg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function vg(e,t,n,r){try{let o=se(e,t,n,r),i=bg(e),s=i.isFile()?o:null,a=i.isFile()?Ti(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Xt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Xt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Xt(o),markerFile:s?Xt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let f=Xt(Sg(u,"hooks").replace(/\\/g,"/"));return[f,Xt(se(f,t,n,r))]}))]}}catch{return null}}function Xt(e){return process.platform==="win32"?e.toLowerCase():e}var Pg={realpath:(e)=>{try{return Rg(e)}catch{return null}},entryKind:(e)=>{let t=Eg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return xg(e).isDirectory()}catch{return!1}}};function Fl(){return Ag({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ce(process.env.HOME||_g()),tmpdir:wg(),paths:Pg})}function Ag(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Gl(n,i,()=>Wl(i,o)),worktreeFacts:(i)=>Gl(r,i,()=>Nl(i)),...t};return o}function Gl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Jt=["fail_closed","paranoid_rm","paranoid_interpreters"],Ar={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Tr=["standard","strict","paranoid"];function Tg(e,t){if(!t)return e;return Tr.indexOf(t)>Tr.indexOf(e)?t:e}function Ig(e){let t=Ni(Q.level,e);if(t===void 0||t==="")return;if(Tr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Tr.join(", ")}.`);return}function kg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function zl(e){return kg(Ni(Q.auditScope,e))==="all"}function Oi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Mi(e={},t){let n=e.safety?.level??"standard",r=Ig(t),o=Tg(n,r),i=Ar[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(xt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(xt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(xt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(xt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||xt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Oi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function xt(e,t){let n=typeof e==="string"?ki(e,t):Ni(e,t);return n==="1"||n?.toLowerCase()==="true"}function ki(e,t){return t.get(e)}function Ni(e,t){let n=ki(e.name,t);if(n!==void 0)return n;if(e.legacyName)return ki(e.legacyName,t);return}import{dirname as Gr}from"node:path";import{closeSync as Og,constants as Bl,fstatSync as Mg,fsyncSync as XP,lstatSync as Wi,mkdirSync as JP,openSync as Ng,readdirSync as QP,readFileSync as Dg,realpathSync as Gi,renameSync as eA,rmdirSync as tA,statSync as Lg,unlinkSync as nA,writeFileSync as rA}from"node:fs";import{isAbsolute as $l,join as Fi,normalize as Wg,parse as Li,relative as zi,resolve as Bi,sep as $i}from"node:path";function Di(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Gg=Symbol("PolicyFilesystemScope"),Fg=Symbol("PolicyFilesystemTarget"),zg=Bl.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function _t(e,t){return{[Gg]:!0,root:Bi(e),label:t}}function Ul(e,t){let n=Wg(t);if(t===""||$l(t)||n===".."||n.startsWith(`..${$i}`))throw new ae(e.label);return{[Fg]:!0,scope:e,relativePath:n,path:Fi(e.root,n)}}function Nn(e,t){return Ul(e,zi(e.root,Bi(t)))}function Hl(e,t="rules policy"){let n=Bi(e),r=Li(n).dir;return Ul(_t(r,t),zi(r,n))}function kr(e){return Vl(e.scope.label,()=>{if(!Ir(e))return null;let t=Ng(e.path,Bl.O_RDONLY|zg);return Bg(t,()=>{let n=Mg(t);if(!n.isFile())throw new ae(e.scope.label);let r=Dg(t,"utf-8"),o=Wi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return Ir(e),r})})}function jl(e,t){if(e.path===t.path)return!0;return Vl(e.scope.label,()=>{if(!Ir(e)||!Ir(t))return!1;let n=(r)=>Fi(Gi(Li(r).dir),Li(r).base);return n(e.path)===n(t.path)})}function Vl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function Bg(e,t){try{return t()}finally{Og(e)}}function Ir(e,t="file"){let n=$g(e.scope);if(!n)return!1;let r=e.relativePath.split($i);for(let o of r.keys()){let i=Fi(e.scope.root,...r.slice(0,o+1)),s=Wi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);Ug(n,Gi(i),e.scope.label)}return!0}function $g(e){if(!Wi(e.root,{throwIfNoEntry:!1}))return null;if(!Lg(e.root).isDirectory())throw new ae(e.label);return Gi(e.root)}function Ug(e,t,n){let r=zi(e,t);if(r===".."||r.startsWith(`..${$i}`)||$l(r))throw new ae(n)}import{dirname as Pt,isAbsolute as qg,join as Tt,relative as Yg,resolve as At,sep as Zg}from"node:path";var wt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Kl="rulebook.json",ql=".cc-safety-net/rules";var Yl=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Hg=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,jg=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Vg="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),aA=new RegExp(`^${jg}/(${wt.source.slice(1,-1)})/${Vg}$`);function Kg(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Zl(e){if(Or(e))try{return Ui(e),null}catch(t){return t instanceof Error?t.message:String(t)}return wt.test(e)?null:`Local rulebook sources must be bare names matching ${wt}: ${e}`}function Ui(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Yl);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Hg.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!wt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Kg(o),name:o}}function Or(e){return Yl.test(e)}var Xl="rule.json",Mr="policy.json",Jl=".cc-safety-net",Xg="rules",Jg="CC_SAFETY_NET_HOME",Ql="`cc-safety-net rule update`";function Qg(e){return At(e,ql)}function eh(e){return Tt(Qg(e),Xl)}function Dn(e){return Tt(At(e),Jl,Mr)}function Hi(e,t={}){return t.userConfigDir??(t.userConfigPath?Pt(t.userConfigPath):Tt(th(e),Xg))}function th(e){let t=e.env.get(Jg);return t?At(Ce(t)):Tt(e.home,Jl)}function nh(e,t={}){return Tt(Hi(e,t),Xl)}function Qt(e,t={}){return Tt(Pt(Hi(e,t)),Mr)}function ec(e,t){let n=t.userConfigPath??nh(e,t),r=t.projectConfigPath??eh(t.cwd),o=rh(e,t),i=oh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Nn(o,n),projectConfigTarget:Nn(i,r)}}function rh(e,t){let n=t.userConfigPath?Pt(Pt(At(t.userConfigPath))):Pt(At(t.userConfigDir??Hi(e,t)));return _t(n,"user policy")}function oh(e,t){let n=At(t),r=At(e),o=Yg(n,r);if(o!==".."&&!o.startsWith(`..${Zg}`)&&!qg(o))return _t(n,"project policy");return _t(Pt(Pt(r)),"project policy")}function tc(e,t){return Tt(e,t,Kl)}var be=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),lt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ct=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),nc=new Set(["python","python3","python2","node","ruby","perl"]),Nr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Dr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var rc="Rulebook exceeds CC Safety Net's safe validation limits.",oc="Additional rulebook validation errors were omitted.",ke=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function ic(e){if(ji(e.allowed_commands,ke.maxAllowedCommands)||ji(e.rules,ke.maxRules)||ji(e.tests,ke.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=ke,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>ke.maxStringCodeUnits||i&&o.length>ke.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>ke.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function ji(e,t){return Array.isArray(e)&&e.length>t}var Vi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ki=64,qi="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var ih={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Yi=new Set(["--init-file","--rcfile"]);function Zi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let f=t.slice(c+1);if(t[0]==="-"&&(f==="c"||f[0]==="-"&&f.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!ih[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Se(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Yi.has(l)&&!s.includes("="))i++;continue}let a=Zi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Ln(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Lr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of sh(e))Ln(n,t);return t.inSingle||t.inDouble}function sh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Ln(s,n)}return t}var Xi=new Set(["rm","find","xargs","parallel"]),ah=new Set(["git","busybox",...Xi,...J,...nc,...we]),lh=new Set(["python","node","ruby","perl"]);function sc(e){let t=M(e);return ah.has(t)||Oe(t)}function Oe(e){return lh.has(ch(e))}function ch(e){let t=k(e).toLowerCase();return Nr.test(t)?"python":t}function Ji(e){try{let t=kr(uh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=mh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function uh(e){return typeof e==="string"?Hl(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function ac(e){let t=new Set;return e.flatMap((n,r)=>{let o=en(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Qi=`must be one of ${Vi.join(", ")}`,dh=/^[^/]+\/[^/]+$/,fh=["version","rules","overrides","transparent_wrappers"];function mh(e){let t=ph(e);return{errors:es(Rh(t,fh,(n)=>n.kind==="custom"),": "," "),sources:Eh(e,t)}}function ph(e){if(!en(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Ki;return[...e.version===1?[]:[_(["version"],"must be 1")],...gh(e.rules,t),...Ch(e.overrides),...Sh(e.transparent_wrappers),...t?[]:yh(e.rules),...en(e.overrides)?Object.keys(e.overrides).filter((n)=>!dh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...vh(e.transparent_wrappers)]}function gh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...lc(e,Ki)?[_(["rules"],qi)]:[]];if(t)return[{path:["rules"],message:qi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...hh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function lc(e,t){let n=cc(e);return n!==void 0&&!(n<=t)}function hh(e,t){let n=cc(e);return n!==void 0&&!(n>=t)}function cc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function yh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=Zl(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Ch(e){if(e===void 0)return[];if(!en(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!en(n))return[_(["overrides",t],'must be "off" or an object')];return[...bh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||ns(n.intent)?[]:[_(["overrides",t,"intent"],Qi)]]})}function bh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...lc(e,ct)?[_(t,`must be at most ${ct} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ct?[_(t,`must be at most ${ct} characters`)]:[]}function Sh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return lt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function vh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(sc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Eh(e,t){let n=en(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Rh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function es(e,t,n){return[...new Set(e.map((r)=>{let o=ts(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ts(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function ns(e){return Vi.includes(e)}function en(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function dc(e){let t=wh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var xh=`required non-empty string up to ${ct} characters`,uc="must be a non-empty array of unique non-empty strings",_h="required non-empty array of non-empty strings";function wh(e){if(!ut(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!ic(e))return{errors:[rc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...es(Ph(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>ke.maxValidationErrors?[...t.slice(0,ke.maxValidationErrors),oc]:t,ruleNames:new Set(fc(e).map((n)=>n.toLowerCase()))}}function fc(e){let t=ut(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ut(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Ph(e,t){return[...typeof e.name==="string"&&wt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Ah(e.allowed_commands),...Th(e.rules,t),...Mh(e.tests),...Nh(e),...Dh(e)]}function Ah(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&lt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Th(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!ut(n))return[_(["rules",r],"must be an object")];return t?kh(n,["rules",r]):Ih(n,["rules",r])}),...ac(e)]}function Ih(e,t){return[...mc(e.name,t),...pc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&lt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Wr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...gc(e.reason,t),...hc(e.intent,t)]}function kh(e,t){return[...mc(e.name,t),...pc(e.command,t),...gc(e.reason,t),...hc(e.intent,t),...Oh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function mc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return wt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function pc(e,t){return typeof e==="string"&&lt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function gc(e,t){return typeof e==="string"&&e!==""&&e.length<=ct?[]:[_([...t,"reason"],xh)]}function hc(e,t){return e===void 0||ns(e)?[]:[_([...t,"intent"],Qi)]}function Oh(e,t){if(!ut(e))return[_(t,"required object")];return[...Wr(e.command_path,[...t,"command_path"],_h,!1),...e.any_args===void 0?[]:Wr(e.any_args,[...t,"any_args"],uc,!0),...e.exclude_args===void 0?[]:Wr(e.exclude_args,[...t,"exclude_args"],uc,!0)]}function Wr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Mh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!ut(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Nh(e){if(!Array.isArray(e.tests))return[];let t=new Set(fc(e));return[...new Set(e.tests.flatMap((n)=>ut(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function Dh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=ut(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function ut(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ec(e,t){let n=ec(e,t),r=!1;try{r=jl(n.userConfigTarget,n.projectConfigTarget)}catch(m){if(m instanceof ae)return Hh(n,m.message);throw m}let o=Ji(n.userConfigTarget),i=r?{config:null,errors:[]}:Ji(n.projectConfigTarget),s=Sc(n.userConfigPath,o.errors),a=Sc(n.projectConfigPath,i.errors),l=new Set,c=o.config?yc(o.config,Gr(n.userConfigPath),"user",n.userScope,l):vc(),u=i.config?yc(i.config,Gr(n.projectConfigPath),"project",n.projectScope,l):vc(),f=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Cc(c.rules,f),...Cc(u.rules,d)],transparent_wrappers:$h(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?bc(f,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Uh(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?bc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function yc(e,t,n,r=_t(Gr(Gr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Wh(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let f=u.rulebook;if(o.has(f.name))return s.push(`duplicate active rulebook name "${f.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(f.name),[{rules:Lh(f),rulebook:{source:n,spec:c,name:f.name,version:f.version,rules:f.rules.map((d)=>`${f.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Lh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Wh(e,t,n){let r=Gh(e),o=tc(t,r),i=zh(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Fh(e)}`]};let s=Bh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Gh(e){return Or(e)?Ui(e).name:e}function Fh(e){return Or(e)?`run ${Ql} to vendor ${e}`:"create that file or remove that source from the rules config"}function zh(e,t){try{return{content:kr(Nn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function Bh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:dc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function $h(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Cc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function bc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Uh(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Sc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Hh(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function vc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as ry,readFileSync as oy}from"node:fs";var Rc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],rs=new Set(Rc.map((e)=>e.id)),Fr=Rc,jh=new Map(Fr.map((e)=>[e.id,e.intent]));function b(e,t){return{id:e,reason:t,intent:jh.get(e)??"manual_only"}}var os=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],zr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Vh=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Kh=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],is=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Kh.flatMap((e)=>Vh.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Br=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],xc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],qh=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ss=xc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),as=xc.flatMap((e)=>qh.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Wn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ls=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),cs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Yh=[...os,zr,...is,...ss,...as,Wn,...ls,...cs,...Br].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),$r=new Set(Br.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),us=new Set(Yh.map((e)=>e.id));import{isAbsolute as ds,join as Zh,normalize as Xh,sep as Ur}from"node:path";var _c=process.platform==="win32",Jh=/[*?]/;function Gn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function fs(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Gn(e.trim(),t);if(!ds(n))return"must be an absolute path or start with ~/";return Fn(n,t)}function ms(e,t){let n=wc(e,t);if(n===null)return"must be a non-empty path string";if(!ds(n))return null;if(Fn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Qh="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",ey="cannot cover the guard's own configuration";function wc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Gn(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ps(e,t){let n=wc(e,t);if(n===null)return"must be a non-empty path string";if(Jh.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!ds(n))return null;if(Fn(n,t)!==null)return Qh;return ty(n,t)?ey:null}function ty(e,t){let n=Hr(e),r=Hr(Zh(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Ur}`)}function Fn(e,t){let n=Hr(e),r=Hr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Ur)?n:`${n}${Ur}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Hr(e){let t=Xh(e);if(_c)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(_c?3:1)&&t.endsWith(Ur))t=t.slice(0,-1);return t}var Pc=30,jr=1,Vr=365;function Ac(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Tc=new Set(Fr.filter((e)=>e.catastrophic).map((e)=>e.id));function A(e,t){if(!e)return null;if(Tc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Tc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Ic(e,t){return Object.freeze(Object.fromEntries(Fr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function kc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Ic(e,t)})}var Oc={standard:0,strict:1,paranoid:2};function Dc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:gs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:gs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:gs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:ny(e,t)}}function gs(e,t){return[...new Set([...e,...t??[]])]}function ny(e,t){let n=t.safety?.level,r=Ar[e.safety.level];return[...n&&Oc[n]<Oc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Jt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Mc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Mc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!$r.has(o))),...e.destructive_command_protection.enabled?Nc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Nc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Mc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Nc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Cs=new Set(["standard","strict","paranoid"]),Fc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Pc}};function zc(e,t){let n=py(Qt(e,t),e.home),r=Yr(Dn(t.cwd),e.home),o=sy(r.parsed,e.home),i=Object.keys(o.policy).length>0?Dc(n.gui??Fc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ys(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var iy="project policy audit settings are ignored; audit is user scope only";function sy(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...Cs.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Lc({overrides:Bc(n.overrides,Jt,["safety","overrides"],It)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:qr(o.overrides,rs,Uc,It)}:{},...o.allow_paths!==void 0?{allow_paths:nn(o.allow_paths,fs,t,["destructive_command_protection","allow_paths"],It)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:qr(i.overrides,us,Hc,It)}:{},...i.deny_paths!==void 0?{deny_paths:nn(i.deny_paths,ms,t,["secret_protection","deny_paths"],It)}:{},...i.allow_paths!==void 0?{allow_paths:nn(i.allow_paths,ps,t,["secret_protection","allow_paths"],It)}:{}};return{policy:Lc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[iy]}}function Bc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],bs));return[]}))}function Lc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var It=()=>{return},bs="must be a boolean",Ss="must be an object if provided",$c=`must be an integer between ${jr} and ${Vr}`,Uc={path:["destructive_command_protection","overrides"],label:"destructive command"},Hc={path:["secret_protection","overrides"],label:"secret protection"},ay=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function ly(e,t){let n=[];return{policy:jc(e,t,(o)=>{n.push(o)}),issues:n}}function cy(e,t){return jc(e,t,It)}function jc(e,t,n){if(!ve(e))return n(_([],"Config must be an object")),Kr();if(e.version!==1)n(_(["version"],"must be 1"));let r=tn(e.safety,["safety"],["level","overrides"],n),o=tn(r.overrides,["safety","overrides"],Jt,n),i=tn(e.workflow,["workflow"],["worktree_mode"],n),s=tn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=tn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=tn(e.audit,["audit"],["retention_days"],n);return Vc(e,ay,[],n),{version:1,safety:{level:uy(r.level,n),overrides:Bc(o,Jt,["safety","overrides"],n)},workflow:{worktree_mode:hs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:hs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:qr(s.overrides,rs,Uc,n),allow_paths:nn(s.allow_paths,fs,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:hs(a.enabled,["secret_protection","enabled"],!0,n),overrides:qr(a.overrides,us,Hc,n),deny_paths:nn(a.deny_paths,ms,t,["secret_protection","deny_paths"],n),allow_paths:nn(a.allow_paths,ps,t,["secret_protection","allow_paths"],n)},audit:{retention_days:dy(l.retention_days,n)}}}function tn(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(t,Ss)),{};return Vc(e,n,t,r),e}function Vc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function uy(e,t){if(e===void 0)return"standard";if(Cs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function hs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,bs));return n}function dy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=jr&&e<=Vr))t(_(["audit","retention_days"],$c));return Ac(e)}function qr(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(n.path,Ss)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function nn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Kr(){return structuredClone(Fc)}function Yr(e,t){if(!ry(e))return{exists:!1,policy:Kr(),errors:[]};try{let n=oy(e,"utf-8");if(!n.trim())return{exists:!0,policy:Kr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=ly(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${my(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Kr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var fy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ss,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[bs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[$c,`not an integer between ${jr} and ${Vr}`]]);function my(e){let t=ts(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=fy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function py(e,t){let n=Yr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:Gc(),errors:[]};let o=cy(r,t);return{policy:ys(o),gui:o,errors:[],levelPresent:Wc(r)}}if(n.parsed===void 0)return{policy:Gc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ys(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Wc(n.parsed)}}function Wc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return Cs.has(t.level)}function Kc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...$r].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Gc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Kc({}),denyPaths:[],allowPaths:[]}}}function ys(e){return{safety:gy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Kc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function gy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function qc(e,t){let n=Ec(e,t),r=zc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...by(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Sy(o,hy(n,r),s,r.policyScopes)}function hy(e,t){let n=Cy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:vy(e.errors.length>0?yy(e.errors):void 0,e.warnings.length>0?Es(e.warnings.join("; ")):void 0,n)}}function yy(e){return`${Es(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Cy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function by(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Sy(e,t,n=Object.freeze({}),r){let o=vs(structuredClone(e)),i=r?{policyScopes:vs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function vs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))vs(t);return Object.freeze(e)}function vy(...e){return Es(e.filter((t)=>!!t).join("; "))}function Es(e){return/[.!?]$/.test(e)?e:`${e}.`}function Yc(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Rs(t.fail_closed,e.strict,"strict"),paranoid_rm:Rs(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Rs(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:kc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Oi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Rs(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function zn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Ey=/^[A-Za-z_][A-Za-z0-9_]*=/;function Zr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Bn(e){let t=Zr(e.words[0],"time")?1:0,n=t===1&&Zr(e.words[t],"-p")?t+1:t,r=t===1&&Zr(e.words[n],"--")?n+1:n,o=Zr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Ey.test(s.text));return i?.provenance==="literal"?i.text:void 0}var dt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Xr(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Ry(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function Jr(e,t,n){e.push(n),t.reset()}function Qr(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function xs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function rn(e,t,n,r,o,i,s){return xs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Ry(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function _s(e,t,n){if(t>=n||Xc(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Xc(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Zc(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Zc(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function ws(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=xy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?_y(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Zc(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Xc(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function xy(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function _y(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var tu=new Set(["&&","||","|","|&"]);function nu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=no(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:io(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function no(e,t,n,r,o,i,s){let a=[],l=[],c=Xr(),u=[],f=()=>{if(c.words.length===0&&c.redirections.length===0)return;let m={start:c.start,end:c.end},p=c.words.map((h)=>h.text);Jr(a,c,{kind:"command",dialect:"posix",source:e.slice(m.start,m.end),span:m,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let m=e[d];if(!m)break;if(s&&m===s)return f(),eu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(oo(m)){if(m===`
-`||m==="\r"){f();let S=m==="\r"&&e[d+1]===`
-`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!tu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,S),span:Object.freeze({start:d,end:S})}));if(u.length>0){let R=ws(e,S,n,u.splice(0));l.push(...R.issues),d=R.next;continue}d=S;continue}d++;continue}if(m==="#"){while(d<n&&e[d]!==`
-`&&e[d]!=="\r")d++;continue}let p=c.start===-1?Vy(e,d,n):void 0;if(p){if(As(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);if(!Ps(o))return on(a,l,d,"word-limit",r.maxWords);let S=no(e,p.braceIndex+1,n,r,o,i+1,"}"),T=S.next,R={start:p.braceIndex+1,end:S.closed?T-1:T},P=Jc(e,R,S);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:P}),l.push(...S.issues),S.pendingHeredocs.length>0||Un(S.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...S.pendingHeredocs),S.limited)return to(a,l,S.next);if(!S.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let h=ro(e,d);if(h){if(f(),!uu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:d,end:d+h.length})})),d+=h.length;continue}if(m===")"){f(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:m,span:{start:d,end:d+1}}),d++;continue}if((m==="("||m==="{"&&My(e,d,n))&&c.start===-1){if(As(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);let S=m==="("?")":"}",T=no(e,d+1,n,r,o,i+1,S),R=T.next,P={start:d+1,end:T.closed?R-1:R},q=Jc(e,P,T);if(a.push({kind:"group",style:m==="("?"subshell":"brace",span:{start:d,end:R},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Un(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return to(a,l,T.next);if(!T.closed)l.push({code:m==="("?"unclosed-subshell":"unclosed-brace-group",message:`${m} group is not closed`});d=R;continue}let g=(m==="<"||m===">")&&e[d+1]!=="("?Ty(e,d):null;if(g){let S=c.words.at(-1),T=S&&S.span.end===d&&/^[0-9]+$/.test(S.raw)?Number(S.raw):void 0;if(T!==void 0)c.words.pop();let R=T===void 0?d:S?.span.start??d;c.start=c.start===-1?d:c.start;let P=d+g.length;while(P<n&&/[ \t]/.test(e[P]??""))P++;let q=e[P],Z=P>d+g.length&&q==="#",ee=!q||oo(q)||!!ro(e,P)||q===s||q===")"||Z||(q==="<"||q===">")&&e[P+1]!=="(",X=g==="<<"||g==="<<-",U=X?_s(e,P,n):void 0,D=U?{word:rn(e,P,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Ts(e,P,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return to(a,l,D.next);if(!Ps(o))return on(a,l,D.next,"word-limit",r.maxWords)}let ce=D?.next??d+g.length,_e={kind:"redirection",operator:g,span:{start:R,end:ce},...T===void 0?{}:{fd:T},...D?{target:D.word}:{}};if(c.redirections.push(_e),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let je=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:g==="<<-",attach:(Ie)=>{if(_e.heredoc=Ie,Ie.quotedDelimiter)return;je.push(...Py(e,Ie.bodySpan.start,Ie.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`});if(D)c.nested.push(...D.nested);c.end=ce,d=ce;continue}if(c.start===-1)As(a,l);let y=Ts(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return to(a,l,y.next);let v=Ly(c.words)?By(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return on(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let S of E){if(!Ps(o))return on(a,l,y.next,"word-limit",r.maxWords);c.words.push(S)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return f(),eu(a,l),l.push(...Ky(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Jc(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:io(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ts(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],f=[],d=!1;while(a<n){let m=e[a],p=(m==="<"||m===">")&&e[a+1]==="(";if(!m||oo(m)||(m===";"||m==="|"||m==="&")&&ro(e,a)||(m==="<"||m===">")&&!p)break;if(m===")")break;if(m==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),f.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(m==='"'){l=!0;let g=wy(e,a,n,r,o,i);if(s+=g.text,u.push(...g.nested),f.push(...g.issues),d||=g.limited,c=$n(c,g.provenance),a=g.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Iy(e,a+2,n);if(s+=g.text,f.push(...g.issues),!g.closed)f.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=g.next;continue}if(m==="\\"){let g=e[a+1];if(!g){f.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(g===`
-`){a+=2;continue}s+=g,a+=2;continue}let h=m==="$"||m==="<"||m===">"||m==="`"?so(e,a,n,r,o,i):null;if(h){let g=ru(h,u,f);if(d||=g.limited,c=$n(c,g.provenance),a=g.next,d)break;continue}if(m==="$"){let g=su(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(m==="*"||m==="?"||m==="[")c=$n(c,"glob");s+=m,a++}return{word:rn(e,t,a,s,c,l,c==="literal"?void 0:Oy(e,t,a)),nested:u,issues:f,next:a,limited:d}}function wy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,f=t+1;while(f<n){let d=e[f];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:f+1,limited:u};if(d==="\\"&&e[f+1]){let p=e[f+1]??"";if(p===`
-`){f+=2;continue}if(p==="\r"&&e[f+2]===`
-`){f+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,f+=2;continue}if(e.startsWith("$((",f)){let p=Is(e,f+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(f,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});f=h;continue}let m=so(e,f,n,r,o,i);if(m){let p=ru(m,l,c);if(f=p.next,u||=p.limited,a=$n(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:f,limited:u};continue}if(d==="$"){let p=su(e,f,n,s,a);s=p.text,a=p.provenance,f=p.next;continue}s+=d??"",f++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function so(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,f=s?"))":c?"`":")",d=Is(e,t+u,n,f),m=d===-1?n:d,p=d===-1?n:d+f.length;if(i>=r.maxDepth)return{program:jy(e,t+u,m,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],S=!1,T=t+u;while(T<m){let R=so(e,T,m,r,o,i+1);if(!R){T++;continue}if(v.push(...R.program.nodes),E.push(...R.program.issues),S||=R.program.status==="limited",T=R.next,S)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,m),span:{start:t+u,end:m},status:io(E,S),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=no(e,t+u,m,r,o,i+1),g=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Un(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,m),span:{start:t+u,end:m},status:io([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function Py(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?so(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function ru(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Is(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`)}function ll(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function wn(e={}){return{reason:_n,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function cl(e){return yp({...e,redact:st})}function ul(e){return st(e instanceof Error?e.message:String(e))}import{isAbsolute as Ol,relative as jp,resolve as Vp,sep as Kp}from"node:path";import{basename as fl,dirname as Cp,isAbsolute as bp,join as Sp,normalize as vp,resolve as dl}from"node:path";var Ep=256,_r=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function at(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ei(e,t){return bi(e,0,t)}function bi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Si(e,o+2),a=xp(e,o,t);if(a===null){if(_r.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Rp(l,t,n),o=a+1;continue}let i=Si(e,o+1);if(!i){r+="$",o++;continue}r+=vi(i,n)??`$${i}`,o+=i.length+1}return r}function xp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Rp(e,t,n){let r=e.slice(2,-1),o=Si(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return vi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(_r.has(o))throw new N("pathEnvironmentExpansion");return e}if(!_r.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=vi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":bi(i.slice(s.length),t+1,n);return l?bi(i.slice(s.length),t+1,n):""}function Si(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function vi(e,t){if(!_r.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function F(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){pl(n,i);let s=t.realpath(i);if(s!==null)return ml(n,e,s,o);let a=Cp(i);if(a===i||o.length>=Ep)return ml(n,e,i,o);o.push(fl(i)),i=a}}function ml(e,t,n,r){let o=r.length===0?n:Sp(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function _p(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;pl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function pl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=hl(e,t,n);if(!o)return"";return F(o,n.paths,r).replace(/\\/g,"/")}function gl(e,t,n,r,o){let i=hl(e,t,n);if(!i)return null;if(o(fl(i)))return F(i,n.paths,r).replace(/\\/g,"/");let s=_p(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function hl(e,t,n){let r=n.home,o=Ei(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?dl(r,o.slice(2)):o,s=Ce(i);return vp(bp(s)?s:dl(t,s))}import{types as wp}from"node:util";var Pp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Ap=new Set(["command","diff","input","patch","patchtext"]),yl=new TextEncoder,Tp=new TextDecoder,Ip=/\s/,kp=64;class Ve extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Pn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Op(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Pr(e){return Pp.has(Op(e))}function Tn(e){if(!e||typeof e!=="object")return;Al(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ue();return}if(t.get||t.set)Ue();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function El(e,t){return xl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function xl(e,t,n,r){let o=Pl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=xl(a,t,n,r+1);return typeof a==="string"&&t.has(Rl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Rl(e){return e.replace(/-/g,"_").toLowerCase()}function _l(e){return wl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Np)}function wl(e,t,n,r){let o=Pl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>wl(a,o.array?t:Ap.has(Rl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Mp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Pn.maxDepth||t.nodes>Pn.maxNodes)Ue();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Pn.maxStringBytes||t.stringBytes>Pn.maxAggregateStringBytes)Ue()}function Pl(e,t,n){if(Mp(e,t,n),!e||typeof e!=="object")return null;let r=Al(e);if(t.ancestors.has(e))Ue();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Pn.maxKeys)Ue();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ue();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Al(e){if(wp.isProxy(e))Ue();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ue();return t}function Ue(){throw new Ve}function Np(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Dp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...xi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...xi(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(..._i(wr(c.slice(4),!0),wr(u.slice(4),!0))),l++;continue}if(!r)t.push(...xi(c))}return t}function Dp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function xi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return vl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return vl(n[1]);if(e.startsWith("diff --git "))return Lp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Sl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Sl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Up(i[1]);return[]}function Lp(e){let t=Wp(e);if(t.length===2&&t[0]&&t[1])return _i(t[0],t[1]);let n=Gp(e);return n?_i(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Wp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(xt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!xt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Tl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(xt(e[n]))n++;return n===e.length?t:[]}function Gp(e){let t=0;while(t<e.length&&xt(e[t]))t++;let n=e.length;while(n>t&&xt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!xt(e[o])){o++;continue}let i=o;while(o<n&&xt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>kp)Ue();if(Fp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Fp(e,t,n,r,o){if(Ri(e,t,n,r,o))return!0;let i=Cl(e,"/",t,n),s=Cl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ri(e,t,i,r,s))return!1;return Ri(e,i+1,n,s+1,o)}function Ri(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Cl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function xt(e){return e!==void 0&&Ip.test(e)}function Tl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Tp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...yl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...yl.encode(zp(s[0]??""))),o+=2}return null}function zp(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function Bp(e){return An(Hp(e))}function _i(e,t){if(e==="/dev/null")return bl(t);if(t==="/dev/null")return bl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(An);let n=$p(e,t)??(e===t?Il(e):null);return[e,t,...n?[n]:[]].flatMap(An)}function bl(e){let t=Il(e);return[e,...t?[t]:[]].flatMap(An)}function Il(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function $p(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Sl(e){return Bp(wr(e,!0))}function Up(e){return An(wr(e,!1))}function wr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Tl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Hp(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function An(e){return e===""||e==="/dev/null"?[]:[e]}function vl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function wi(e,t,n){if(at(e))return;let r=t.flatMap((i)=>kl(i,n));if(!r[0])return;let o=kl(Ol(e)?e:Vp(r[0],e),n)[0];if(!o)return;return r.some((i)=>qp(o,i))?o:void 0}function kl(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function qp(e,t){let n=jp(t,e);return n===""||n!==".."&&!n.startsWith(`..${Kp}`)&&!Ol(n)}function In(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Eg,realpathSync as xg,statSync as Rg}from"node:fs";import{homedir as _g,tmpdir as wg}from"node:os";import{statSync as bg}from"node:fs";import{join as Sg}from"node:path";import{spawnSync as Yp}from"node:child_process";import{existsSync as On,lstatSync as Zp,readFileSync as Mn,realpathSync as Yt,statSync as kn}from"node:fs";import{dirname as Pi,isAbsolute as Ai,join as Zt,resolve as Ar}from"node:path";var Xp=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Jp=5000;function Nl(e,t=gg(),n=Jp){let r=Qp(e),o=r===null?null:eg(r);if(r===null||o===null)return null;let i=fg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Qp(e){try{let t=Yt(Ar(e));return kn(t).isDirectory()?t:null}catch{return null}}function eg(e){let t=mg(e);if(!t)return null;try{let n=Zp(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Ti(t);if(!r?.commonDir)return null;if(!rg(r.gitDir,t))return null;return og(r.gitDir,Pi(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Ti(e){try{let t=tg(e);if(!t)return null;let n=Yt(Ai(t)?t:Ar(Pi(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:ng(n)}}catch{return null}}function tg(e){let t=Mn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function ng(e){try{let t=Mn(Zt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Yt(Ai(t)?t:Ar(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function rg(e,t){let n=ig(e);return n===null?!1:Dl(e,n,t)}function og(e,t){let n=sg(e);return n===null?!0:Dl(e,n,t)}function ig(e){let t=Zt(e,"gitdir");if(!On(t))return null;let n=Mn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function sg(e){let t=Zt(e,"config.worktree");return On(t)?lg(t):null}function Dl(e,t,n){try{return ag(Ai(t)?t:Ar(e,t),n)}catch{return!1}}function ag(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Ml(Yt.native(e))===Ml(Yt.native(t))}function Ml(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function lg(e){let t=Mn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=cg(s[1]??"")}return r}function cg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return dg(t.slice(1,-1))}var ug={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function dg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:ug[n]??t)}function mg(e){try{return Ii(Yt(e))}catch{return null}}function Ii(e){let t=e;while(!0){let n=Zt(t,".git");if(On(n))return n;let r=Pi(t);if(r===t)return null;t=r}}function fg(e,t,n,r){if(pg(t))return!0;if(n===null)return!0;let o=Yp(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:hg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Ll(o.stdout.trim())}function pg(e){return[Zt(e.commonDir,"config"),Zt(e.gitDir,"config.worktree")].filter((t)=>On(t)).some((t)=>yg(t))}function gg(){return Xp.find((e)=>On(e))??null}function Nn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function hg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Nn(t)))}function yg(e){let t;try{t=Mn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Cg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Ll(c)}return r}function Cg(e){return e==="include"||e.startsWith("includeif ")}function Ll(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Wl(e,t){if(e==="")return null;let n=ye(),r=Ii(se(e,e,t,n)),o=r?vg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function vg(e,t,n,r){try{let o=se(e,t,n,r),i=bg(e),s=i.isFile()?o:null,a=i.isFile()?Ti(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Xt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Xt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Xt(o),markerFile:s?Xt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=Xt(Sg(u,"hooks").replace(/\\/g,"/"));return[m,Xt(se(m,t,n,r))]}))]}}catch{return null}}function Xt(e){return process.platform==="win32"?e.toLowerCase():e}var Pg={realpath:(e)=>{try{return xg(e)}catch{return null}},entryKind:(e)=>{let t=Eg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Rg(e).isDirectory()}catch{return!1}}};function Fl(){return Ag({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ce(process.env.HOME||_g()),tmpdir:wg(),paths:Pg})}function Ag(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Gl(n,i,()=>Wl(i,o)),worktreeFacts:(i)=>Gl(r,i,()=>Nl(i)),...t};return o}function Gl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Jt=["fail_closed","paranoid_rm","paranoid_interpreters"],Tr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Ir=["standard","strict","paranoid"];function Tg(e,t){if(!t)return e;return Ir.indexOf(t)>Ir.indexOf(e)?t:e}function Ig(e){let t=Ni(Q.level,e);if(t===void 0||t==="")return;if(Ir.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Ir.join(", ")}.`);return}function kg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function zl(e){return kg(Ni(Q.auditScope,e))==="all"}function Oi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Mi(e={},t){let n=e.safety?.level??"standard",r=Ig(t),o=Tg(n,r),i=Tr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Rt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(Rt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(Rt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(Rt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Rt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Oi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Rt(e,t){let n=typeof e==="string"?ki(e,t):Ni(e,t);return n==="1"||n?.toLowerCase()==="true"}function ki(e,t){return t.get(e)}function Ni(e,t){let n=ki(e.name,t);if(n!==void 0)return n;if(e.legacyName)return ki(e.legacyName,t);return}import{dirname as Fr}from"node:path";import{closeSync as Og,constants as Bl,fstatSync as Mg,fsyncSync as eA,lstatSync as Wi,mkdirSync as tA,openSync as Ng,readdirSync as nA,readFileSync as Dg,realpathSync as Gi,renameSync as rA,rmdirSync as oA,statSync as Lg,unlinkSync as iA,writeFileSync as sA}from"node:fs";import{isAbsolute as $l,join as Fi,normalize as Wg,parse as Li,relative as zi,resolve as Bi,sep as $i}from"node:path";function Di(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Gg=Symbol("PolicyFilesystemScope"),Fg=Symbol("PolicyFilesystemTarget"),zg=Bl.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function _t(e,t){return{[Gg]:!0,root:Bi(e),label:t}}function Ul(e,t){let n=Wg(t);if(t===""||$l(t)||n===".."||n.startsWith(`..${$i}`))throw new ae(e.label);return{[Fg]:!0,scope:e,relativePath:n,path:Fi(e.root,n)}}function Dn(e,t){return Ul(e,zi(e.root,Bi(t)))}function Hl(e,t="rules policy"){let n=Bi(e),r=Li(n).dir;return Ul(_t(r,t),zi(r,n))}function Or(e){return Vl(e.scope.label,()=>{if(!kr(e))return null;let t=Ng(e.path,Bl.O_RDONLY|zg);return Bg(t,()=>{let n=Mg(t);if(!n.isFile())throw new ae(e.scope.label);let r=Dg(t,"utf-8"),o=Wi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return kr(e),r})})}function jl(e,t){if(e.path===t.path)return!0;return Vl(e.scope.label,()=>{if(!kr(e)||!kr(t))return!1;let n=(r)=>Fi(Gi(Li(r).dir),Li(r).base);return n(e.path)===n(t.path)})}function Vl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function Bg(e,t){try{return t()}finally{Og(e)}}function kr(e,t="file"){let n=$g(e.scope);if(!n)return!1;let r=e.relativePath.split($i);for(let o of r.keys()){let i=Fi(e.scope.root,...r.slice(0,o+1)),s=Wi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);Ug(n,Gi(i),e.scope.label)}return!0}function $g(e){if(!Wi(e.root,{throwIfNoEntry:!1}))return null;if(!Lg(e.root).isDirectory())throw new ae(e.label);return Gi(e.root)}function Ug(e,t,n){let r=zi(e,t);if(r===".."||r.startsWith(`..${$i}`)||$l(r))throw new ae(n)}import{dirname as Pt,isAbsolute as qg,join as Tt,relative as Yg,resolve as At,sep as Zg}from"node:path";var wt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Kl="rulebook.json",ql=".cc-safety-net/rules";var Yl=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Hg=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,jg=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Vg="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),uA=new RegExp(`^${jg}/(${wt.source.slice(1,-1)})/${Vg}$`);function Kg(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Zl(e){if(Mr(e))try{return Ui(e),null}catch(t){return t instanceof Error?t.message:String(t)}return wt.test(e)?null:`Local rulebook sources must be bare names matching ${wt}: ${e}`}function Ui(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Yl);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Hg.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!wt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Kg(o),name:o}}function Mr(e){return Yl.test(e)}var Xl="rule.json",Nr="policy.json",Jl=".cc-safety-net",Xg="rules",Jg="CC_SAFETY_NET_HOME",Ql="`cc-safety-net rule update`";function Qg(e){return At(e,ql)}function eh(e){return Tt(Qg(e),Xl)}function Ln(e){return Tt(At(e),Jl,Nr)}function Hi(e,t={}){return t.userConfigDir??(t.userConfigPath?Pt(t.userConfigPath):Tt(th(e),Xg))}function th(e){let t=e.env.get(Jg);return t?At(Ce(t)):Tt(e.home,Jl)}function nh(e,t={}){return Tt(Hi(e,t),Xl)}function Qt(e,t={}){return Tt(Pt(Hi(e,t)),Nr)}function ec(e,t){let n=t.userConfigPath??nh(e,t),r=t.projectConfigPath??eh(t.cwd),o=rh(e,t),i=oh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Dn(o,n),projectConfigTarget:Dn(i,r)}}function rh(e,t){let n=t.userConfigPath?Pt(Pt(At(t.userConfigPath))):Pt(At(t.userConfigDir??Hi(e,t)));return _t(n,"user policy")}function oh(e,t){let n=At(t),r=At(e),o=Yg(n,r);if(o!==".."&&!o.startsWith(`..${Zg}`)&&!qg(o))return _t(n,"project policy");return _t(Pt(Pt(r)),"project policy")}function tc(e,t){return Tt(e,t,Kl)}var be=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),lt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ct=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),nc=new Set(["python","python3","python2","node","ruby","perl"]),Dr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Lr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var rc="Rulebook exceeds CC Safety Net's safe validation limits.",oc="Additional rulebook validation errors were omitted.",ke=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function ic(e){if(ji(e.allowed_commands,ke.maxAllowedCommands)||ji(e.rules,ke.maxRules)||ji(e.tests,ke.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=ke,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>ke.maxStringCodeUnits||i&&o.length>ke.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>ke.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function ji(e,t){return Array.isArray(e)&&e.length>t}var Vi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ki=64,qi="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var ih={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Yi=new Set(["--init-file","--rcfile"]);function Zi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!ih[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Se(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Yi.has(l)&&!s.includes("="))i++;continue}let a=Zi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Wn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Wr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of sh(e))Wn(n,t);return t.inSingle||t.inDouble}function sh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Wn(s,n)}return t}var Xi=new Set(["rm","find","xargs","parallel"]),ah=new Set(["git","busybox",...Xi,...J,...nc,...we]),lh=new Set(["python","node","ruby","perl"]);function sc(e){let t=M(e);return ah.has(t)||Oe(t)}function Oe(e){return lh.has(ch(e))}function ch(e){let t=k(e).toLowerCase();return Dr.test(t)?"python":t}function Ji(e){try{let t=Or(uh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=fh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function uh(e){return typeof e==="string"?Hl(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function ac(e){let t=new Set;return e.flatMap((n,r)=>{let o=en(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Qi=`must be one of ${Vi.join(", ")}`,dh=/^[^/]+\/[^/]+$/,mh=["version","rules","overrides","transparent_wrappers"];function fh(e){let t=ph(e);return{errors:es(xh(t,mh,(n)=>n.kind==="custom"),": "," "),sources:Eh(e,t)}}function ph(e){if(!en(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Ki;return[...e.version===1?[]:[_(["version"],"must be 1")],...gh(e.rules,t),...Ch(e.overrides),...Sh(e.transparent_wrappers),...t?[]:yh(e.rules),...en(e.overrides)?Object.keys(e.overrides).filter((n)=>!dh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...vh(e.transparent_wrappers)]}function gh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...lc(e,Ki)?[_(["rules"],qi)]:[]];if(t)return[{path:["rules"],message:qi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...hh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function lc(e,t){let n=cc(e);return n!==void 0&&!(n<=t)}function hh(e,t){let n=cc(e);return n!==void 0&&!(n>=t)}function cc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function yh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=Zl(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Ch(e){if(e===void 0)return[];if(!en(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!en(n))return[_(["overrides",t],'must be "off" or an object')];return[...bh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||ns(n.intent)?[]:[_(["overrides",t,"intent"],Qi)]]})}function bh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...lc(e,ct)?[_(t,`must be at most ${ct} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ct?[_(t,`must be at most ${ct} characters`)]:[]}function Sh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return lt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function vh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(sc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Eh(e,t){let n=en(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function xh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function es(e,t,n){return[...new Set(e.map((r)=>{let o=ts(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ts(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function ns(e){return Vi.includes(e)}function en(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function dc(e){let t=wh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Rh=`required non-empty string up to ${ct} characters`,uc="must be a non-empty array of unique non-empty strings",_h="required non-empty array of non-empty strings";function wh(e){if(!ut(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!ic(e))return{errors:[rc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...es(Ph(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>ke.maxValidationErrors?[...t.slice(0,ke.maxValidationErrors),oc]:t,ruleNames:new Set(mc(e).map((n)=>n.toLowerCase()))}}function mc(e){let t=ut(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ut(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Ph(e,t){return[...typeof e.name==="string"&&wt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Ah(e.allowed_commands),...Th(e.rules,t),...Mh(e.tests),...Nh(e),...Dh(e)]}function Ah(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&lt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Th(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!ut(n))return[_(["rules",r],"must be an object")];return t?kh(n,["rules",r]):Ih(n,["rules",r])}),...ac(e)]}function Ih(e,t){return[...fc(e.name,t),...pc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&lt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Gr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...gc(e.reason,t),...hc(e.intent,t)]}function kh(e,t){return[...fc(e.name,t),...pc(e.command,t),...gc(e.reason,t),...hc(e.intent,t),...Oh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function fc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return wt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function pc(e,t){return typeof e==="string"&&lt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function gc(e,t){return typeof e==="string"&&e!==""&&e.length<=ct?[]:[_([...t,"reason"],Rh)]}function hc(e,t){return e===void 0||ns(e)?[]:[_([...t,"intent"],Qi)]}function Oh(e,t){if(!ut(e))return[_(t,"required object")];return[...Gr(e.command_path,[...t,"command_path"],_h,!1),...e.any_args===void 0?[]:Gr(e.any_args,[...t,"any_args"],uc,!0),...e.exclude_args===void 0?[]:Gr(e.exclude_args,[...t,"exclude_args"],uc,!0)]}function Gr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Mh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!ut(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Nh(e){if(!Array.isArray(e.tests))return[];let t=new Set(mc(e));return[...new Set(e.tests.flatMap((n)=>ut(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function Dh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=ut(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function ut(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ec(e,t){let n=ec(e,t),r=!1;try{r=jl(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ae)return Hh(n,f.message);throw f}let o=Ji(n.userConfigTarget),i=r?{config:null,errors:[]}:Ji(n.projectConfigTarget),s=Sc(n.userConfigPath,o.errors),a=Sc(n.projectConfigPath,i.errors),l=new Set,c=o.config?yc(o.config,Fr(n.userConfigPath),"user",n.userScope,l):vc(),u=i.config?yc(i.config,Fr(n.projectConfigPath),"project",n.projectScope,l):vc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Cc(c.rules,m),...Cc(u.rules,d)],transparent_wrappers:$h(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?bc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Uh(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?bc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function yc(e,t,n,r=_t(Fr(Fr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Wh(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:Lh(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Lh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Wh(e,t,n){let r=Gh(e),o=tc(t,r),i=zh(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Fh(e)}`]};let s=Bh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Gh(e){return Mr(e)?Ui(e).name:e}function Fh(e){return Mr(e)?`run ${Ql} to vendor ${e}`:"create that file or remove that source from the rules config"}function zh(e,t){try{return{content:Or(Dn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function Bh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:dc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function $h(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Cc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function bc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Uh(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Sc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Hh(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function vc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as ry,readFileSync as oy}from"node:fs";var xc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],rs=new Set(xc.map((e)=>e.id)),zr=xc,jh=new Map(zr.map((e)=>[e.id,e.intent]));function b(e,t){return{id:e,reason:t,intent:jh.get(e)??"manual_only"}}var os=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Br={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Vh=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Kh=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],is=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Kh.flatMap((e)=>Vh.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var $r=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Rc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],qh=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ss=Rc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),as=Rc.flatMap((e)=>qh.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Gn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ls=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),cs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Yh=[...os,Br,...is,...ss,...as,Gn,...ls,...cs,...$r].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Ur=new Set($r.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),us=new Set(Yh.map((e)=>e.id));import{isAbsolute as ds,join as Zh,normalize as Xh,sep as Hr}from"node:path";var _c=process.platform==="win32",Jh=/[*?]/;function Fn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ms(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Fn(e.trim(),t);if(!ds(n))return"must be an absolute path or start with ~/";return zn(n,t)}function fs(e,t){let n=wc(e,t);if(n===null)return"must be a non-empty path string";if(!ds(n))return null;if(zn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Qh="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",ey="cannot cover the guard's own configuration";function wc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Fn(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ps(e,t){let n=wc(e,t);if(n===null)return"must be a non-empty path string";if(Jh.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!ds(n))return null;if(zn(n,t)!==null)return Qh;return ty(n,t)?ey:null}function ty(e,t){let n=jr(e),r=jr(Zh(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Hr}`)}function zn(e,t){let n=jr(e),r=jr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Hr)?n:`${n}${Hr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function jr(e){let t=Xh(e);if(_c)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(_c?3:1)&&t.endsWith(Hr))t=t.slice(0,-1);return t}var Pc=30,Vr=1,Kr=365;function Ac(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Tc=new Set(zr.filter((e)=>e.catastrophic).map((e)=>e.id));function A(e,t){if(!e)return null;if(Tc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Tc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Ic(e,t){return Object.freeze(Object.fromEntries(zr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function kc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Ic(e,t)})}var Oc={standard:0,strict:1,paranoid:2};function Dc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:gs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:gs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:gs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:ny(e,t)}}function gs(e,t){return[...new Set([...e,...t??[]])]}function ny(e,t){let n=t.safety?.level,r=Tr[e.safety.level];return[...n&&Oc[n]<Oc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Jt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Mc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Mc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Ur.has(o))),...e.destructive_command_protection.enabled?Nc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Nc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Mc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Nc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Cs=new Set(["standard","strict","paranoid"]),Fc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Pc}};function zc(e,t){let n=py(Qt(e,t),e.home),r=Zr(Ln(t.cwd),e.home),o=sy(r.parsed,e.home),i=Object.keys(o.policy).length>0?Dc(n.gui??Fc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ys(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var iy="project policy audit settings are ignored; audit is user scope only";function sy(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...Cs.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Lc({overrides:Bc(n.overrides,Jt,["safety","overrides"],It)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Yr(o.overrides,rs,Uc,It)}:{},...o.allow_paths!==void 0?{allow_paths:nn(o.allow_paths,ms,t,["destructive_command_protection","allow_paths"],It)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Yr(i.overrides,us,Hc,It)}:{},...i.deny_paths!==void 0?{deny_paths:nn(i.deny_paths,fs,t,["secret_protection","deny_paths"],It)}:{},...i.allow_paths!==void 0?{allow_paths:nn(i.allow_paths,ps,t,["secret_protection","allow_paths"],It)}:{}};return{policy:Lc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[iy]}}function Bc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],bs));return[]}))}function Lc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var It=()=>{return},bs="must be a boolean",Ss="must be an object if provided",$c=`must be an integer between ${Vr} and ${Kr}`,Uc={path:["destructive_command_protection","overrides"],label:"destructive command"},Hc={path:["secret_protection","overrides"],label:"secret protection"},ay=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function ly(e,t){let n=[];return{policy:jc(e,t,(o)=>{n.push(o)}),issues:n}}function cy(e,t){return jc(e,t,It)}function jc(e,t,n){if(!ve(e))return n(_([],"Config must be an object")),qr();if(e.version!==1)n(_(["version"],"must be 1"));let r=tn(e.safety,["safety"],["level","overrides"],n),o=tn(r.overrides,["safety","overrides"],Jt,n),i=tn(e.workflow,["workflow"],["worktree_mode"],n),s=tn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=tn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=tn(e.audit,["audit"],["retention_days"],n);return Vc(e,ay,[],n),{version:1,safety:{level:uy(r.level,n),overrides:Bc(o,Jt,["safety","overrides"],n)},workflow:{worktree_mode:hs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:hs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Yr(s.overrides,rs,Uc,n),allow_paths:nn(s.allow_paths,ms,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:hs(a.enabled,["secret_protection","enabled"],!0,n),overrides:Yr(a.overrides,us,Hc,n),deny_paths:nn(a.deny_paths,fs,t,["secret_protection","deny_paths"],n),allow_paths:nn(a.allow_paths,ps,t,["secret_protection","allow_paths"],n)},audit:{retention_days:dy(l.retention_days,n)}}}function tn(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(t,Ss)),{};return Vc(e,n,t,r),e}function Vc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function uy(e,t){if(e===void 0)return"standard";if(Cs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function hs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,bs));return n}function dy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Vr&&e<=Kr))t(_(["audit","retention_days"],$c));return Ac(e)}function Yr(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(n.path,Ss)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function nn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function qr(){return structuredClone(Fc)}function Zr(e,t){if(!ry(e))return{exists:!1,policy:qr(),errors:[]};try{let n=oy(e,"utf-8");if(!n.trim())return{exists:!0,policy:qr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=ly(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${fy(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:qr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var my=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ss,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[bs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[$c,`not an integer between ${Vr} and ${Kr}`]]);function fy(e){let t=ts(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=my.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function py(e,t){let n=Zr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:Gc(),errors:[]};let o=cy(r,t);return{policy:ys(o),gui:o,errors:[],levelPresent:Wc(r)}}if(n.parsed===void 0)return{policy:Gc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ys(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Wc(n.parsed)}}function Wc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return Cs.has(t.level)}function Kc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Ur].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Gc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Kc({}),denyPaths:[],allowPaths:[]}}}function ys(e){return{safety:gy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Kc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function gy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function qc(e,t){let n=Ec(e,t),r=zc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...by(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Sy(o,hy(n,r),s,r.policyScopes)}function hy(e,t){let n=Cy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:vy(e.errors.length>0?yy(e.errors):void 0,e.warnings.length>0?Es(e.warnings.join("; ")):void 0,n)}}function yy(e){return`${Es(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Cy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function by(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Sy(e,t,n=Object.freeze({}),r){let o=vs(structuredClone(e)),i=r?{policyScopes:vs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function vs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))vs(t);return Object.freeze(e)}function vy(...e){return Es(e.filter((t)=>!!t).join("; "))}function Es(e){return/[.!?]$/.test(e)?e:`${e}.`}function Yc(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:xs(t.fail_closed,e.strict,"strict"),paranoid_rm:xs(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:xs(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:kc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Oi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function xs(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Bn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Ey=/^[A-Za-z_][A-Za-z0-9_]*=/;function Xr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function $n(e){let t=Xr(e.words[0],"time")?1:0,n=t===1&&Xr(e.words[t],"-p")?t+1:t,r=t===1&&Xr(e.words[n],"--")?n+1:n,o=Xr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Ey.test(s.text));return i?.provenance==="literal"?i.text:void 0}var dt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Jr(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function xy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>me(t)))})}function Qr(e,t,n){e.push(n),t.reset()}function eo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Rs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function rn(e,t,n,r,o,i,s){return Rs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function me(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return xy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:me(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function _s(e,t,n){if(t>=n||Xc(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Xc(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Zc(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Zc(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function ws(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Ry(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?_y(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Zc(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Xc(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Ry(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function _y(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var tu=new Set(["&&","||","|","|&"]);function nu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=ro(e,0,e.length,t,{used:0,max:t.maxWords},0);return me({kind:"program",dialect:"posix",source:e,span:n,status:so(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function ro(e,t,n,r,o,i,s){let a=[],l=[],c=Jr(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((h)=>h.text);Qr(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),eu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(io(f)){if(f===`
+`||f==="\r"){m();let S=f==="\r"&&e[d+1]===`
+`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!tu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,S),span:Object.freeze({start:d,end:S})}));if(u.length>0){let x=ws(e,S,n,u.splice(0));l.push(...x.issues),d=x.next;continue}d=S;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
+`&&e[d]!=="\r")d++;continue}let p=c.start===-1?Vy(e,d,n):void 0;if(p){if(As(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);if(!Ps(o))return on(a,l,d,"word-limit",r.maxWords);let S=ro(e,p.braceIndex+1,n,r,o,i+1,"}"),T=S.next,x={start:p.braceIndex+1,end:S.closed?T-1:T},P=Jc(e,x,S);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:P}),l.push(...S.issues),S.pendingHeredocs.length>0||Hn(S.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...S.pendingHeredocs),S.limited)return no(a,l,S.next);if(!S.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let h=oo(e,d);if(h){if(m(),!uu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:d,end:d+h.length})})),d+=h.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&My(e,d,n))&&c.start===-1){if(As(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);let S=f==="("?")":"}",T=ro(e,d+1,n,r,o,i+1,S),x=T.next,P={start:d+1,end:T.closed?x-1:x},q=Jc(e,P,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:x},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Hn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return no(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=x;continue}let g=(f==="<"||f===">")&&e[d+1]!=="("?Ty(e,d):null;if(g){let S=c.words.at(-1),T=S&&S.span.end===d&&/^[0-9]+$/.test(S.raw)?Number(S.raw):void 0;if(T!==void 0)c.words.pop();let x=T===void 0?d:S?.span.start??d;c.start=c.start===-1?d:c.start;let P=d+g.length;while(P<n&&/[ \t]/.test(e[P]??""))P++;let q=e[P],Z=P>d+g.length&&q==="#",ee=!q||io(q)||!!oo(e,P)||q===s||q===")"||Z||(q==="<"||q===">")&&e[P+1]!=="(",X=g==="<<"||g==="<<-",U=X?_s(e,P,n):void 0,D=U?{word:rn(e,P,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Ts(e,P,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return no(a,l,D.next);if(!Ps(o))return on(a,l,D.next,"word-limit",r.maxWords)}let ce=D?.next??d+g.length,_e={kind:"redirection",operator:g,span:{start:x,end:ce},...T===void 0?{}:{fd:T},...D?{target:D.word}:{}};if(c.redirections.push(_e),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let je=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:g==="<<-",attach:(Ie)=>{if(_e.heredoc=Ie,Ie.quotedDelimiter)return;je.push(...Py(e,Ie.bodySpan.start,Ie.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`});if(D)c.nested.push(...D.nested);c.end=ce,d=ce;continue}if(c.start===-1)As(a,l);let y=Ts(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return no(a,l,y.next);let v=Ly(c.words)?By(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return on(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let S of E){if(!Ps(o))return on(a,l,y.next,"word-limit",r.maxWords);c.words.push(S)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return m(),eu(a,l),l.push(...Ky(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Jc(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:so(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ts(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||io(f)||(f===";"||f==="|"||f==="&")&&oo(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(f==='"'){l=!0;let g=wy(e,a,n,r,o,i);if(s+=g.text,u.push(...g.nested),m.push(...g.issues),d||=g.limited,c=Un(c,g.provenance),a=g.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Iy(e,a+2,n);if(s+=g.text,m.push(...g.issues),!g.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=g.next;continue}if(f==="\\"){let g=e[a+1];if(!g){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(g===`
+`){a+=2;continue}s+=g,a+=2;continue}let h=f==="$"||f==="<"||f===">"||f==="`"?ao(e,a,n,r,o,i):null;if(h){let g=ru(h,u,m);if(d||=g.limited,c=Un(c,g.provenance),a=g.next,d)break;continue}if(f==="$"){let g=su(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(f==="*"||f==="?"||f==="[")c=Un(c,"glob");s+=f,a++}return{word:rn(e,t,a,s,c,l,c==="literal"?void 0:Oy(e,t,a)),nested:u,issues:m,next:a,limited:d}}function wy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
+`){m+=2;continue}if(p==="\r"&&e[m+2]===`
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=Is(e,m+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(m,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=h;continue}let f=ao(e,m,n,r,o,i);if(f){let p=ru(f,l,c);if(m=p.next,u||=p.limited,a=Un(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=su(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function ao(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=Is(e,t+u,n,m),f=d===-1?n:d,p=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:jy(e,t+u,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],S=!1,T=t+u;while(T<f){let x=ao(e,T,f,r,o,i+1);if(!x){T++;continue}if(v.push(...x.program.nodes),E.push(...x.program.issues),S||=x.program.status==="limited",T=x.next,S)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:so(E,S),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=ro(e,t+u,f,r,o,i+1),g=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Hn(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:so([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function Py(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?ao(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function ru(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Is(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
 `||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
-`?a+2:a+1,f=ws(e,u,n,s.splice(0));if(!f.terminated)return-1;a=f.next-1;continue}let c=ou(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=Ay(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",f=a+(u?3:2);while(f<n&&/[ \t]/.test(e[f]??""))f++;let d=_s(e,f,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Ay(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=ou(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function ou(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!qy(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function ro(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Ty(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function oo(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function iu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Iy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=ky(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function ky(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return eo(e,t+1,n,16,2,t+1);if(r==="u")return eo(e,t+1,n,16,4,t+1);if(r==="U")return eo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return eo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function eo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function io(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function su(e,t,n,r,o){let i=iu(e,t,n);return{text:r+e.slice(t,i),provenance:$n(o,"variable"),next:i}}function Oy(e,t,n){let r=Qr(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,f=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||f||d){let m=c?3:d?1:2,p=c?"))":d?"`":")",h=Is(e,a+m,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let m=iu(e,a,n);if(m>a+1){r.push(o,a,"literal"),r.push(a,m,"variable"),a=m,o=m;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function $n(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function My(e,t,n){return t+1>=n||oo(e[t+1]??"")||ro(e,t+1)!==null}var Ny=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Dy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Ly(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Wy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Wy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Gy(e,t);if(n==="env")return Fy(e,t);if(n==="sudo")return zy(e,t);return}function Gy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Fy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Ny.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function zy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Dy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function au(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=lu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>cu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function By(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=lu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>cu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>rn(e,t.span.start,t.span.end,a,"literal",!1))}}function lu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((m)=>Qc(m,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=Qc(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let f=u.start+c.length-u.end,d=u.alternatives.reduce((m,p)=>m+f+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...$y(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function Qc(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Hy(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:Uy(e,r)}}function $y(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function Uy(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Hy(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function cu(e,t){let n=`x${e}`,r=Ts(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function jy(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function on(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function to(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ps(e){return e.used++,e.used<=e.max}function Vy(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Un(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Un(n.nodes));return(t.kind==="group"||t.kind==="function")&&Un(t.body.nodes)})}function Ky(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function uu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function eu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!tu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function As(e,t){if(!uu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function qy(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var fu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Yy=new Set(["gc","cat","type","cp","mv","rm"]),mu=["-rec","-for","-path","-literalpath","-whatif"],Zy=/^\$env:\w/i,Xy=/^(?:\$\{?\w+\}?|~)\\./;function pu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...fu].some((o)=>n.includes(o))&&!(n.includes("rm")&&mu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!Jy(n))return!1;let r=Ns(e,t);if(gu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ms(r).some(Qy)}function gu(e){return e.nodes.some((t)=>{if(t.kind==="group")return gu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function Jy(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Qy(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&fu.has(n))return!0;let r=e.slice(t+1);if(n&&Yy.has(n)&&r.some(eC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return mu.some((s)=>i.startsWith(s))})}function eC(e){return Zy.test(e)||Xy.test(e)}function Ns(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ds(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:iC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ds(e,t,n,r,o,i=!1){let s=[],a=[],l=Xr(),c=0,u=!1,f=()=>{if(l.words.length===0&&l.redirections.length===0)return;let m={start:l.start,end:l.end};Jr(s,l,{kind:"command",dialect:"powershell",source:e.slice(m.start,m.end),span:m,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let m=e[d];if(!m)break;if(i&&m==="}")return f(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=oC(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return f(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(m)){if(m==="\r"||m===`
-`){f();let y=m==="\r"&&e[d+1]===`
-`?d+2:d+1;s.push(ks(e,d,y)),d=y;continue}d++;continue}let h=Cu(e,d);if(h){f(),s.push(ks(e,d,d+h.length)),d+=h.length;continue}if(m==="{"){if(f(),o>=r.maxDepth)return a.push(yu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ds(e,d+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(d+1,v),span:{start:d+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(m==="}"){f(),s.push(ks(e,d,d+1)),d++;continue}if(m===">"||m==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===m?d+2:d+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?du(e,v,n,r,o):void 0,S=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:S}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=S,d=S;continue}if(m===","){l.start=l.start===-1?d:l.start,l.words.push(xs({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let g=du(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,u||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),f(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next>d?g.next:d+1}return f(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function du(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,f=!1,d=(p)=>{let h=tC(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),u+=Os(h.program),f||=h.program.status==="limited",s="command-substitution",h.next},m=t;while(m<n){let p=e[m];if(!p||/\s/.test(p)||Cu(e,m)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[m+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),m++;break}i+=h,m+=2;continue}if(e.startsWith("$(",m)){m=d(m);continue}if(p==="'"){a=!0,m++;let h=!1;while(m<e.length){if(e[m]==="'"&&e[m+1]==="'"){i+="'",m+=2;continue}if(e[m]==="'"){h=!0,m++;break}i+=e[m]??"",m++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,m++;let h=!1;while(m<n){let g=e[m];if(g==="`"&&e[m+1]){i+=e[m+1],m+=2;continue}if(g==='"'){h=!0,m++;break}if(e.startsWith("$(",m)){m=d(m);continue}if(g==="$")s=e[m+1]==="("?"command-substitution":"variable";i+=g??"",m++}if(!h)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[m+1]==="("?"command-substitution":"variable";if(p==="@"&&m===t)s="variable";i+=p,m++}return{word:rn(e,t,m,i,s,a,s==="literal"?void 0:nC(e,t,m)),next:m,issues:l,nested:c,words:u,limited:f}}function tC(e,t,n,r,o){let i=hu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[yu(r.maxDepth)],nodes:[]}),next:a};let l=Ds(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function hu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Os(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Os(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Os(r)}}return t}function nC(e,t,n){let r=Qr(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=hu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=rC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function rC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function yu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ms(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ms(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ms)]})}function Cu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function oC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function iC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ks(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Me(e,t="auto",n=dt){if(t==="powershell"||t==="auto"&&pu(e.slice(0,n.maxInputLength),n))return Ns(e,n);return nu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function sn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function ao(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Ls(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function Hn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){Hn(e,t)}function kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Ws(e){return e===`
+`?a+2:a+1,m=ws(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=ou(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=Ay(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=_s(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Ay(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=ou(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function ou(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!qy(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function oo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Ty(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function io(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function iu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Iy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=ky(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function ky(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return to(e,t+1,n,16,2,t+1);if(r==="u")return to(e,t+1,n,16,4,t+1);if(r==="U")return to(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return to(e,t,n,8,3,t+1);return{text:r,next:t+1}}function to(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function so(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function su(e,t,n,r,o){let i=iu(e,t,n);return{text:r+e.slice(t,i),provenance:Un(o,"variable"),next:i}}function Oy(e,t,n){let r=eo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,p=c?"))":d?"`":")",h=Is(e,a+f,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let f=iu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Un(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function My(e,t,n){return t+1>=n||io(e[t+1]??"")||oo(e,t+1)!==null}var Ny=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Dy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Ly(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Wy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Wy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Gy(e,t);if(n==="env")return Fy(e,t);if(n==="sudo")return zy(e,t);return}function Gy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Fy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Ny.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function zy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Dy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function au(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=lu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>cu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function By(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=lu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>cu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>rn(e,t.span.start,t.span.end,a,"literal",!1))}}function lu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>Qc(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=Qc(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...$y(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function Qc(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Hy(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:Uy(e,r)}}function $y(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function Uy(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Hy(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function cu(e,t){let n=`x${e}`,r=Ts(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function jy(e,t,n,r){return me({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function on(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function no(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ps(e){return e.used++,e.used<=e.max}function Vy(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Hn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Hn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Hn(t.body.nodes)})}function Ky(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function uu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function eu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!tu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function As(e,t){if(!uu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function qy(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var mu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Yy=new Set(["gc","cat","type","cp","mv","rm"]),fu=["-rec","-for","-path","-literalpath","-whatif"],Zy=/^\$env:\w/i,Xy=/^(?:\$\{?\w+\}?|~)\\./;function pu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...mu].some((o)=>n.includes(o))&&!(n.includes("rm")&&fu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!Jy(n))return!1;let r=Ns(e,t);if(gu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ms(r).some(Qy)}function gu(e){return e.nodes.some((t)=>{if(t.kind==="group")return gu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function Jy(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Qy(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&mu.has(n))return!0;let r=e.slice(t+1);if(n&&Yy.has(n)&&r.some(eC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return fu.some((s)=>i.startsWith(s))})}function eC(e){return Zy.test(e)||Xy.test(e)}function Ns(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ds(e,0,e.length,t,0);return me({kind:"program",dialect:"powershell",source:e,span:n,status:iC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ds(e,t,n,r,o,i=!1){let s=[],a=[],l=Jr(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};Qr(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=oC(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`){m();let y=f==="\r"&&e[d+1]===`
+`?d+2:d+1;s.push(ks(e,d,y)),d=y;continue}d++;continue}let h=Cu(e,d);if(h){m(),s.push(ks(e,d,d+h.length)),d+=h.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(yu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ds(e,d+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=me({kind:"program",dialect:"powershell",source:e.slice(d+1,v),span:{start:d+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(ks(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?du(e,v,n,r,o):void 0,S=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:S}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=S,d=S;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Rs({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let g=du(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,u||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next>d?g.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function du(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(p)=>{let h=tC(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),u+=Os(h.program),m||=h.program.status==="limited",s="command-substitution",h.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||Cu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[f+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=h,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(p==="'"){a=!0,f++;let h=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){h=!0,f++;break}i+=e[f]??"",f++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let h=!1;while(f<n){let g=e[f];if(g==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(g==='"'){h=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=g??"",f++}if(!h)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:rn(e,t,f,i,s,a,s==="literal"?void 0:nC(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function tC(e,t,n,r,o){let i=hu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[yu(r.maxDepth)],nodes:[]}),next:a};let l=Ds(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function hu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Os(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Os(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Os(r)}}return t}function nC(e,t,n){let r=eo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=hu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=rC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function rC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function yu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ms(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ms(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ms)]})}function Cu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function oC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function iC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ks(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Me(e,t="auto",n=dt){if(t==="powershell"||t==="auto"&&pu(e.slice(0,n.maxInputLength),n))return Ns(e,n);return nu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function sn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function lo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Ls(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function jn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){jn(e,t)}function kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Ws(e){return e===`
 `||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Y(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function Ke(e,t,n){return!kt(C(e,t-1))&&j(e,t,n)&&!kt(C(e,t+n.length))}function qe(e,t){return kt(C(e,t-1))!==kt(C(e,t))}function oe(e){return e===`
-`||e===";"||e==="&"||e==="|"}function an(e){return e==="|"||e===";"}function lo(e,t,n){let r=Ls(e,n);if(t==="rm")return sC(r);if(t==="dd")return lC(r);return xu(r,!0)}function co(e,t,n){let r=Ls(e,n);if(t==="rm")return cC(r);if(t==="reset-hard")return Eu(r,"--ha","rd");if(t==="reset-merge")return Eu(r,"--me","rge");if(t==="clean")return mC(r);if(t==="checkout")return gC(r);if(t==="push-force")return hC(r);if(t==="push-refspec")return yC(r);if(t==="push-delete")return CC(r);if(t==="branch")return bC(r);if(t==="tag")return EC(r);if(t==="restore")return RC(r);return xu(r,!1)}function sC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Ke(e,i,"rm")&&H(l)&&l!==`
+`||e===";"||e==="&"||e==="|"}function an(e){return e==="|"||e===";"}function co(e,t,n){let r=Ls(e,n);if(t==="rm")return sC(r);if(t==="dd")return lC(r);return Ru(r,!0)}function uo(e,t,n){let r=Ls(e,n);if(t==="rm")return cC(r);if(t==="reset-hard")return Eu(r,"--ha","rd");if(t==="reset-merge")return Eu(r,"--me","rge");if(t==="clean")return fC(r);if(t==="checkout")return gC(r);if(t==="push-force")return hC(r);if(t==="push-refspec")return yC(r);if(t==="push-delete")return CC(r);if(t==="branch")return bC(r);if(t==="tag")return EC(r);if(t==="restore")return xC(r);return Ru(r,!1)}function sC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Ke(e,i,"rm")&&H(l)&&l!==`
 `)t=!0,i++;continue}let a=aC(e,i);if(s===`
 `||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=bu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=bu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function aC(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function bu(e,t,n){if(Su(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Su(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Su(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function lC(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(C(e,n))){t=!1;continue}if(Ke(e,n,"dd")){t=!0,n++;continue}if(!t||!Ke(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function cC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=C(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=dC(e,o);if(s>=0){if(uC(e,s))return!0;let a=s,l=!1;while(H(C(e,a)))l||=C(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(C(e,o-1)))&&(!C(e,o+2)||H(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&qe(e,o+11)||Gs(e,o,"recursive"),r||=j(e,o,"--force")&&qe(e,o+7)||Gs(e,o,"force"),n&&r)return!0;o++}return!1}function Gs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&qe(e,t+r+2)}function uC(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(C(e,n)))n++;let i=n;while(n<Y(e)&&!H(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=vu(e,i,"recursive"),a=vu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=fC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function vu(e,t,n){return j(e,t,`--${n}`)&&qe(e,t+n.length+2)||Gs(e,t,n)}function dC(e,t){if(t>0&&kt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!H(C(e,n+1)))return-1;return n+1}function fC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=C(e,c)??"",f=(u==="r"||u==="f")&&qe(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&f,s||=u==="f"&&f,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&f,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Eu(e,t,n){return Vn(e,"reset",an,!0,(r)=>C(e,r)==="-"&&ln(e,r,t,n)?!0:r)}function mC(e){return Vn(e,"clean",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(ln(e,t,"--fo","rce"))return!0;let n=jn(e,t,an);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function uo(e,t,n){if(!Ke(e,t,"git"))return null;let r=t+3;if(!H(C(e,r)))return{commandEnd:-1,next:r};while(H(C(e,r)))r++;while(r<Y(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=jn(e,r,oe);if(Ke(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=pC(e,r,o);r=o;while(H(C(e,r)))r++;if(i)return{commandEnd:Ke(e,r,n)?r+n.length:-1,next:jn(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=jn(e,r,oe);while(H(C(e,r)))r++}return{commandEnd:-1,next:r}}function pC(e,t,n){for(let r of be)if(n-t===r.length&&j(e,t,r))return!0;return!1}function gC(e){return Ru(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function hC(e){return Vn(e,"push",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!kt(C(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=_u(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function yC(e){return Vn(e,"push",oe,!1,(t)=>{if(H(C(e,t))&&C(e,t+1)==="+"&&t+2<Y(e)&&!oe(C(e,t+2))&&!H(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function CC(e){return Vn(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&ln(e,t,"--de","lete"))return!0;if(H(C(e,t))&&C(e,t+1)===":"&&t+2<Y(e)&&!H(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function bC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=uo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=jn(e,o,oe),s=SC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function SC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(ln(e,i,"--de","lete"))r=!0;if(ln(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&vC(C(e,s))){let u=C(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!qe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function vC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function EC(e){return Ru(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Ru(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=uo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(ln(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&qe(e,r+1))return!0;if(an(o))i.outerActive=!1}return!1}function Vn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=uo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(C(e,u)))i=!1;s=c}if(l)i=!1}return!1}function RC(e){let t=!1;for(let n=0;n<Y(e);n++){if(Ws(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=uo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function xu(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=C(e,r),i=t?Ws(o):oe(o);if(n&&H(o)&&C(e,r+1)==="-"&&Ke(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Ke(e,r,"find"))n=!0,r+=3}return!1}function jn(e,t,n){let r=t;while(r<Y(e)&&!H(C(e,r))&&!n(C(e,r)))r++;return r}function _u(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return qe(e,o)?o:-1}function ln(e,t,n,r){return _u(e,t,n,r)>=0}function Ye(e,t){Hn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&co(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var xC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Hn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Au(t.nodes,r,i)}function Au(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Au(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return _C(r,t,n)})}function _C(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!xC.test(o.text));return e.words.every((o,i)=>o===t||wu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||wu(o.target.raw,n.anchored,!0)))}function wu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as wC,resolve as Tu}from"node:path";function Kn(e,t,n,r){let o=wC(e)?Tu(e):t?Tu(t,e):void 0;if(!o)return;try{return F(o,n,r)}catch{return o}}function Iu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var cn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",qn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Fs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),PC=new Set(["-p","--print"]),AC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),TC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),IC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),kC=new Map([["python",new Set(["m"])]]),OC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),MC=new Set(["always","default","never"]),NC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),DC=/\\\r?\n/g,LC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Ou(e){return mo(e).code}function fo(e){return mo(e).sources}function Mu(e){return LC.get(Bs(e))??[]}function mo(e){let t=Bs(e[0]??"");if(!Fs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&PC.has(s)){let f=e[i+1];if(f===void 0)return Ne(t,n,r,o);if(f.startsWith("-"))continue;n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),i++;continue}if(GC(t,s)){let f=e[i+1];if(f===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(FC(t)&&a){let f=a[1]??"";n.push({tokenIndex:i,value:f}),r.push({tokenIndex:i,kind:"inline-code",value:f});continue}if(t==="node"){let f=WC(s);if(f){if(f.attached){if(o&&=f.value!=="",f.value!=="")r.push({tokenIndex:i,kind:"module-file",value:f.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(OC.get(t)?.has(s)){let f=e[i+1];if(f===void 0||f.startsWith("-")&&!(t==="ruby"&&NC.has(s))||t==="python"&&!MC.has(f))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let f=1;f<s.length;f++){let d=s[f];if(d===void 0)break;if(kC.get(t)?.has(d)){let m=s.slice(f+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(AC.get(t)?.has(d)){l=s.slice(f+1)||e[i+1],c=f+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&d==="r"){let m=s.slice(f+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let m=s.slice(f+1);if(!m){if(o=!1,f+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(TC.get(t)?.has(d)){if(f+1===s.length)i++;break}if(IC.get(t)?.has(d)&&f+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function WC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function zs(e,t){return Bs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Bs(e){let t=k(e).toLowerCase();return Nr.test(t)?"python":t}function GC(e,t){return Fs.get(e)?.has(t)??!1}function FC(e){return Fs.get(e)?.has("--eval")??!1}function Yn(e,t){let n=$C(e,t);if(!ku(n,t))return!1;Ee(t,n);let r=BC(n);if(ku(r,t))return!0;return Ee(t,r),zC.test(r)}var zC=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function BC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function ku(e,t){if(lo(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(lo(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(lo(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>co(o,r))))}function $C(e,t){return Ee(t,e),e.replace(DC,"")}import{isAbsolute as id,relative as sd}from"node:path";import{isAbsolute as zu,parse as JC}from"node:path";import{dirname as UC,isAbsolute as HC,parse as jC,sep as VC}from"node:path";function ft(e,t,n){if(at(t))throw Error("Unsupported Windows namespace path");let r=HC(t)?jC(t).root:"",o=r||e;for(let i of qC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=UC(o);continue}let s=KC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function KC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${VC}${t}`}function qC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var $s=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],YC=new Set($s),ZC=1024,Nu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Du=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),XC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function po(e){return YC.has(e)}function Us(e){return po(e)||Nu.has(e)||Du.has(e)||Mn(e)}function Ze(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Lu(e,t){let n=Ze("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=ZC?{state:"valid",count:r}:{state:"invalid"}}function go(e,t,n){let o=e.match(XC)?.[1];if(!o||!Us(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ze(o,t,n)??""}${e.slice(i+1)}`}}function Wu(e){return Fu(e,Du)}function Gu(e){return Fu(e,Nu)}function Fu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var $u=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!$u.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function ho(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Uu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Ot(e,t,n,r){if(!Uu(un(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let f=0;f<V.wrapperPeelIterations.cap;f++){let d=Bu(i),m=ho(i);for(let[h,g]of m.envAssignments)s.set(h,g),a.set(h,g);if(i=m.words,i.length===0)break;while(i.length>0&&un(i).includes("=")&&!eb(i)){let h=tb(un(i),a,t.env)??go(un(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=un(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=rb(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=sb(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=ab(i);if(p==="builtin")i=i.slice(De(i,1)==="--"?2:1);if(Bu(i)===d)break}let u=ho(i);for(let[f,d]of u.envAssignments)s.set(f,d),a.set(f,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:QC(u.words,o)}}function QC(e,t){return e.some((n)=>!t.has(n))}function Bu(e){return e.map(w).join(" ")}function un(e){let t=e[0];return t?w(t):""}function De(e,t){let n=e[t];return n?w(n):void 0}function eb(e){return $u.test(un(e))}function tb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var nb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function rb(e,t,n){let r=1,o=n;while(r<e.length){let i=De(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=De(e,r+1);o=s?Zn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Zn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Zn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(nb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var ob=new Set(["-i","-0","--null"]),ib=new Set(["-u","--unset","-C","--chdir","-P"]);function sb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=De(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let f of n.keys())o.set(f,"");o.set("TMPDIR",""),a++;continue}if(ob.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let f=De(e,a+1);if(f!==void 0)o.set(f,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:De(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(ib.has(c)){if(c==="-C"||c==="--chdir"){let f=De(e,a+1);s=f?Zn(s,f,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let f=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Zn(s,f,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let f=Pe(De(e,a)??"");if(!f)break;o.set(f.name,f.value),a++}if(De(e,a)==="--")a++;return l(a)}return l(a)}function Zn(e,t,n){if(t==="")return null;if(!e&&!zu(t))return null;let r=zu(t)?JC(t).root:n.realpath(e??"/");if(r===null)return null;try{return ft(r,t,n)}catch{return null}}function ab(e){if(De(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=De(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var lb=/['"\\$`{}#]/;function yo(e,t){if(e.some((r)=>lb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function mt(e,t,n){return Co(e,t,n).tokens}function cb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Mt(e,t,n,r=0){let o=Co(e,t,n),i=(o.envSplitValues??[]).flatMap(cb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Mt(s,t,n,r+1)}function Co(e,t,n,r){if(!Uu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Ot(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Ks=Symbol("adopt-as-operand"),ub=new Set(["env","sudo","command","builtin"]),db=new Set(["&&","||","|&","|","&",";"]),fb=new Set(["<<","<<<",">|"]),mb=new Set(["|","|&"]),pb=/[*@#?$!_-]/,gb=/^\w+(?::\w+)*/,hb=Object.freeze([]),Xn=Object.freeze({kind:"scope",edge:"enter"}),Jn=Object.freeze({kind:"scope",edge:"exit"}),yb=Object.freeze([]),Cb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Qn=new Set(["bash","sh","zsh","dash","ksh"]),bb=256,qu=new WeakMap;function Yu(e,t){let n=t.status==="complete"?new Set(Vs(t)):new Set,r=Eb(e,n);if(Lr(r))return bo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Nt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return bo("structural-limit",r,t);if(o.invalid)return bo("invalid",r,t);let s=bo("complete",r,t,o.assignmentFallbacks);return qu.set(s,Object.freeze(i)),s}function vo(e,t,n,r,o){let i=o.word??((f)=>f),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let f of Zu(e)){if(f.kind==="scope"){if(f.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let m=u.pop();if(m===void 0)throw Error("scope exit without a matching enter");s=m.state,a=m.segment,l=m.shellWords,c=m.pipeProducer;continue}if(f.kind==="operator"){if(!f.boundary)continue;let d=o.segment(a,s,c,f.operator,l);if(d)return d;s=Sb(a,s,n,r),c=a.length>0&&mb.has(f.operator)?a:null,a=[],l=new Set;continue}if(f.kind==="redirection"){if(f.fd!==void 0)l.add(a.length-1);if(f.target===void 0)continue;let d=o.redirection({operator:f.operator,role:f.role,targetOrder:f.targetOrder,target:f.target,...f.body===void 0?{}:{body:f.body,consumer:f.consumer}},s);if(d===Ks){l.add(a.length),a.push(i(f.target));continue}if(d)return d;continue}a.push(i(f.text))}return o.segment(a,s,c,null,l)}function Eo(e){return Zu(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function me(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:me(i,t);return a?me(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function er(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function Sb(e,t,n,r){let o=er(e)?new Map([...t.variables,...vb(e,t.variables)]):t.variables,i=mt([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(me(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function vb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],me(o,t)]]:[]})}function Zu(e){return qu.get(e)??hb}function Eb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function bo(e,t,n,r=yb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Nt(e,t){return e.nodes.flatMap((n,r)=>Rb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function Rb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Le(Ab(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Le(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[So("{"),...Nt(e.body,a),...s?[So("}")]:[]]:[Xn,Le("("),...Nt(e.body,a),...s?[Le(")")]:[],Jn]}]}let o=Ob(e,r.functions);if(o){if(r.depth>=dt.maxDepth||++r.flags.expansions>bb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Hu(e,r),So(";"),...Nt(o,{...r,depth:r.depth+1}),So(";")]},...ju(e,t,n,r)]}return[{start:e.span.start,events:Hu(e,r)},...ju(e,t,n,r)]}function Hu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Ju(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:xb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function xb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Ju(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[qs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:Tb(r),targetOrder:fb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:ed(t)}:{}}),...s===void 0?o:o.slice(1)]}function ju(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[qs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Le(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...Xu(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?_b(t,n,r):[]]}function _b(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:Xu(n.source.slice(r.span.end,e.span.end),n)}]}function Xu(e,t){if(t.depth>=dt.maxDepth)return t.flags.limited=!0,[];let n=Me(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Nt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Ju(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Le("glob"):s!==""||e.quoted&&o.length===0?qs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of Hs(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(Le(m));continue}s+=m.text,a||=m.glob}continue}let u=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=Hs(m,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=u?Nt(u,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(Xn,...p,Jn);continue}let f=u?Nt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Xn,...f,Jn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Le("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Xn,...f,...c.raw.endsWith(")")?[Le(")")]:[],Jn);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>Le("(")),...d===1?[Xn]:[],...f,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>Le(")")):[],...d===1?[Jn]:[])}return l(),o}function Hs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Vu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Vu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Vu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=Pb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return wb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&pb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?gb:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function wb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Hs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function Pb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Ab(e){return/^[\r\n]+$/.test(e)?";":e}function Le(e){return Object.freeze({kind:"operator",operator:e,boundary:db.has(e)})}function So(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function qs(e){return Object.freeze({kind:"word",text:e})}function Tb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function tr(e){return Cb.has(e)||/^python\d/.test(e)}var Ib=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Qu(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=Ib.get(e)?.has(n)??!1;return Qu(e,t.slice(r?2:1))}function js(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return js(e.slice(1));if(!ub.has(t))return[...e];return js(Qu(t,e.slice(1)))}function ed(e){let t=Bn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return js(n<0?[]:e.words.slice(n).map((r)=>r.text))}function kb(e){let t=ed(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return tr(n)&&!Qn.has(n)}function Vs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Vs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Vs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(kb(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!Nb(t))return r;return[...r,...o]})}function Ob(e,t){let n=Bn(e);return n===void 0?void 0:t.get(n)}function pt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function Mb(e){if(pt(e.words[0],"git"))return pt(e.words[1],"commit");if(!pt(e.words[0],"gh")||!pt(e.words[2],"create"))return!1;return pt(e.words[1],"pr")||pt(e.words[1],"issue")}function Nb(e){return(pt(e.words[0],"cat")||pt(e.words[0],"tee")||Mb(e))&&!e.words.some(Ku)&&!e.redirections.some((n)=>Ku(n.target))}function Ku(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var td=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),nd=new Set([...td,"glob"]),Db=new Set([...nd,"pattern"]);class We extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function nr(e){let t=Lb(),n=An(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:Wb(e),store:t}}function pe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Xe(e,t){if(!e.includes("$"))return e;return Ei(e,t)}function Lb(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Me(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let f={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,f),f}let l=e.get(i);if(l)return l;let c=Yu(i,a);return e.set(i,c),c},getCommandProgram:r}}function Wb(e){let t=e.route.kind==="grep"?nd:e.route.kind==="glob"?Db:td;return[...El(e.input,t),...e.route.kind==="patch"?_l(e.input):[]]}var Gb=new Set(["-S","--suffix"]);function dn(e,t,n,r,o){if(e.status==="structural-limit")throw new We;if(e.status!=="complete")return o.findMalformedTarget(e.source);return vo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(me(i.target,s.variables),s)?i.target:null})}function Ro(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Gb.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Ae="Git metadata and hooks are protected. Ask the user before modifying them.";function ad(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(wr(e.invocation.toolName))return null;let a=e.paths.find((l)=>rd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=pe(e,"input-candidate");if(!i)return null;let s=dn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>$b(a,l,t,n,r),isRedirectionTarget:(a,l)=>rd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=_o(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Ys(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(f)=>c?xo(f,l):Fb(f,l);if(n.markerFiles.some(u))return!0;return r&&od(n).some(u)}if(Ys(a,n))return!0;return r&&od(n).some((c)=>xo(c,a))}function Fb(e,t){let n=sd(t,e);if(n===""||n.startsWith("..")||id(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function zb(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function Bb(e,t,n,r,o){if(!n)return!1;return Ys(_o(se(e,t,r,o)),n)}function rd(e,t,n,r,o,i){let s=_o(se(e,t,r,o));return i.includes(s)||cd(s,n)}function ld(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>xo(i,_o(se(s,t,r,o)))))}function Ys(e,t){return t.entries.includes(e)||t.directories.includes(e)||cd(e,t)}function cd(e,t){return t.hooksDirectories.some((n)=>xo(e,n))}function od(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function xo(e,t){let n=sd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!id(n)}function _o(e){return process.platform==="win32"?e.toLowerCase():e}function $b(e,t,n,r,o){if(er(e))return null;let i=Mt([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=Ro(i.slice(1)),a=s.sources.find((l)=>zb(me(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&Bb(me(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Io,normalize as Zb,parse as Xb,posix as yd,resolve as Wt,sep as Qs}from"node:path";import{isAbsolute as Ub,join as ud,normalize as md,parse as Hb,sep as dd}from"node:path";var jb=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Vb=` 	
-`;function rr(e,t){if(gt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Zs(e.get("TMPDIR")??"",t)}function Lt(e,t){if(e.has("TMPDIR"))return Zs(e.get("TMPDIR")??"",t);let n=Xs(e,t);if(n===void 0)return!0;return Zs(n,t)}function Xs(e,t){return gd(e,t,"TMPDIR")}function Zs(e,t){if(!e)return!1;if(qb(e))return!1;return fn(e,t)}function gt(e,t){let n=gd(e,t,"IFS");return n!==void 0&&n!==""&&n!==Vb}function fn(e,t){let n=wo(e,t.paths);if(n===null)return!1;return pd(t).some((r)=>To(n,r))}function Ao(e,t){let n=wo(e,t.paths);if(n===null)return!1;return pd(t).some((r)=>Po(r)===Po(n))}var fd=new WeakMap;function pd(e){let t=fd.get(e);if(t)return t;let n=Kb(e);return fd.set(e,n),n}function Kb(e){let t=jb.map((r)=>wo(r,e.paths)??md(r)),n=wo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&Yb(n))return[...t,n];return t}function qb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function gd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function Yb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function wo(e,t){try{let n=md(e);if(!Ub(n))return n;let r=Hb(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=ud(i,o[s]??"");if(t.entryKind(a)==="missing")return ud(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function To(e,t){let n=Po(e),r=Po(t);if(n===r)return!0;let o=r.endsWith(dd)?r:`${r}${dd}`;return n.startsWith(o)}function Po(e){return process.platform==="win32"?e.toLowerCase():e}var Jb=process.platform==="win32",hd=64,Qb=16384;function or(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return b(o.id,o.reason)}function ir(e){let t=au(e,hd,hd,Qb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:eS(e)}}function eS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>tS(e.raw,n.span.start-e.span.start))}function tS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Gt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??ye();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:aS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&cS(e))return{kind:"outside_anchored_cwd"};let o=!r&&bd(e,t.posixShell);if(at(e))return{kind:"outside_anchored_cwd"};if(ea(e,r))return{kind:"root_or_home_target"};if(rS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(oS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(lS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&mS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>pS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(gS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(nS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function nS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Io(r)||r.startsWith("~"))return!1;if(ta(r))return!1;if(Sd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return fn(Wt(t.resolvedCwd,r),t.environment)}function Cd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(sS(i))return!1;if(Ao(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Sd(r??i,s,t.environment.paths,t.budget))}function ea(e,t=!1){let n=e.trim(),r=yd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function rS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Io(o)?o:t.resolvedCwd?Wt(t.resolvedCwd,o):null;if(!i)return!1;let s=ge(F(i,t.environment.paths,t.budget));if(s===Xb(s).root)return!0;return s===ge(F(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function ge(e){let t=Zb(e);if(Jb){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function oS(e,t,n,r,o,i,s,a){let l=e.trim();if(ta(l))return!1;if(!r&&fn(l,a))return!0;return(t||i&&s)&&n&&!o&&iS(l,n)}function iS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!bd(e.slice(n.length+1),t)})}function sS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return yd.normalize(`/${t[1]??""}`)==="/"}function ta(e){return e.split(/[\\/]+/).includes("..")}function aS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Gn(o.trim(),t);if(!Io(i))return[];try{let s=F(i,n,r);if(Fn(s,F(t,n,r)))return[];return[ge(s)]}catch{return[]}})}function lS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(ta(r))return!1;let o=n?r:Gn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Io(o)?o:i?Wt(i,o):null;if(!s)return!1;try{let a=ge(F(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Qs)?l:`${l}${Qs}`))}catch{return!1}}function cS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function bd(e,t=!1){return e.includes("$")||e.includes("`")||uS(e)||t&&dS(e)}function uS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function dS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&fS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function fS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function mS(e,t,n,r){try{return ge(F(e,n,r))===ge(F(t,n,r))}catch{try{return ge(e)===ge(t)}catch{return!1}}}function pS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return ge(F(Wt(t,e),n,r))===ge(F(o,n,r))}catch{try{return ge(Wt(t,e))===ge(o)}catch{return!1}}}function gS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Js(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Js(Wt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Js(Wt(a,e),t,i,s)}catch{return!1}}function Js(e,t,n,r){try{return vd(F(e,n,r),F(t,n,r))}catch{return!1}}function Sd(e,t,n,r){if(!t)return!1;try{return vd(F(t,n,r),F(e,n,r))}catch{return!0}}function vd(e,t){let n=ge(e),r=ge(t);return n.startsWith(`${r}${Qs}`)||n===r}var hS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Ed="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",yS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Rd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",xd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",CS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",bS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",SS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:xd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Ae},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Rd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:CS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Ed},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:yS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Ed}};function _d(e,t,n,r=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return vS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function vS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=RS(o),s=o[i];if(!s||!hS.has(OS(s.text)))return null;let a=ES(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",bS);for(let l of a.targets)if(!at(l.text)&&ea(ra(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",xd);for(let l of a.targets)if(n.resolvedCwd&&Dt(ra(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return b("powershell.remove-item-git-metadata",Ae);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",Rd);for(let l of a.targets){let c=or(Ge(ra(l.text),n),n,r,SS);if(c)return c}return null}function ES(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(xS(l))continue;if(s){t.push(na(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=wS(l.text);if(!c){t.push(na(l)),i=i||l.dynamic;continue}if(PS(c.name)){let u=c.value?_S(c.value,l):e[++a];if(u?.kind==="word"){t.push(na(u)),i=i||u.dynamic;continue}i=!0;continue}if(AS(c.name)){n=!0;continue}if(TS(c.name)){r=!0;continue}if(IS(c.name))o=kS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function RS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function na(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function xS(e){return e.kind==="word"&&e.text===","}function ra(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function _S(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function wS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function PS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function AS(e){return"recurse".startsWith(e)}function TS(e){return e.length>=2&&"force".startsWith(e)}function IS(e){return e==="wi"||"whatif".startsWith(e)}function kS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function OS(e){return e.toLowerCase()}var mn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",ko="Unsupported heredoc syntax",wd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var MS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),NS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),DS=new Set(["-o","--output","--query","--subscription"]),LS=new Set;function Pd(e){if(e==="aws")return MS;if(e==="gcloud")return NS;if(e==="az")return DS;return LS}var WS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),GS=new Set;function Ad(e){if(e==="git")return be;if(e==="docker")return WS;return GS}function Je(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=de(e);for(let o of t){if(!BS(n,o.command))continue;if(o.match){if(FS(n,e,o.match))return Td(o);continue}if(!$S(n,e,o.subcommand))continue;if(HS(e,new Set(o.block_args),r))return Td(o)}return null}function Td(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function FS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return zS(r,n.command_path,Pd(e))}function zS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function BS(e,t){return e===M(t)}function $S(e,t,n){if(!n)return!0;return Id(t,1,n,Ad(e))}function Id(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&US(e,i,n,r))return!0;continue}return s===n}return!1}function US(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Id(e,t+2,n,r)}function HS(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var jS=new Set(["-e","--source"]),VS=new Set(["-F","-v","--assign","--field-separator"]),kd=new Set(["-f","--file"]),KS=new Set(["print","printf","return"]),Od=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],qS="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Md(e,t,n){let r=!1;for(let o of YS(e)){let i=ZS(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",qS):null}function ia(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&jS.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(VS.has(a)||kd.has(a))){let l=e[s+1];if(i&&=l!==void 0,kd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function ar(e){return ia(e).sources}function YS(e){return ar(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function ZS(e,t){Ee(t,e);let n=e.includes("system")?sa(e,t):null,r=XS(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function sa(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Mo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Nd(e,i+1);continue}if(s==="/"&&Dd(e,i)){i=Ld(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,sr(e[a-1])||sr(e[i]))continue;let l=Oo(e,i);if(e[l]!=="(")continue;l=Oo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Mo(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Oo(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function XS(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let m=Mo(e,i,u);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(u==="#"){i=Nd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Dd(e,i)){let m=Ld(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(oa(e,i,"print")||oa(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let f=e[i+1]==="&"?i+2:i+1,d=Oo(e,f);if(oa(e,d,"getline")){o=!0;let m=ev(s,l,c);if(r||=m===null,m!==null)n.push(m);c=f,i=f;continue}if(nv(s,a)){o=!0;let m=QS(e,d);if(!m){r=!0,c=f,i=f;continue}if(!JS(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=f,i++}if(!o)return null;return{dynamic:r,commands:n}}function sr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Oo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function JS(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Mo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=tv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function QS(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Mo(e,t,n)}function ev(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function tv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function oa(e,t,n){return e.startsWith(n,t)&&!sr(e[t-1])&&!sr(e[t+n.length])}function nv(e,t){return t!==null&&t>=e}function Nd(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Dd(e,t){let n=rv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(sr(e[r-1]))r--;return KS.has(e.slice(r,n+1))}function rv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Ld(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var ov=new Set(["sudo","env","command","builtin"]);function No(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=iv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function iv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&sv(a,r);if(l)i.push(s);if(!l&&Dr.has(M(a)))break;if(o)break}return i}function sv(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||Xi.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Oe(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return ov.has(e.toLowerCase())}function zt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Fe(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Do([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Do(e,t,n,r,o,i,s,a,l){let c=Co(e,t,n,i);for(let[m,p]of c.envAssignments)i.set(m,p),o.set(m,p);let{tokens:u,cwd:f}=c;if(c.envSplitValues){let m=yo(c.envSplitValues,u);if(!m)throw new N("derivedCommandShape");aa(a),yield*Do(m,t,f,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new N("wrapperPeelIterations");let d=No(u,s);if(d){for(let m of[d.childIndex,...d.alternativeChildIndices])aa(a),yield*Do(m===d.childIndex?d.tokens:[...u.slice(m)],t,f,r,new Map(o),new Map(i),s,a,!0);return}if(lv(u)){aa(a),yield*Do([...u.slice(1)],t,f,r,o,i,s,a,l);return}yield av(u,f,r,o,i,l)}function av(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function aa(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function lv(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function la(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function ze(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||ca(r,"recursive")){t=!0;continue}if(r==="-f"||ca(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Wd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>ca(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function ca(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var cv="find -delete permanently removes files. Use -print first to preview.",uv="find -exec rm -rf is dangerous. Use explicit file list instead.",dv=new Set(["-exec","-execdir","-ok","-okdir"]),fv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Gd(e,t){let n=e.map(w),r=mv(e,n,t);if(r)return r;if(Wo(n,1)&&!gv(e,n,t)){let s=A(b("find.delete",cv),t.policy);if(s)return s}let o=t.budget??ye(),i=0;while(i<n.length){let s=n[i],a=ht(s??"");if(a>0){i+=a+1;continue}if(!Qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=lr(n,i);i=l.nextIndex;let c=yv(l.tokens,t.environment);if(c){let m=A(c,t.policy);if(m)return m}let u=s==="-execdir"||s==="-okdir",f=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=f?.id.startsWith("custom.")?f:A(f,t.policy);if(d)return d}return null}function mv(e,t,n){if(!Wo(t,1)&&!ua(t,n.environment))return null;let o=Lo(e)??K(["."]),i=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=ir(s);for(let l of a.expandedTargets??[w(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Ae)}}if(pv(t)&&i.resolvedCwd&&ld(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return b("find.delete-git-metadata",Ae);return null}function ua(e,t){let n=0;while(n<e.length){if(!Qe(e[n])){n++;continue}let r=lr(e,n),o=Mt([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function pv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function gv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Lo(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Xs(o,n.environment),s=n.trustedTmpdirValue??Lt(o,n.environment),a=n.allowTmpdirVar??!rr(o,n.environment),l=Gt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??gt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=ir(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((f)=>Cd(f,l,{containmentTarget:hv(f,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function hv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Lo(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function yv(e,t){let n=mt([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&ze(n))return b("find.exec-rm-recursive-force",uv);return null}function lr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Wo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Qe(r)){n=lr(e,n).nextIndex;continue}let o=ht(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ht(e){return fv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Qe(e){return e!==void 0&&dv.has(e)}function cr(e){let t=Me(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Cv=5,da="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function zd(e,t,n){let r=Go(e,t,n),o=bv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Cv;a++){let{subcommand:l,rest:c}=Re(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let f=o.get(u),d=xv(f);if(d===null||d.length===0)return{blockedReason:da,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:da,expanded:!0,tokens:i}}function Bd(e,t,n){return Go(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Re(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=be.has(o)?2:1}return{subcommand:null,rest:[]}}function bv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Go(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=vv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Sv(e,t,n)]}}function Sv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=fa(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=fa(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Fd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Fd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(be.has(i)){o+=2;continue}o++}return r}function vv(e,t){let n=Ev(e,t),r=Rv(e,t);return{blockedReason:n===null||r===null?da:null,entries:[...n??[],...r??[]]}}function Ev(e,t){let n=Ze("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=cr(n);if(!o)return null;for(let i of o){let s=fa(i);if(!s)return null;r.push(s)}return r}function Rv(e,t){let n=Lu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ze(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ze(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function fa(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Fd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ze(e.slice(r+1),t,n)}}function xv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return cr(t)}var _v="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",wv="git checkout --force discards uncommitted changes. Use 'git stash' first.",Pv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Av="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Tv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",Iv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",kv="git switch --force discards uncommitted changes. Use 'git stash' first.",Ov="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Mv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Nv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Dv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Lv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Wv="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Gv="git push --force destroys remote history. Use --force-with-lease for safer force push.",Fv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",zv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Bv="git branch -D force-deletes without merge check. Use -d for safe delete.",$v="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",Uv="git merge --abort discards merge conflict resolutions. Use 'git status' first.",Hv="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",jv="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Vv="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",Kv="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",qv="git worktree remove --force can delete uncommitted changes. Remove --force flag.",Yv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Zv=new Set(["--recurse-submodules","--track","-t"]),ma=new Set(["-b","-B","-U"]),pa=new Set(["-c","-C"]),Xv=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var pn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Ud(e){let{subcommand:t,rest:n}=Re(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return yt(Jv(n));case"switch":return yt(Qv(n));case"restore":return yt(tE(n));case"reset":return rE(n);case"clean":return yt(iE(n));case"rm":return yt(sE(n));case"push":return Bt(aE(n));case"branch":return Bt(uE(n));case"stash":return Bt(gE(n));case"worktree":return Bt(hE(n));case"rebase":return yt(dE(n));case"merge":return yt(fE(n));case"tag":return Bt(mE(n));case"reflog":return Bt(pE(n));default:return null}}function yt(e){return e?{...e,localDiscard:!0}:null}function Bt(e){return e?{...e,localDiscard:!1}:null}function Jv(e){let{index:t,before:n}=ie(e),r=de(n,{shortOptsWithValue:ma});if(n.some((i)=>O(i,"--force"))||r.has("-f"))return b("git.checkout-force",wv);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(O(i,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",Av)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return b("git.checkout-ref-path",Pv);return b("git.checkout-double-dash",_v)}if(eE(e).length>=2)return b("git.checkout-ambiguous",Tv);return null}function Qv(e){let{before:t}=ie(e);if(t.some((r)=>O(r,"--discard-changes")))return b("git.switch-discard-changes",Iv);let n=de(t,{shortOptsWithValue:pa});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return b("git.switch-force",kv);return null}function eE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(Yv.has(r)){n+=2;continue}if(Zv.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function tE(e){let t=nE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",Mv):b("git.restore-unstaged",Ov)}function nE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(Xv.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function rE(e){let t=null;for(let n of e){if(O(n,"--hard")){t=b("git.reset-hard",Nv);break}if(O(n,"--merge")){t=b("git.reset-merge",Dv);break}}if(!t)return null;return oE(e)?Bt(t):yt(t)}function oE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function iE(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return b("git.clean-force",Lv);return null}function sE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",Wv):null}function aE(e){let{before:t,after:n}=ie(e),r=de(t);if(t.some((s)=>O(s,"--mirror")))return b("git.push-mirror",zv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||$d(t,n).some(lE))return b("git.push-force",Gv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||$d(t,n).some(cE))return b("git.push-delete",Fv);return null}function $d(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function lE(e){return e.startsWith("+")||e.includes(":+")}function cE(e){return e.length>1&&e.startsWith(":")}function uE(e){let{before:t}=ie(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return b("git.branch-force-delete",Bv);return null}function dE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.rebase-abort",$v):null}function fE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.merge-abort",Uv):null}function mE(e){let{before:t}=ie(e);return de(t).has("-d")||t.some((r)=>O(r,"--delete"))?b("git.tag-delete",Hv):null}function pE(e){return e[0]==="delete"?b("git.reflog-delete",jv):null}function gE(e){for(let t of e){if(t==="drop")return b("git.stash-drop",Vv);if(t==="clear")return b("git.stash-clear",Kv)}return null}function hE(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",qv);return null}import{dirname as LE,isAbsolute as WE,join as of,resolve as GE}from"node:path";var ha="TMPDIR",ya="IFS",jd=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Vd=/^[A-Za-z_][A-Za-z0-9_]*$/,Kd=new Set(["export","typeset","declare","readonly"]),yE=new Set(["builtin","command","time"]),qd=new Set(["do","then","else"]),CE=new Set(["do","then","case"]),Hd=new Set(["done","fi","esac"]),bE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Yd(e,t){return e.map((n)=>n.provenance==="variable"&&tf(n.text)?ur(n.text,t.shellAssignments):w(n))}function ur(e,t){return e.replace(bE,(n,r,o)=>t.get(r??o??"")??n)}function Zd(e,t){return{env:e,effectiveEnvAssignments:RE(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Xd(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ca(e,t){let n=Qd(e,t),r=e[0]??"";if(CE.has(r))t.bodyDepth+=1;if(r==="elif"||Hd.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(Hd.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);ba(t,a)});let o=n.commandIndex;if(o!==-1&&Kd.has(e[o]??""))e.filter((a)=>Vd.test(a)&&ga(a)).forEach((a)=>{xE(t,a)});let i=o===-1?-1:ef(e,o);if(i===-1||e[i]!=="unset")return;let s=wE(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(qd.has(r)){t.shellAssignments.set(a,"");return}_E(t,a)})}function Jd(e,t){let n=Qd(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Qd(e,t){let n=qd.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!tf(a)),o=r!==-1&&Kd.has(e[ef(e,r)]??""),i=EE(t);return{assignments:e.flatMap((a,l)=>{let c=SE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!po(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function ef(e,t){let n=t;while(yE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function tf(e){return Pe(e)!==null||jd.test(e)}function SE(e,t,n){return Pe(e)??vE(e,t,n)}function vE(e,t,n){let r=go(e,n,t);if(r)return r;let o=e.match(jd)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function ga(e){return e===ha||e===ya||Us(e)}function EE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function RE(e,t){let n=[ha,ya].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ba(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function xE(e,t){ba(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function _E(e,t){if(!ga(t)&&!Vd.test(t))return;if(e.shellAssignments.set(t,""),po(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!ga(t)||t===ha||t===ya||Mn(t)){ba(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function wE(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as PE}from"node:path";function Fo(e,t){return $s.some((n)=>t?.has(n)||e.has(n))}function zo(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(PE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=nf(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=nf(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=be.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function nf(e,t,n){try{let r=ft(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function rf(e,t,n){if(!t.localDiscard||!n.worktreeMode||Fo(n.environment.env,n.envAssignments))return null;let r=zo(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Sa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Sa(e,t,n){let{subcommand:r,rest:o}=Re(e),i=r?.toLowerCase();if(t.dynamicArguments||AE(o)||ME(e,t.environment.env,t.envAssignments,n)||kE(o)||TE(i,o))return!0;return i==="clean"&&OE(o)>1}function AE(e){return e.some((t)=>/[$*?[]/.test(t))}function TE(e,t){if(e==="checkout"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:ma}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:pa}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||IE(s))||r.has("-C");return o&&i}return!1}function IE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function kE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function OE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function ME(e,t,n,r){if(Ze("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Go(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>DE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||NE(s.value);if(Gu(n))return!0;return r.recursiveSubmodules}function NE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function DE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function sf(e,t,n){let r=e.map(w),o=n.environment.paths,i=zo(r,n.cwd,o),s=n.originalCwd?o.realpath(GE(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Fo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?zE(e,n.shellAssignments,o):af(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!FE(a,r,t,n)||!fn(a,n.environment)||Ao(a,n.environment)||To(s,a)||To(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function FE(e,t,n,r){let o=r.environment.paths,i=of(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!Sa(t,r,s)}function zE(e,t,n){let r=Re(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?ur(a,t??new Map):a;if(!WE(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function af(e,t){if(t.entryKind(of(e,".git"))!=="missing")return e;let n=LE(e);return n===e?null:af(n,t)}var BE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",$E=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Bo(e,t){return lf(e,t)}function lf(e,t,n){let r=e.map(w),o=zd(r,t.environment.env,t.envAssignments),i=o.blockedReason?A(b("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Wu(t.envAssignments)||Bd(r,t.environment.env,t.envAssignments))&&UE(s))return b("git.ssh-env",BE);let a=Ud(s);if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=rf(r,a,t)??sf(e,a,t);if(!l)return a;return n?.(l),null}function cf(e,t){let n=null;return{match:lf(e,t,(o)=>{n=o}),relaxation:n}}function UE(e){let{subcommand:t,rest:n}=Re(e),r=t?.toLowerCase();if(!r)return!1;if($E.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&HE(n)}function HE(e){return e.find((t)=>!jE(t))?.toLowerCase()==="update"}function jE(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as wR}from"node:path";function uf(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function $o(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var df="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",VE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",KE="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",mf="rm -rf targeting root or home directory is extremely dangerous and always blocked.",qE="rm -rf in home directory is dangerous. Change to a project directory first.",ff={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:mf},git_metadata_target:{id:"rm.git-metadata",reason:Ae},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:KE},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:qE},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:df},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:VE},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:df}};function Uo(e,t){let n=Gt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=ze(r),i=Wd(r),s=ZE(e);for(let a of s){let l=ir(a.word);if(o&&l.unsafeBraceExpansion){let c=A(or({kind:"outside_anchored_cwd"},n,t.policy,ff),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=Ce(c),f={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return b("rm.git-metadata",Ae);if(i&&!o){let d=Ge(u,n,f);if(d.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",mf);if(d.kind==="git_metadata_target")return b("rm.git-metadata",Ae);continue}if(!o)continue;for(let d of YE(u,n,f)){let m=or(d,n,t.policy,ff),p=A(m,t.policy);if(p)return p}}}return null}function YE(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function ZE(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},$t={kind:"dynamic"},XE=new Set(["<","<<","<<-","<<<","<&","<>"]),gf=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,JE=/^(?:[0-9]+|[@*])$/,QE=dt.maxWords,eR=dt.maxInputLength;function hf(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(C(e,o-1)))&&(!C(e,o+2)||H(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&qe(e,o+11)||Gs(e,o,"recursive"),r||=j(e,o,"--force")&&qe(e,o+7)||Gs(e,o,"force"),n&&r)return!0;o++}return!1}function Gs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&qe(e,t+r+2)}function uC(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(C(e,n)))n++;let i=n;while(n<Y(e)&&!H(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=vu(e,i,"recursive"),a=vu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=mC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function vu(e,t,n){return j(e,t,`--${n}`)&&qe(e,t+n.length+2)||Gs(e,t,n)}function dC(e,t){if(t>0&&kt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!H(C(e,n+1)))return-1;return n+1}function mC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=C(e,c)??"",m=(u==="r"||u==="f")&&qe(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Eu(e,t,n){return Kn(e,"reset",an,!0,(r)=>C(e,r)==="-"&&ln(e,r,t,n)?!0:r)}function fC(e){return Kn(e,"clean",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(ln(e,t,"--fo","rce"))return!0;let n=Vn(e,t,an);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function mo(e,t,n){if(!Ke(e,t,"git"))return null;let r=t+3;if(!H(C(e,r)))return{commandEnd:-1,next:r};while(H(C(e,r)))r++;while(r<Y(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=Vn(e,r,oe);if(Ke(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=pC(e,r,o);r=o;while(H(C(e,r)))r++;if(i)return{commandEnd:Ke(e,r,n)?r+n.length:-1,next:Vn(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=Vn(e,r,oe);while(H(C(e,r)))r++}return{commandEnd:-1,next:r}}function pC(e,t,n){for(let r of be)if(n-t===r.length&&j(e,t,r))return!0;return!1}function gC(e){return xu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function hC(e){return Kn(e,"push",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!kt(C(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=_u(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function yC(e){return Kn(e,"push",oe,!1,(t)=>{if(H(C(e,t))&&C(e,t+1)==="+"&&t+2<Y(e)&&!oe(C(e,t+2))&&!H(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function CC(e){return Kn(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&ln(e,t,"--de","lete"))return!0;if(H(C(e,t))&&C(e,t+1)===":"&&t+2<Y(e)&&!H(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function bC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=mo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=Vn(e,o,oe),s=SC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function SC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(ln(e,i,"--de","lete"))r=!0;if(ln(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&vC(C(e,s))){let u=C(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!qe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function vC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function EC(e){return xu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function xu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=mo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(ln(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&qe(e,r+1))return!0;if(an(o))i.outerActive=!1}return!1}function Kn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=mo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(C(e,u)))i=!1;s=c}if(l)i=!1}return!1}function xC(e){let t=!1;for(let n=0;n<Y(e);n++){if(Ws(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=mo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Ru(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=C(e,r),i=t?Ws(o):oe(o);if(n&&H(o)&&C(e,r+1)==="-"&&Ke(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Ke(e,r,"find"))n=!0,r+=3}return!1}function Vn(e,t,n){let r=t;while(r<Y(e)&&!H(C(e,r))&&!n(C(e,r)))r++;return r}function _u(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return qe(e,o)?o:-1}function ln(e,t,n,r){return _u(e,t,n,r)>=0}function Ye(e,t){jn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&uo(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var RC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;jn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Au(t.nodes,r,i)}function Au(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Au(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return _C(r,t,n)})}function _C(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!RC.test(o.text));return e.words.every((o,i)=>o===t||wu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||wu(o.target.raw,n.anchored,!0)))}function wu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as wC,resolve as Tu}from"node:path";function qn(e,t,n,r){let o=wC(e)?Tu(e):t?Tu(t,e):void 0;if(!o)return;try{return F(o,n,r)}catch{return o}}function Iu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var cn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Yn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Fs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),PC=new Set(["-p","--print"]),AC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),TC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),IC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),kC=new Map([["python",new Set(["m"])]]),OC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),MC=new Set(["always","default","never"]),NC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),DC=/\\\r?\n/g,LC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Ou(e){return po(e).code}function fo(e){return po(e).sources}function Mu(e){return LC.get(Bs(e))??[]}function po(e){let t=Bs(e[0]??"");if(!Fs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&PC.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(GC(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(FC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=WC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(OC.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&NC.has(s))||t==="python"&&!MC.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(kC.get(t)?.has(d)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(AC.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(TC.get(t)?.has(d)){if(m+1===s.length)i++;break}if(IC.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function WC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function zs(e,t){return Bs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Bs(e){let t=k(e).toLowerCase();return Dr.test(t)?"python":t}function GC(e,t){return Fs.get(e)?.has(t)??!1}function FC(e){return Fs.get(e)?.has("--eval")??!1}function Zn(e,t){let n=$C(e,t);if(!ku(n,t))return!1;Ee(t,n);let r=BC(n);if(ku(r,t))return!0;return Ee(t,r),zC.test(r)}var zC=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function BC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function ku(e,t){if(co(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(co(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(co(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>uo(o,r))))}function $C(e,t){return Ee(t,e),e.replace(DC,"")}import{isAbsolute as id,relative as sd}from"node:path";import{isAbsolute as zu,parse as JC}from"node:path";import{dirname as UC,isAbsolute as HC,parse as jC,sep as VC}from"node:path";function mt(e,t,n){if(at(t))throw Error("Unsupported Windows namespace path");let r=HC(t)?jC(t).root:"",o=r||e;for(let i of qC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=UC(o);continue}let s=KC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function KC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${VC}${t}`}function qC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var $s=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],YC=new Set($s),ZC=1024,Nu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Du=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),XC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function go(e){return YC.has(e)}function Us(e){return go(e)||Nu.has(e)||Du.has(e)||Nn(e)}function Ze(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Lu(e,t){let n=Ze("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=ZC?{state:"valid",count:r}:{state:"invalid"}}function ho(e,t,n){let o=e.match(XC)?.[1];if(!o||!Us(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ze(o,t,n)??""}${e.slice(i+1)}`}}function Wu(e){return Fu(e,Du)}function Gu(e){return Fu(e,Nu)}function Fu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var $u=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!$u.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function yo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Uu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Ot(e,t,n,r){if(!Uu(un(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let d=Bu(i),f=yo(i);for(let[h,g]of f.envAssignments)s.set(h,g),a.set(h,g);if(i=f.words,i.length===0)break;while(i.length>0&&un(i).includes("=")&&!eb(i)){let h=tb(un(i),a,t.env)??ho(un(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=un(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=rb(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=sb(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=ab(i);if(p==="builtin")i=i.slice(De(i,1)==="--"?2:1);if(Bu(i)===d)break}let u=yo(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:QC(u.words,o)}}function QC(e,t){return e.some((n)=>!t.has(n))}function Bu(e){return e.map(w).join(" ")}function un(e){let t=e[0];return t?w(t):""}function De(e,t){let n=e[t];return n?w(n):void 0}function eb(e){return $u.test(un(e))}function tb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var nb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function rb(e,t,n){let r=1,o=n;while(r<e.length){let i=De(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=De(e,r+1);o=s?Xn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Xn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Xn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(nb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var ob=new Set(["-i","-0","--null"]),ib=new Set(["-u","--unset","-C","--chdir","-P"]);function sb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=De(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(ob.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=De(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:De(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(ib.has(c)){if(c==="-C"||c==="--chdir"){let m=De(e,a+1);s=m?Xn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Xn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(De(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(De(e,a)==="--")a++;return l(a)}return l(a)}function Xn(e,t,n){if(t==="")return null;if(!e&&!zu(t))return null;let r=zu(t)?JC(t).root:n.realpath(e??"/");if(r===null)return null;try{return mt(r,t,n)}catch{return null}}function ab(e){if(De(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=De(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var lb=/['"\\$`{}#]/;function Co(e,t){if(e.some((r)=>lb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function ft(e,t,n){return bo(e,t,n).tokens}function cb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Mt(e,t,n,r=0){let o=bo(e,t,n),i=(o.envSplitValues??[]).flatMap(cb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Mt(s,t,n,r+1)}function bo(e,t,n,r){if(!Uu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Ot(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Ks=Symbol("adopt-as-operand"),ub=new Set(["env","sudo","command","builtin"]),db=new Set(["&&","||","|&","|","&",";"]),mb=new Set(["<<","<<<",">|"]),fb=new Set(["|","|&"]),pb=/[*@#?$!_-]/,gb=/^\w+(?::\w+)*/,hb=Object.freeze([]),Jn=Object.freeze({kind:"scope",edge:"enter"}),Qn=Object.freeze({kind:"scope",edge:"exit"}),yb=Object.freeze([]),Cb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),er=new Set(["bash","sh","zsh","dash","ksh"]),bb=256,qu=new WeakMap;function Yu(e,t){let n=t.status==="complete"?new Set(Vs(t)):new Set,r=Eb(e,n);if(Wr(r))return So("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Nt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return So("structural-limit",r,t);if(o.invalid)return So("invalid",r,t);let s=So("complete",r,t,o.assignmentFallbacks);return qu.set(s,Object.freeze(i)),s}function Eo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of Zu(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=Sb(a,s,n,r),c=a.length>0&&fb.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===Ks){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function xo(e){return Zu(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function fe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:fe(i,t);return a?fe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function Sb(e,t,n,r){let o=tr(e)?new Map([...t.variables,...vb(e,t.variables)]):t.variables,i=ft([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(fe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function vb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],fe(o,t)]]:[]})}function Zu(e){return qu.get(e)??hb}function Eb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function So(e,t,n,r=yb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Nt(e,t){return e.nodes.flatMap((n,r)=>xb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function xb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Le(Ab(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Le(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[vo("{"),...Nt(e.body,a),...s?[vo("}")]:[]]:[Jn,Le("("),...Nt(e.body,a),...s?[Le(")")]:[],Qn]}]}let o=Ob(e,r.functions);if(o){if(r.depth>=dt.maxDepth||++r.flags.expansions>bb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Hu(e,r),vo(";"),...Nt(o,{...r,depth:r.depth+1}),vo(";")]},...ju(e,t,n,r)]}return[{start:e.span.start,events:Hu(e,r)},...ju(e,t,n,r)]}function Hu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Ju(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:Rb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function Rb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Ju(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[qs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:Tb(r),targetOrder:mb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:ed(t)}:{}}),...s===void 0?o:o.slice(1)]}function ju(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[qs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Le(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...Xu(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?_b(t,n,r):[]]}function _b(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:Xu(n.source.slice(r.span.end,e.span.end),n)}]}function Xu(e,t){if(t.depth>=dt.maxDepth)return t.flags.limited=!0,[];let n=Me(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Nt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Ju(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Le("glob"):s!==""||e.quoted&&o.length===0?qs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of Hs(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Le(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=Hs(f,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=u?Nt(u,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(Jn,...p,Qn);continue}let m=u?Nt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Jn,...m,Qn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Le("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Jn,...m,...c.raw.endsWith(")")?[Le(")")]:[],Qn);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>Le("(")),...d===1?[Jn]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>Le(")")):[],...d===1?[Qn]:[])}return l(),o}function Hs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Vu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Vu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Vu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=Pb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return wb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&pb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?gb:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function wb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Hs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function Pb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Ab(e){return/^[\r\n]+$/.test(e)?";":e}function Le(e){return Object.freeze({kind:"operator",operator:e,boundary:db.has(e)})}function vo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function qs(e){return Object.freeze({kind:"word",text:e})}function Tb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function nr(e){return Cb.has(e)||/^python\d/.test(e)}var Ib=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Qu(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=Ib.get(e)?.has(n)??!1;return Qu(e,t.slice(r?2:1))}function js(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return js(e.slice(1));if(!ub.has(t))return[...e];return js(Qu(t,e.slice(1)))}function ed(e){let t=$n(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return js(n<0?[]:e.words.slice(n).map((r)=>r.text))}function kb(e){let t=ed(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return nr(n)&&!er.has(n)}function Vs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Vs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Vs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(kb(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!Nb(t))return r;return[...r,...o]})}function Ob(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function pt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function Mb(e){if(pt(e.words[0],"git"))return pt(e.words[1],"commit");if(!pt(e.words[0],"gh")||!pt(e.words[2],"create"))return!1;return pt(e.words[1],"pr")||pt(e.words[1],"issue")}function Nb(e){return(pt(e.words[0],"cat")||pt(e.words[0],"tee")||Mb(e))&&!e.words.some(Ku)&&!e.redirections.some((n)=>Ku(n.target))}function Ku(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var td=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),nd=new Set([...td,"glob"]),Db=new Set([...nd,"pattern"]);class We extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function rr(e){let t=Lb(),n=Tn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:Wb(e),store:t}}function pe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Xe(e,t){if(!e.includes("$"))return e;return Ei(e,t)}function Lb(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Me(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=Yu(i,a);return e.set(i,c),c},getCommandProgram:r}}function Wb(e){let t=e.route.kind==="grep"?nd:e.route.kind==="glob"?Db:td;return[...El(e.input,t),...e.route.kind==="patch"?_l(e.input):[]]}var Gb=new Set(["-S","--suffix"]);function dn(e,t,n,r,o){if(e.status==="structural-limit")throw new We;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Eo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(fe(i.target,s.variables),s)?i.target:null})}function Ro(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Gb.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Ae="Git metadata and hooks are protected. Ask the user before modifying them.";function ad(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Pr(e.invocation.toolName))return null;let a=e.paths.find((l)=>rd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=pe(e,"input-candidate");if(!i)return null;let s=dn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>$b(a,l,t,n,r),isRedirectionTarget:(a,l)=>rd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=wo(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Ys(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?_o(m,l):Fb(m,l);if(n.markerFiles.some(u))return!0;return r&&od(n).some(u)}if(Ys(a,n))return!0;return r&&od(n).some((c)=>_o(c,a))}function Fb(e,t){let n=sd(t,e);if(n===""||n.startsWith("..")||id(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function zb(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function Bb(e,t,n,r,o){if(!n)return!1;return Ys(wo(se(e,t,r,o)),n)}function rd(e,t,n,r,o,i){let s=wo(se(e,t,r,o));return i.includes(s)||cd(s,n)}function ld(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>_o(i,wo(se(s,t,r,o)))))}function Ys(e,t){return t.entries.includes(e)||t.directories.includes(e)||cd(e,t)}function cd(e,t){return t.hooksDirectories.some((n)=>_o(e,n))}function od(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function _o(e,t){let n=sd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!id(n)}function wo(e){return process.platform==="win32"?e.toLowerCase():e}function $b(e,t,n,r,o){if(tr(e))return null;let i=Mt([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=Ro(i.slice(1)),a=s.sources.find((l)=>zb(fe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&Bb(fe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as ko,normalize as Zb,parse as Xb,posix as yd,resolve as Wt,sep as Qs}from"node:path";import{isAbsolute as Ub,join as ud,normalize as fd,parse as Hb,sep as dd}from"node:path";var jb=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Vb=` 	
+`;function or(e,t){if(gt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Zs(e.get("TMPDIR")??"",t)}function Lt(e,t){if(e.has("TMPDIR"))return Zs(e.get("TMPDIR")??"",t);let n=Xs(e,t);if(n===void 0)return!0;return Zs(n,t)}function Xs(e,t){return gd(e,t,"TMPDIR")}function Zs(e,t){if(!e)return!1;if(qb(e))return!1;return mn(e,t)}function gt(e,t){let n=gd(e,t,"IFS");return n!==void 0&&n!==""&&n!==Vb}function mn(e,t){let n=Po(e,t.paths);if(n===null)return!1;return pd(t).some((r)=>Io(n,r))}function To(e,t){let n=Po(e,t.paths);if(n===null)return!1;return pd(t).some((r)=>Ao(r)===Ao(n))}var md=new WeakMap;function pd(e){let t=md.get(e);if(t)return t;let n=Kb(e);return md.set(e,n),n}function Kb(e){let t=jb.map((r)=>Po(r,e.paths)??fd(r)),n=Po(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&Yb(n))return[...t,n];return t}function qb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function gd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function Yb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Po(e,t){try{let n=fd(e);if(!Ub(n))return n;let r=Hb(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=ud(i,o[s]??"");if(t.entryKind(a)==="missing")return ud(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Io(e,t){let n=Ao(e),r=Ao(t);if(n===r)return!0;let o=r.endsWith(dd)?r:`${r}${dd}`;return n.startsWith(o)}function Ao(e){return process.platform==="win32"?e.toLowerCase():e}var Jb=process.platform==="win32",hd=64,Qb=16384;function ir(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return b(o.id,o.reason)}function sr(e){let t=au(e,hd,hd,Qb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:eS(e)}}function eS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>tS(e.raw,n.span.start-e.span.start))}function tS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Gt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??ye();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:aS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&cS(e))return{kind:"outside_anchored_cwd"};let o=!r&&bd(e,t.posixShell);if(at(e))return{kind:"outside_anchored_cwd"};if(ea(e,r))return{kind:"root_or_home_target"};if(rS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(oS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(lS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&fS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>pS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(gS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(nS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function nS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(ko(r)||r.startsWith("~"))return!1;if(ta(r))return!1;if(Sd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return mn(Wt(t.resolvedCwd,r),t.environment)}function Cd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(sS(i))return!1;if(To(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Sd(r??i,s,t.environment.paths,t.budget))}function ea(e,t=!1){let n=e.trim(),r=yd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function rS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=ko(o)?o:t.resolvedCwd?Wt(t.resolvedCwd,o):null;if(!i)return!1;let s=ge(F(i,t.environment.paths,t.budget));if(s===Xb(s).root)return!0;return s===ge(F(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function ge(e){let t=Zb(e);if(Jb){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function oS(e,t,n,r,o,i,s,a){let l=e.trim();if(ta(l))return!1;if(!r&&mn(l,a))return!0;return(t||i&&s)&&n&&!o&&iS(l,n)}function iS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!bd(e.slice(n.length+1),t)})}function sS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return yd.normalize(`/${t[1]??""}`)==="/"}function ta(e){return e.split(/[\\/]+/).includes("..")}function aS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Fn(o.trim(),t);if(!ko(i))return[];try{let s=F(i,n,r);if(zn(s,F(t,n,r)))return[];return[ge(s)]}catch{return[]}})}function lS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(ta(r))return!1;let o=n?r:Fn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=ko(o)?o:i?Wt(i,o):null;if(!s)return!1;try{let a=ge(F(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Qs)?l:`${l}${Qs}`))}catch{return!1}}function cS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function bd(e,t=!1){return e.includes("$")||e.includes("`")||uS(e)||t&&dS(e)}function uS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function dS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&mS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function mS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function fS(e,t,n,r){try{return ge(F(e,n,r))===ge(F(t,n,r))}catch{try{return ge(e)===ge(t)}catch{return!1}}}function pS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return ge(F(Wt(t,e),n,r))===ge(F(o,n,r))}catch{try{return ge(Wt(t,e))===ge(o)}catch{return!1}}}function gS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Js(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Js(Wt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Js(Wt(a,e),t,i,s)}catch{return!1}}function Js(e,t,n,r){try{return vd(F(e,n,r),F(t,n,r))}catch{return!1}}function Sd(e,t,n,r){if(!t)return!1;try{return vd(F(t,n,r),F(e,n,r))}catch{return!0}}function vd(e,t){let n=ge(e),r=ge(t);return n.startsWith(`${r}${Qs}`)||n===r}var hS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Ed="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",yS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",xd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Rd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",CS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",bS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",SS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Rd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Ae},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:xd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:CS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Ed},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:yS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Ed}};function _d(e,t,n,r=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return vS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function vS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=xS(o),s=o[i];if(!s||!hS.has(OS(s.text)))return null;let a=ES(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",bS);for(let l of a.targets)if(!at(l.text)&&ea(ra(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Rd);for(let l of a.targets)if(n.resolvedCwd&&Dt(ra(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return b("powershell.remove-item-git-metadata",Ae);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",xd);for(let l of a.targets){let c=ir(Ge(ra(l.text),n),n,r,SS);if(c)return c}return null}function ES(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(RS(l))continue;if(s){t.push(na(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=wS(l.text);if(!c){t.push(na(l)),i=i||l.dynamic;continue}if(PS(c.name)){let u=c.value?_S(c.value,l):e[++a];if(u?.kind==="word"){t.push(na(u)),i=i||u.dynamic;continue}i=!0;continue}if(AS(c.name)){n=!0;continue}if(TS(c.name)){r=!0;continue}if(IS(c.name))o=kS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function xS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function na(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function RS(e){return e.kind==="word"&&e.text===","}function ra(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function _S(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function wS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function PS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function AS(e){return"recurse".startsWith(e)}function TS(e){return e.length>=2&&"force".startsWith(e)}function IS(e){return e==="wi"||"whatif".startsWith(e)}function kS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function OS(e){return e.toLowerCase()}var fn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Oo="Unsupported heredoc syntax",wd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var MS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),NS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),DS=new Set(["-o","--output","--query","--subscription"]),LS=new Set;function Pd(e){if(e==="aws")return MS;if(e==="gcloud")return NS;if(e==="az")return DS;return LS}var WS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),GS=new Set;function Ad(e){if(e==="git")return be;if(e==="docker")return WS;return GS}function Je(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=de(e);for(let o of t){if(!BS(n,o.command))continue;if(o.match){if(FS(n,e,o.match))return Td(o);continue}if(!$S(n,e,o.subcommand))continue;if(HS(e,new Set(o.block_args),r))return Td(o)}return null}function Td(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function FS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return zS(r,n.command_path,Pd(e))}function zS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function BS(e,t){return e===M(t)}function $S(e,t,n){if(!n)return!0;return Id(t,1,n,Ad(e))}function Id(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&US(e,i,n,r))return!0;continue}return s===n}return!1}function US(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Id(e,t+2,n,r)}function HS(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var jS=new Set(["-e","--source"]),VS=new Set(["-F","-v","--assign","--field-separator"]),kd=new Set(["-f","--file"]),KS=new Set(["print","printf","return"]),Od=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],qS="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Md(e,t,n){let r=!1;for(let o of YS(e)){let i=ZS(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",qS):null}function ia(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&jS.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(VS.has(a)||kd.has(a))){let l=e[s+1];if(i&&=l!==void 0,kd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function lr(e){return ia(e).sources}function YS(e){return lr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function ZS(e,t){Ee(t,e);let n=e.includes("system")?sa(e,t):null,r=XS(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function sa(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=No(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Nd(e,i+1);continue}if(s==="/"&&Dd(e,i)){i=Ld(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,ar(e[a-1])||ar(e[i]))continue;let l=Mo(e,i);if(e[l]!=="(")continue;l=Mo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=No(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Mo(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function XS(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=No(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=Nd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Dd(e,i)){let f=Ld(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(oa(e,i,"print")||oa(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=Mo(e,m);if(oa(e,d,"getline")){o=!0;let f=ev(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(nv(s,a)){o=!0;let f=QS(e,d);if(!f){r=!0,c=m,i=m;continue}if(!JS(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function ar(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Mo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function JS(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function No(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=tv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function QS(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return No(e,t,n)}function ev(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function tv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function oa(e,t,n){return e.startsWith(n,t)&&!ar(e[t-1])&&!ar(e[t+n.length])}function nv(e,t){return t!==null&&t>=e}function Nd(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Dd(e,t){let n=rv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(ar(e[r-1]))r--;return KS.has(e.slice(r,n+1))}function rv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Ld(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var ov=new Set(["sudo","env","command","builtin"]);function Do(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=iv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function iv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&sv(a,r);if(l)i.push(s);if(!l&&Lr.has(M(a)))break;if(o)break}return i}function sv(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||Xi.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Oe(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return ov.has(e.toLowerCase())}function zt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Fe(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Lo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Lo(e,t,n,r,o,i,s,a,l){let c=bo(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=Co(c.envSplitValues,u);if(!f)throw new N("derivedCommandShape");aa(a),yield*Lo(f,t,m,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new N("wrapperPeelIterations");let d=Do(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])aa(a),yield*Lo(f===d.childIndex?d.tokens:[...u.slice(f)],t,m,r,new Map(o),new Map(i),s,a,!0);return}if(lv(u)){aa(a),yield*Lo([...u.slice(1)],t,m,r,o,i,s,a,l);return}yield av(u,m,r,o,i,l)}function av(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function aa(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function lv(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function la(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function ze(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||ca(r,"recursive")){t=!0;continue}if(r==="-f"||ca(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Wd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>ca(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function ca(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var cv="find -delete permanently removes files. Use -print first to preview.",uv="find -exec rm -rf is dangerous. Use explicit file list instead.",dv=new Set(["-exec","-execdir","-ok","-okdir"]),mv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Gd(e,t){let n=e.map(w),r=fv(e,n,t);if(r)return r;if(Go(n,1)&&!gv(e,n,t)){let s=A(b("find.delete",cv),t.policy);if(s)return s}let o=t.budget??ye(),i=0;while(i<n.length){let s=n[i],a=ht(s??"");if(a>0){i+=a+1;continue}if(!Qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=cr(n,i);i=l.nextIndex;let c=yv(l.tokens,t.environment);if(c){let f=A(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=m?.id.startsWith("custom.")?m:A(m,t.policy);if(d)return d}return null}function fv(e,t,n){if(!Go(t,1)&&!ua(t,n.environment))return null;let o=Wo(e)??K(["."]),i=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=sr(s);for(let l of a.expandedTargets??[w(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Ae)}}if(pv(t)&&i.resolvedCwd&&ld(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return b("find.delete-git-metadata",Ae);return null}function ua(e,t){let n=0;while(n<e.length){if(!Qe(e[n])){n++;continue}let r=cr(e,n),o=Mt([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function pv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function gv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Wo(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Xs(o,n.environment),s=n.trustedTmpdirValue??Lt(o,n.environment),a=n.allowTmpdirVar??!or(o,n.environment),l=Gt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??gt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=sr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((m)=>Cd(m,l,{containmentTarget:hv(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function hv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Wo(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function yv(e,t){let n=ft([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&ze(n))return b("find.exec-rm-recursive-force",uv);return null}function cr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Go(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Qe(r)){n=cr(e,n).nextIndex;continue}let o=ht(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ht(e){return mv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Qe(e){return e!==void 0&&dv.has(e)}import{resolve as UE}from"node:path";function ur(e){let t=Me(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Cv=5,da="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function zd(e,t,n){let r=Fo(e,t,n),o=bv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Cv;a++){let{subcommand:l,rest:c}=xe(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=Rv(m);if(d===null||d.length===0)return{blockedReason:da,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:da,expanded:!0,tokens:i}}function Bd(e,t,n){return Fo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function xe(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=be.has(o)?2:1}return{subcommand:null,rest:[]}}function bv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Fo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=vv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Sv(e,t,n)]}}function Sv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=ma(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=ma(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Fd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Fd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(be.has(i)){o+=2;continue}o++}return r}function vv(e,t){let n=Ev(e,t),r=xv(e,t);return{blockedReason:n===null||r===null?da:null,entries:[...n??[],...r??[]]}}function Ev(e,t){let n=Ze("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=ur(n);if(!o)return null;for(let i of o){let s=ma(i);if(!s)return null;r.push(s)}return r}function xv(e,t){let n=Lu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ze(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ze(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function ma(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Fd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ze(e.slice(r+1),t,n)}}function Rv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return ur(t)}var _v="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",wv="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",Pv="git checkout --force discards uncommitted changes. Use 'git stash' first.",Av="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Tv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Iv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",kv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Ov="git switch --force discards uncommitted changes. Use 'git stash' first.",Mv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Nv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Dv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Lv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Wv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Gv="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Fv="git push --force destroys remote history. Use --force-with-lease for safer force push.",zv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",Bv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",$v="git branch -D force-deletes without merge check. Use -d for safe delete.",Uv="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",Hv="git merge --abort discards merge conflict resolutions. Use 'git status' first.",jv="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Vv="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Kv="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",qv="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Yv="git worktree remove --force can delete uncommitted changes. Remove --force flag.",Zv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Xv=new Set(["--recurse-submodules","--track","-t"]),fa=new Set(["-b","-B","-U"]),pa=new Set(["-c","-C"]),Jv=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var pn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Ud(e,t){let{subcommand:n,rest:r}=xe(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return yt(Qv(r,t));case"switch":return yt(tE(r));case"restore":return yt(rE(r));case"reset":return iE(r);case"clean":return yt(aE(r));case"rm":return yt(lE(r));case"push":return Bt(cE(r));case"branch":return Bt(mE(r));case"stash":return Bt(yE(r));case"worktree":return Bt(CE(r));case"rebase":return yt(fE(r));case"merge":return yt(pE(r));case"tag":return Bt(gE(r));case"reflog":return Bt(hE(r));default:return null}}function yt(e){return e?{...e,localDiscard:!0}:null}function Bt(e){return e?{...e,localDiscard:!1}:null}function Qv(e,t){let{index:n,before:r}=ie(e),o=de(r,{shortOptsWithValue:fa});if(r.some((a)=>O(a,"--force"))||o.has("-f"))return b("git.checkout-force",Pv);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(O(a,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",Tv)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return b("git.checkout-ref-path",Av);return b("git.checkout-double-dash",_v)}let i=nE(e);if(i.length>=2)return b("git.checkout-ambiguous",Iv);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>O(a,"--detach")||O(a,"--track")))return null;if(eE(s)||t(s))return b("git.checkout-double-dash",wv);return null}function eE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function tE(e){let{before:t}=ie(e);if(t.some((r)=>O(r,"--discard-changes")))return b("git.switch-discard-changes",kv);let n=de(t,{shortOptsWithValue:pa});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return b("git.switch-force",Ov);return null}function nE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(Zv.has(r)){n+=2;continue}if(Xv.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function rE(e){let t=oE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",Nv):b("git.restore-unstaged",Mv)}function oE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(Jv.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function iE(e){let t=null;for(let n of e){if(O(n,"--hard")){t=b("git.reset-hard",Dv);break}if(O(n,"--merge")){t=b("git.reset-merge",Lv);break}}if(!t)return null;return sE(e)?Bt(t):yt(t)}function sE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function aE(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return b("git.clean-force",Wv);return null}function lE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",Gv):null}function cE(e){let{before:t,after:n}=ie(e),r=de(t);if(t.some((s)=>O(s,"--mirror")))return b("git.push-mirror",Bv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||$d(t,n).some(uE))return b("git.push-force",Fv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||$d(t,n).some(dE))return b("git.push-delete",zv);return null}function $d(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function uE(e){return e.startsWith("+")||e.includes(":+")}function dE(e){return e.length>1&&e.startsWith(":")}function mE(e){let{before:t}=ie(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return b("git.branch-force-delete",$v);return null}function fE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.rebase-abort",Uv):null}function pE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.merge-abort",Hv):null}function gE(e){let{before:t}=ie(e);return de(t).has("-d")||t.some((r)=>O(r,"--delete"))?b("git.tag-delete",jv):null}function hE(e){return e[0]==="delete"?b("git.reflog-delete",Vv):null}function yE(e){for(let t of e){if(t==="drop")return b("git.stash-drop",Kv);if(t==="clear")return b("git.stash-clear",qv)}return null}function CE(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",Yv);return null}import{dirname as GE,isAbsolute as FE,join as om,resolve as zE}from"node:path";var ha="TMPDIR",ya="IFS",jd=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Vd=/^[A-Za-z_][A-Za-z0-9_]*$/,Kd=new Set(["export","typeset","declare","readonly"]),bE=new Set(["builtin","command","time"]),qd=new Set(["do","then","else"]),SE=new Set(["do","then","case"]),Hd=new Set(["done","fi","esac"]),vE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Yd(e,t){return e.map((n)=>n.provenance==="variable"&&tm(n.text)?dr(n.text,t.shellAssignments):w(n))}function dr(e,t){return e.replace(vE,(n,r,o)=>t.get(r??o??"")??n)}function Zd(e,t){return{env:e,effectiveEnvAssignments:_E(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Xd(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ca(e,t){let n=Qd(e,t),r=e[0]??"";if(SE.has(r))t.bodyDepth+=1;if(r==="elif"||Hd.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(Hd.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);ba(t,a)});let o=n.commandIndex;if(o!==-1&&Kd.has(e[o]??""))e.filter((a)=>Vd.test(a)&&ga(a)).forEach((a)=>{wE(t,a)});let i=o===-1?-1:em(e,o);if(i===-1||e[i]!=="unset")return;let s=AE(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(qd.has(r)){t.shellAssignments.set(a,"");return}PE(t,a)})}function Jd(e,t){let n=Qd(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Qd(e,t){let n=qd.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!tm(a)),o=r!==-1&&Kd.has(e[em(e,r)]??""),i=RE(t);return{assignments:e.flatMap((a,l)=>{let c=EE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!go(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function em(e,t){let n=t;while(bE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function tm(e){return Pe(e)!==null||jd.test(e)}function EE(e,t,n){return Pe(e)??xE(e,t,n)}function xE(e,t,n){let r=ho(e,n,t);if(r)return r;let o=e.match(jd)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function ga(e){return e===ha||e===ya||Us(e)}function RE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function _E(e,t){let n=[ha,ya].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ba(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function wE(e,t){ba(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function PE(e,t){if(!ga(t)&&!Vd.test(t))return;if(e.shellAssignments.set(t,""),go(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!ga(t)||t===ha||t===ya||Nn(t)){ba(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function AE(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as TE}from"node:path";function zo(e,t){return $s.some((n)=>t?.has(n)||e.has(n))}function gn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(TE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=nm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=nm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=be.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function nm(e,t,n){try{let r=mt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function rm(e,t,n){if(!t.localDiscard||!n.worktreeMode||zo(n.environment.env,n.envAssignments))return null;let r=gn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Sa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Sa(e,t,n){let{subcommand:r,rest:o}=xe(e),i=r?.toLowerCase();if(t.dynamicArguments||IE(o)||DE(e,t.environment.env,t.envAssignments,n)||ME(o)||kE(i,o))return!0;return i==="clean"&&NE(o)>1}function IE(e){return e.some((t)=>/[$*?[]/.test(t))}function kE(e,t){if(e==="checkout"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:fa}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:pa}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||OE(s))||r.has("-C");return o&&i}return!1}function OE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function ME(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function NE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function DE(e,t,n,r){if(Ze("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Fo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>WE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||LE(s.value);if(Gu(n))return!0;return r.recursiveSubmodules}function LE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function WE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function im(e,t,n){let r=e.map(w),o=n.environment.paths,i=gn(r,n.cwd,o),s=n.originalCwd?o.realpath(zE(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||zo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?$E(e,n.shellAssignments,o):sm(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!BE(a,r,t,n)||!mn(a,n.environment)||To(a,n.environment)||Io(s,a)||Io(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function BE(e,t,n,r){let o=r.environment.paths,i=om(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!Sa(t,r,s)}function $E(e,t,n){let r=xe(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?dr(a,t??new Map):a;if(!FE(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function sm(e,t){if(t.entryKind(om(e,".git"))!=="missing")return e;let n=GE(e);return n===e?null:sm(n,t)}var HE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",jE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Bo(e,t){return am(e,t)}function am(e,t,n){let r=e.map(w),o=zd(r,t.environment.env,t.envAssignments),i=o.blockedReason?A(b("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Wu(t.envAssignments)||Bd(r,t.environment.env,t.envAssignments))&&VE(s))return b("git.ssh-env",HE);let a=Ud(s,(c)=>{let u=gn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(UE(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=rm(r,a,t)??im(e,a,t);if(!l)return a;return n?.(l),null}function lm(e,t){let n=null;return{match:am(e,t,(o)=>{n=o}),relaxation:n}}function VE(e){let{subcommand:t,rest:n}=xe(e),r=t?.toLowerCase();if(!r)return!1;if(jE.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&KE(n)}function KE(e){return e.find((t)=>!qE(t))?.toLowerCase()==="update"}function qE(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as Tx}from"node:path";function cm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function $o(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var um="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",YE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ZE="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",mm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",XE="rm -rf in home directory is dangerous. Change to a project directory first.",dm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:mm},git_metadata_target:{id:"rm.git-metadata",reason:Ae},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:ZE},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:XE},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:um},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:YE},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:um}};function Uo(e,t){let n=Gt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=ze(r),i=Wd(r),s=QE(e);for(let a of s){let l=sr(a.word);if(o&&l.unsafeBraceExpansion){let c=A(ir({kind:"outside_anchored_cwd"},n,t.policy,dm),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=Ce(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return b("rm.git-metadata",Ae);if(i&&!o){let d=Ge(u,n,m);if(d.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",mm);if(d.kind==="git_metadata_target")return b("rm.git-metadata",Ae);continue}if(!o)continue;for(let d of JE(u,n,m)){let f=ir(d,n,t.policy,dm),p=A(f,t.policy);if(p)return p}}}return null}function JE(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function QE(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},$t={kind:"dynamic"},ex=new Set(["<","<<","<<-","<<<","<&","<>"]),pm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,tx=/^(?:[0-9]+|[@*])$/,nx=dt.maxWords,rx=dt.maxInputLength;function gm(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Ho(e){let t=dr(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(Vo))return $t;return{kind:"literal",source:n.map(w).join(" ")}}function yf(e){let t=dr(e[1])==="--"?2:1,n=e[t],r=dr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!Vo(n))return $t;return{kind:"literal",source:r}}function jo(e,t){let n=nR(e);if(n===-1)return Ct;let r=rR(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=iR(s,e,n,r.ifs);if(!a)return $t;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>QE||i>eR)return $t;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(aR)].filter((s)=>s!==null).join(" ")}}function Cf(e,t,n,r){if(!Se(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&XE.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return $t;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?$t:{kind:"literal",source:r}}function et(e){let t=Se(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=dr(n);return ao(n,r)?{kind:"literal",source:r}:$t}var tR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function xa(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=k(M(s));return!tR.has(a)&&!J.has(a)&&!Ft(a)}function nR(e){return Se(e.map(w)).commandIndex??-1}function rR(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(oR);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function oR(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function iR(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?va(o):sR(o,r);if(e.parameter==="*"){let a=va(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Ea(l,r)}let i=t[n+1+e.parameter];if(i&&!Vo(i))return;let s=dr(i);return e.quoted?[s]:Ea(s,r)}function va(e){return e.every(Vo)?e.map(w):void 0}function sR(e,t){let n=va(e);if(!n)return;let r=n.map((o)=>Ea(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ea(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Ho(e){let t=mr(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(Vo))return $t;return{kind:"literal",source:n.map(w).join(" ")}}function hm(e){let t=mr(e[1])==="--"?2:1,n=e[t],r=mr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!Vo(n))return $t;return{kind:"literal",source:r}}function jo(e,t){let n=ix(e);if(n===-1)return Ct;let r=sx(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=lx(s,e,n,r.ifs);if(!a)return $t;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>nx||i>rx)return $t;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(ux)].filter((s)=>s!==null).join(" ")}}function ym(e,t,n,r){if(!Se(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&ex.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return $t;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?$t:{kind:"literal",source:r}}function et(e){let t=Se(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=mr(n);return lo(n,r)?{kind:"literal",source:r}:$t}var ox=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Ra(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=k(M(s));return!ox.has(a)&&!J.has(a)&&!Ft(a)}function ix(e){return Se(e.map(w)).commandIndex??-1}function sx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(ax);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function ax(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function lx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?va(o):cx(o,r);if(e.parameter==="*"){let a=va(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Ea(l,r)}let i=t[n+1+e.parameter];if(i&&!Vo(i))return;let s=mr(i);return e.quoted?[s]:Ea(s,r)}function va(e){return e.every(Vo)?e.map(w):void 0}function cx(e,t){let n=va(e);if(!n)return;let r=n.map((o)=>Ea(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ea(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Vo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function dr(e){return e?w(e):""}function aR(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function _a(e,t){return Ra(Me(e,"posix"),t)}function mr(e){return _a(e,new Set(Array.from(e.matchAll(gf)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Ra(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Ra(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Ra(o,n))||bf(r.words,n))return!0;fR(r,n)}return!1}function bf(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(fr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return pf(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Se(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&pf(s[l],t)}let i=lR(e,n,t);if(i===null)return!1;if(i===-1)return!0;return bf(e.slice(i),t)}function lR(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return cR(e,t+1);if(r==="exec")return uR(e,t+1);if(r==="env")return dR(e,t+1,n);return null}function cR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function uR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function dR(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return fr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return fr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function fR(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(fr(n,t))t.add(r.name)}}function fr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(gf)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(JE.test(o)||t.has(o))}))}function pf(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||fr(e,t))}var mR=["--init-file","--rcfile"],pR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function tt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Sf(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Sf(e,t,!1);if(r!==null)return r}}return null}function nt(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Se(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Sf(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function vf(e){let t=k(e[0]??"").toLowerCase(),n=gR(e,t),r=pR.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function gR(e,t){let n=Se(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?mR.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let f=l.split("=",1)[0]??l;if(t==="bash"&&Yi.has(f)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Zi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var wa="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Pa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",hR="__CC_SAFETY_NET_XARGS_INPUT__",Ko="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",qo="rm",yR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,CR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,bR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,SR=/^(?:[0-9]+|[@*])$/;function xf(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Ut(n),i=n.slice(r),s=b("xargs.shell-dynamic",Pa);if(ER(i,o,t)&&A(s,t.policy))return A(s,t.policy);for(let a of Fe(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?A(s,t.policy):null;if(c)return c;let u=Tf(l,o,a.wrapperEnvAssignments),f=a.head==="rm"&&o!==null&&Pf(l,o),d=t.analyzeChild(l,{...zt(a,t),dynamicInput:u,dynamicSourceInput:f||wf(l,a.head,o,a.wrapperEnvAssignments,u,t.environment),dynamicRmInput:f,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",wa)});if(d)return d;let m=vR(l,o,t.policy?.rules??[],A(s,t.policy));if(m)return m;if(a.head==="git"){let h=o===null?[...l,hR]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...zt(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=Je(l,t.policy?.rules??[]);if(p)return p}return null}function vR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function _f(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=uf(e,r,t.length,n);return o===null?[]:[o]}function wf(e,t,n,r,o,i){if(J.has(t)){if(nt(e))return!1;if(n!==null&&RR(e,n))return!0;let s=tt(e);if(!s){let a=et(K(e));if(a.kind==="literal")return n!==null&&a.source.includes(n);return a.kind==="none"&&o}if(n!==null&&s.includes(n))return!0;if(Ye(s))return!0;return xR(s,n,r)}if(Oe(t))return Ef(e,n,mo,Mu(t));if(we.has(t))return Ef(e,n,ia,Od);if(t==="eval"){let s=Ho(K(e));if(s.kind==="dynamic")return!0;if(n!==null)return s.kind==="literal"&&s.source.includes(n);return o}if(t==="find")return _R(e,n,i);if(t==="git"){let s=Re(e);return n===null?s.subcommand===null:(s.subcommand?.includes(n)??!1)||s.subcommand!==null&&pn.has(s.subcommand.toLowerCase())&&Af(s.rest,n).some((a)=>a.includes(n))}return!1}function Ef(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Ko]).sources.some((a)=>a.value===Ko);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Ko}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Ko}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>_f(l,t,a))));return $o(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function ER(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Fe(e,n),(i)=>i.head)),o=t===null?[...e,qo]:e.map((i,s)=>s===0?i:i.replaceAll(t,qo));return Array.from(Fe(o,n)).some((i)=>i.head===qo&&!r.has(qo))}function Pf(e,t){return Af(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Af(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Tf(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function RR(e,t){let n=Se(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return _f(i,t,o).some((l)=>{let c=e.map((f,d)=>d===s?f.replaceAll(t,l):f),u=Se(c);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(n.commandIndex===null&&u.commandIndex!==null)return!0;if(n.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(c[u.commandIndex]??"").includes(l))return!0;return u.scriptIndex!==null&&(c[u.scriptIndex]??"").includes(l)})}))}function xR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(yR))if(Rf(o,r))return!0;for(let o of e.matchAll(CR))for(let i of(o[1]??"").matchAll(bR))if(Rf(i,r))return!0;return _a(e,r)}function Rf(e,t){let n=e[1]??e[2];return n!==void 0&&(SR.test(n)||t.has(n))}function _R(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Qe(s)){let l=lr(e,i);i=l.nextIndex-1;for(let c of Fe(l.tokens,{environment:n,cwd:void 0})){let u=Tf(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Pf(c.tokens,t)||wf(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=ht(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Ut(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var pr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",gr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",PR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",AR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Zo=/\{[^{}\s]*\}/g,If=/\{\}|\{-?\d+\}/g,TR=["e","f","source","file","-e","-f","--source","--file"],IR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],kR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),OR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),kf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),MR=new Set(["--workdir","--wd"]),Of="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Te(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Wf(e){return Te([...e],(t)=>Ye(t))}function Gf(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=gn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Kf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:f}=o;if(c){let p=gn(t);if(p)return p;let h=Wf(t.envAssignments?.values()??[]);if(h)return h}if(l){let p=FR(t);if(p)return p}if(u!==void 0&&a){let p=gn(t);if(p)return p}let d=zR(u,t.cwd,t.environment.paths);if(d===null){let p=gn(t);if(p)return p}let m=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(f){if([...Fe(i,m)].flatMap((h)=>[...h.envAssignments.values()]).some(Ia)){let h=gn(t);if(h)return h}return null}if(i.length===0){let p=s.map((g)=>g[0]??"");t.budget.charge("derivedTokens",p.length);let h=$f(m.envAssignments,m.cwd,a);return Te(p,(g)=>t.analyzeNested(g,h))}return Te(Fe(i,m),(p)=>NR(p,o,t,m))}function NR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(jf)){let g=gn(n);if(g)return g}let u=Wf(c);if(u)return u;let f=c.some(G),d=i||f,m=a&&d,p=$f(e.envAssignments,e.wrapperCwd,s||m);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Te(o,(E)=>n.analyzeChild(Yo(l,E,n.budget),zt(e,r)))};if(nt(l))return g();let y=tt(l);if(y){if(Vf(y)){let R=bt(n);if(R)return R;if(o.length===0)return null;return Te(o,(P)=>n.analyzeNested(Df(y,P,n.budget),p))}if(G(y)){if(o.length>0)return Te(o,(q)=>n.analyzeNested(Df(y,q,n.budget),p));let R=cr(y);if(R?.[0]&&M(R[0])==="rm"&&ze(R)){let q=Nf(n);if(q)return q}let P=R?n.analyzeChild(R,{...zt(e,r),dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",gr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",pr)}):null;if(P)return P;return n.analyzeNested(y,p)}let E=!f&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((R)=>jo(K(R===void 0?l:i?l.map((P)=>Uf(P,R)):[...l,...R]),y)):[];if(E.some((R)=>R.kind==="dynamic")){let R=bt(n);if(R)return R}let S=E.flatMap((R)=>R.kind==="literal"?[R.source]:[]);if(S.length>0)return n.budget.charge("derivedTokens",S.length),Te(S,(R)=>n.analyzeNested(R,p));if(mr(y)){let R=bt(n);if(R)return R}let T=n.analyzeNested(y,p);if(T)return T;if(d)return bt(n);return null}let v=et(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&G(v.source))return bt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=bt(n);if(E)return E;let S=g();if(S)return S;if(i)return null;let T=o.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return n.budget.charge("derivedTokens",T.length),Te(T,(R)=>n.analyzeNested(R,p))}if(d||a)return bt(n)??g();return null}if(e.head==="rm"&&ze(l)){if(i&&o.length>0)return Te(o,(y)=>Aa(Yo(l,y,n.budget,If),e.cwd,r));if(o.length>0)return Te(o,(y)=>Aa(Lf(l,y,n.budget),e.cwd,r));let g=Aa(l.flatMap((y,v)=>{if(v===0||!G(y))return[y];return y.startsWith("-")?[y.replace(If,"")]:[]}),e.cwd,r);if(g)return g;return Nf(n)}let h=o.length>0?o:[void 0];return Te(h,(g)=>{let y=g===void 0?l:i?Yo(l,g,n.budget):Lf(l,g,n.budget),v=b("parallel.shell-dynamic",gr),E=a&&e.head==="find"?GR(y,r):null,S=zf(y,a,n)??E?.customResult??null,T=M(e.head),R=a&&(T==="rm"&&Ta(y)||T==="xargs"&&Bf(y)||E?.rmOptions===!0),P=a&&(R||E?.executedSource===!0||E===null&&Ff(y,T)),q=n.analyzeChild(y,{...zt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:R,dynamicSourceInput:S!==null||P,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",pr)});if(P){let Z=A(v,n.policy);if(Z)return Z}return q??S??Je(y,n.policy?.rules??[])})}function Ff(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return WR(e);if(t==="git")return DR(e);if(t==="find")return!0;if(we.has(t))return Mf(e,TR,ar);if(Oe(t))return Mf(e,IR,fo);return!1}function Ta(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||Vf(o)))}function DR(e){if(LR(e))return!0;let t=Re(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!pn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function LR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function WR(e){if(nt(e))return!1;let t=tt(e);if(t!==null)return G(t);let n=et(K(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function Mf(e,t,n){let r=n(e);if(r.some((o)=>G(o.value)))return!0;if(!e.some(G))return n([...e,Of]).some((o)=>o.value===Of);return $o(r,t,(o)=>n(e.map((i)=>Uf(i,[o]))))}function zf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(G))return bt(n);return Te(o,(i)=>Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function GR(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of Fe(i,t))n.executedSource||=Ff(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ta(a.tokens)||a.head==="xargs"&&Bf(a.tokens),n.customResult??=zf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Qe(a)){i=[],n.executedSource||=G(a);continue}let l=ht(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function Bf(e){let t=e.slice(Ut(e).childStart);return M(t[0]??"")==="rm"&&Ta(t)}function Xo(e,t){return(n)=>A(b(e,t),n.policy)}var bt=Xo("parallel.shell-dynamic",gr),FR=Xo("parallel.command-stream-dynamic",PR),gn=Xo("parallel.command-stream-dynamic",AR),Nf=Xo("parallel.rm-recursive-force-dynamic",pr);function Aa(e,t,n){return A(Uo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Lt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function $f(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Uf(e,t){return e.replace(Zo,(n)=>Hf(n,t))}function Yo(e,t,n,r=Zo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Hf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Df(e,t,n){return Yo([e],t,n)[0]??""}function Lf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Hf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function G(e){return e.search(Zo)!==-1}function jf(e){if(Ia(e))return!0;for(let t of e.matchAll(Zo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Ia(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Vf(e){return/^\{[^{}\s]*\}$/.test(e)}function zR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!wR(e))return null;try{return ft(t??e,e,n)}catch{return null}}function Kf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=la(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=la(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||OR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(kf.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=kf.has(p)?2:1;continue}if(MR.has(y)){c=!0;let E=v??h;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(kR.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Ia:jf);let u=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){u.push(p),p=[];continue}if(g!==void 0)p.push(g)}u.push(p)}c||=u.length>1;let f=BR(u),d=n.some(G),m=n.length===0&&o===-1;return{template:n,jobs:f,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:m,unsupported:c,workdir:a,dryRun:l}}function BR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function qf(e){return Kf(e).childStart}var $R="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Jo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Oa(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function ka(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Zf(e,t,n,r,o=!1,i){let a=(zn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",$R):null;return A(a,i)??Xf(e,t,n,o,i)}function Xf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Oa(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=sn(e,t),l=HR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((f)=>f<=l))return A(b("shell.dynamic-structure",Jo),o);if(A(Bo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((f,d)=>d>l&&w(f)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&pn.has(c)&&i.some((f)=>f>l&&(u===-1||f<u)))return A(b("shell.dynamic-structure",Jo),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&jR(t)?A(b("shell.dynamic-structure",Jo),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=ze(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?A(b("shell.dynamic-structure",Jo),o):null}if(s==="xargs")return Yf(e,t.slice(Ut(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return Yf(e,t.slice(qf(t.map(w))),"parallel",n,r,o);return null}function Yf(e,t,n,r,o,i){if(t.length===0)return null;let s=UR(t,r);if(zn(e,s)){let l=A(b(`${n}.shell-dynamic`,n==="xargs"?Pa:gr),i);if(l)return l}let a=Xf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Oa(l)&&ka(l)))return A(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?wa:pr),i);return null}function UR(e,t){let n=Ot(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function HR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(be.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function jR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Oa(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||ka(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||ka(s)))return!0;continue}if(t=!0,a)return!0;let l=ht(s.text);if(l>0){n=l;continue}if(Qe(s.text))o=!0,r=!0}return!1}function Ma(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!ao(t[n.tokenIndex],n.value)})}var VR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",KR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",qR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Jf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",VR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",KR);if(e==="shred"&&n.length>0)return b("shred.target",qR);return null}var em=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Uo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Bo(e.words,Na(e))},{heads:new Set(["find"]),analyze:(e)=>Gd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>xf(e.words,{...Qf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Gf(e.words,{...Qf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})}];function Qf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ht(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Na(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var om="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function im(e){return em.find((t)=>t.heads.has(e))?.analyze}function yn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,f=s?s.originalCwd:c?void 0:n.cwd,d=ho(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let m=Ot(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=m.envSplitValues??[];if(p.length>0){let x=[...p,...i(m.words)].join(" "),I=Ye(x);if(I)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:I.reason}),ue(I);if(n.strict)return he(r);let L=yo(p,i(m.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:m.cwd===void 0?n.effectiveCwd:m.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...m.envAssignments])});if(te)return te}}let h=m.rewritten?K(i(m.words)):sn(o,m.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>h.length){let x=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...d.envAssignments,...m.envAssignments]),E=g[0];if(!E)return null;if(Ft(E))throw new N("wrapperPeelIterations");let S=M(E),T=m.cwd===null?void 0:m.cwd??u,R=m.cwd===null?void 0:f,P=m.cwd===void 0?n.effectiveCwd:m.cwd,q=s?s.allowTmpdirVar:!rr(v,n.environment),Z=Zf(o,m.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),ue(Z);let ee=No(g,n.policy);if(ee){for(let x of[ee.childIndex,...ee.alternativeChildIndices]){tm(y.wrapperNormalizationBudget);let I=h.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=yn(I,t,{...y,effectiveCwd:P,envAssignments:v});if(L)return L}return null}let X=l?void 0:S==="eval"?Ho(h):S==="trap"&&!a?yf(h):void 0;if(a&&s&&S==="eval"){if(X?.kind==="dynamic")return hn(s,n.policy);if(X?.kind==="literal"){let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v});if(x)return x}return Cn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!xa(n.commandView)))return he(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:S==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?J.has(S):am(E,S)){if(nt(g))return null;if(a&&s){let x=tt(g);if(x){if(s.dynamicSourceInput??s.dynamicInput){let L=hn(s,n.policy);if(L)return L}if(mr(x)){let L=hn(s,n.policy);if(L)return L}return n.analyzeNested(x,{effectiveCwd:P,envAssignments:v})}let I=et(h);if(I.kind==="dynamic")return hn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?hn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?hn(s,n.policy):null}if(l){let x=tt(g),I=x?n.analyzeNested(x,{effectiveCwd:P,envAssignments:v}):et(h).kind==="dynamic"?he(r):null;if(I)return I}if(s===void 0){let x=JR(g,v,P,n,r,t);if(x)return x;let I=tt(g);if(I){let qt=jo(h,I);if(qt.kind==="dynamic")return he(r);let hi=qt.kind==="literal"?qt.source:I,il=QR(hi);r?.recordSegment({type:"shell-wrapper",wrapper:S,innerCommand:il}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:il,depth:t+1});let sl=n.analyzeNested(hi,{effectiveCwd:P,envAssignments:v});if(sl)return sl;return mr(hi)?he(r):null}let L=et(h);if(L.kind==="dynamic")return he(r);if(L.kind==="literal")return Qo(L.source,P,v,n,r,t);let te=Cf(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return he(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:P,envAssignments:v})}}if(!s&&(S==="source"||S===".")){let x=g[1]==="-p"?2:null;if(x!==null){let qt=n.commandView?h[x]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return he(r)}let I=x===null?1:3,L=g[I]==="--"?I+1:I,te=n.commandView?h[L]:void 0;if(!te)return null;if(te.provenance==="literal")return Qo(te.text,P,v,n,r,t);if(n.strict||!n.commandView||!xa(n.commandView))return he(r)}if(we.has(S)&&!l){if(!s&&n.strict&&Ma(ar(g),h))return he(r);let x=Md(g,(L)=>Ht(n.analyzeNested(L,{effectiveCwd:P,envAssignments:v}))),I=A(x,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),ue(I)}if(Oe(S)&&!l){if(!s&&n.strict&&Ma(fo(g),h))return he(r);let x=Ou(g);if(a&&s)return ZR(S,x,P,v,n,s);if(x){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:S,codeArg:x,paranoidBlocked:I}),I){let te=A(b("interpreter.one-liner-paranoid",qn),n.policy);if(te)return ue(te)}if(zs(S,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let L=n.analyzeNested(x,{effectiveCwd:P,envAssignments:v});if(L&&!sm(L,x))return L;if(Yn(x)){let te=A(b("interpreter.dangerous-command",cn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:cn}),ue(te)}r=void 0}}if(S==="busybox"&&g.length>1)return tm(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),yn(h.slice(1),t,{...y,effectiveCwd:P,envAssignments:v});let D=s?null:A(Jf(S,g),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),ue(D);let ce=r===y.trace?y:{...y,trace:r},_e={words:h,head:S,cwd:T,originalCwd:R,envAssignments:v,allowTmpdirVar:q,dynamicArguments:m.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:P,options:ce,analyzeChildTokens:(x,I)=>a&&s?Da(x,t,ce,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ht(yn(K(x),t+1,{...ce,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:v}))??Je(x,ce.policy.rules),analyzeChild:(x,I)=>Da(x,t,ce,I)},je=s&&(S==="xargs"||S==="parallel")?void 0:im(S);if(S==="rm"||S==="xargs"||S==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let Ie=r&&S==="git"?cf(_e.words,Na(_e)):void 0,pi=nm(Ie?Ie.match:je?.(_e)??null,n.policy);if(r)ex(_e,pi,Ie?.relaxation??null);if(pi)return ue(pi);if(a&&s&&(S==="rm"||S==="rmdir")){if(!(S==="rm"&&(ze(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Cn(s,n.policy):null)??XR(s,n.policy)}let rl=je!==void 0,ol=!s&&!rl&&!Dr.has(S),gi=r&&ol?[]:void 0;if(ol)for(let x=1;x<g.length;x++){let I=g[x];if(!I)continue;gi?.push(I);let L=nm(YR(g,x,t,ce,T,R,P,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[],embeddedCommandFound:M(I)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&rl)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let Rr=Je(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Rr,reason:Rr?.reason}),Rr)return ue(Rr);return a&&s?Cn(s,n.policy):null}function Da(e,t,n,r){return Ht(yn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function YR(e,t,n,r,o,i,s,a){for(let l of Fe(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=M(c);if(am(c,u)||im(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=Da(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!rr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function ZR(e,t,n,r,o,i){if(!t)return Cn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=A(b("interpreter.one-liner-paranoid",qn),o.policy);if(a)return ue(a)}if(zs(e,t))return Cn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!sm(s,t))return s;if(Yn(t)){let a=A(b("interpreter.dangerous-command",cn),o.policy);if(a)return ue(a)}return Cn(i,o.policy)}function sm(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(ko)||e.reason===mn)&&!Lr(t)}function hn(e,t){let n=e.shellDynamicMatch?A(e.shellDynamicMatch,t):null;return n?ue(n):null}function Cn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?A(e.dynamicSourceMatch,t):null;return n?ue(n):null}function XR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?A(e.rmDynamicMatch,t):null;return n?ue(n):null}function JR(e,t,n,r,o,i){let s=vf(e);if(s.argvSource?.kind==="absent")return he(o);if(s.argvSourceApplies&&s.argvSource){let l=Qo(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Qo(a,n,t,r,o,i,!0)}function Qo(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return he(o);let a=Kn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?he(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function QR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function ex(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function tm(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function he(e){return e?.recordSegment({type:"error",message:om}),ue(tx())}function tx(){return{id:"",reason:om,intent:"stop_and_explain"}}function am(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function nm(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:A(e,t)}var nx=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,rx=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function ox(e,t){let n=um(e,t);if(n.length===0)return!1;let r=n[cm(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return nx.test(e.join(" "))}function lm(e,t,n,r,o){if(e.dialect==="powershell"){let g=sx(e.words,o);if(g.kind==="none")return;if(!t||g.kind==="unknown")return null;return rm(ux(g.target),t,n.paths)}let i=e.words.map(w),s=i.some((g)=>/^CDPATH\+?=/.test(g));if(!ox(i,n))return s?null:void 0;if(!t)return null;let a=um(i,n,t),l=cm(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((g)=>g.length<=1||!g.startsWith("-")||g==="--");if((u===-1?c:c.slice(0,u)).some((g)=>!/^-[LP]+$/.test(g)))return null;let d=u===-1?[]:c.slice(u),m=d[0]==="--"?d.slice(1):d;if(m.length!==1)return null;let p=m[0]??"",h=e.words.some((g)=>g.provenance==="variable"&&g.text===p)?ix(p,r):p;if(h===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(h)&&(s||n.env.has("CDPATH")))return null;return rm(h,t,n.paths)}function ix(e,t){let n=ur(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function rm(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return ft(t,e,n)}catch{return null}}function sx(e,t){let n=ax(e[0])?1:0,r=e[n];if(!lx(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!rx.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return cx(e.slice(n+1),t)}function ax(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function lx(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function cx(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function ux(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function cm(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function um(e,t,n){let r=dx(e);return mt([...r],t,n)}function dx(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var fx="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",jt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function za(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Me(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Fa(e,n);let u=`${ko}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return hm(e,n),{reason:mn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return hm(e,n),{reason:mn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Fa(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Zd(n.environment.env,n.envAssignments);return ni(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ni(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],f=u?.kind==="connector"?u.operator:void 0,d=mx(e,l,c,a,f),m=a==="&&"||a==="||",p=m?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=m||Sn(f);if(c.kind==="function"){let Z=h.flatMap((X)=>{let U=vn(X);return U.functionDefinitions.set(c.name,c.body),La(X,[U],d,f==="&",Sn(f))}),ee=Wa(Z,[],g,y,a,f);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of h){let D=ni(c.body,t,n,r,[vn(U)]);if(D.result)return D;if(Z.push(...La(U,D.states,d,f==="&",Sn(f))),v)ee.push(U,...d?D.states.map((ce)=>ei(U,ce)):D.states)}let X=Wa(Z,ee,g,y,a,f);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),S=e.nodes[l-2],T=ri(a)&&S?.kind==="command"?hf(S)??gx(S):void 0,R=[],P=[];for(let Z of h){let ee=hx(c,t,n,r,[vn(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ei(Z,U));for(let U of X){let D=vn(U),ce=bx(c,t,n.trace?{...n,trace:ym(n.trace,E)}:n,r,D,ri(a),T);if(ce)return{result:ce,states:i};let _e=Dx(c,D.functionDefinitions);if(_e)n.budget.charge("derivedTokens",oi(_e));let je=_e?t+1>=V.recursionDepth.cap?Ga(c.displayText,n,[D]):ni(_e,t+1,n,r,[D]):{result:null,states:Mx(c,D)};if(je.result)return je;if(R.push(...La(Z,je.states,d,f==="&",Sn(f))),v)P.push(Z),P.push(...je.states.map((Ie)=>d?ei(Z,Ie):Ie))}}let q=Wa(R,P,g,y,a,f);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function mx(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ri(r)||ri(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&px(e,t)}function La(e,t,n,r,o){let i=n?t.map((a)=>ei(e,a)):[...t],s=o?i.flatMap((a)=>bn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ei(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function px(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(yx(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ri(e){return e==="|"||e==="|&"}function gx(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Sn(e){return e==="&&"||e==="||"}function Wa(e,t,n,r,o,i){let s={success:ti([...n,...e]),failure:ti([...r,...t])},a=Sn(i)?s:void 0;return{states:Sn(o)||a?ti([...s.success,...s.failure]):s.success,conditionalStates:a}}function ym(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function hx(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=Cx(e);if(s){if(t+1>=V.recursionDepth.cap)return Ga(s,n,o);let a=Me(s,"powershell");if(a.status==="limited")return Ga(s,n,o);if(a.status!=="complete")return dm(i,n,r,o);n.budget.charge("derivedTokens",oi(a)),i.push({program:a,depth:t+1})}}return dm(i,n,r,o)}function yx(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function dm(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ni(i.program,i.depth,t,n,[vn(a)]);if(l.result)return l;s.push(...l.states)}o=ti(s)}return{result:null,states:o}}function Cx(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function oi(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+oi(o),0):n.kind==="group"||n.kind==="function"?oi(n.body):0),0)}function Ga(e,t,n){return t.trace?.recordSegment({type:"error",message:$e}),{result:{reason:$e,segment:e,intent:"stop_and_explain"},states:[...n]}}function bx(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=wx(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Cm(e,o,"before-consumer",a.environment.paths,a.budget);let c=sn(e.dialect,e.words),u=c.map(w),f=e.displayText,d=Yd(c,o.shellGitContextState),m=Jd(d,o.shellGitContextState);if(e.dialect==="powershell"){let g=A(_d(e,i,Wx(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!g,reason:g?.reason}),g)return Lx(f,g)}if(u.length===1&&u[0]?.includes(" ")&&!zn(e.dialect,e.words)){let g=A(Ye(u[0]),a.policy),y=g!==null&&!a.strict&&Pu(e,a.rootProgram);if(g&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:g.reason}),{reason:g.reason,segment:f,ruleId:g.id,intent:g.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let v=fm(e,l,o,m,s,a);if(v)return v;return Ca(d,o.shellGitContextState),null}let p=yn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:m,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(g,y)=>{let v=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=za(g,t+1,{...a,effectiveCwd:v,envAssignments:y?.envAssignments??m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?ym(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:f};let h=fm(e,l,o,m,s,a);if(h)return h;return Ca(d,o.shellGitContextState),null}function fm(e,t,n,r,o,i){let s=Px(e,t,n,r??new Map,i);if(s)return s;return Cm(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),Ex(e,t,n,i.environment.paths,i.budget),Ix(e,n,o,i.environment,i.trace),null}var Sx=new Set([">>","<>"]);function Cm(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?vx(s):Sx.has(s.operator)))continue;mm(s.target,t,r,o)}if(n!=="before-consumer"||!xe(e.words[0],"tee"))return;let i=bm(e.words.slice(1));if(!i)return;for(let s of i.operands)mm(s,t,r,o)}function vx(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function mm(e,t,n,r){let o=e?.provenance==="literal"?Kn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function Ex(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!ii(i))return;for(let s of Rx(e)){let a=Kn(s.text,n.effectiveCwd,r,o);if(!a||!Iu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function Rx(e){let t=_x(e.redirections)?.target,n=pm(t)?[t]:[];if(xe(e.words[0],"cat"))return xx(e.words)?n:[];if(!xe(e.words[0],"tee"))return[];let r=bm(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(pm))return[];return[...r.operands,...n]}function xx(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function _x(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function bm(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&xe(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function pm(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function xe(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function ii(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function wx(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return jt;let n=t[0];if(!n?.heredoc)return jt;if(!ii(n.heredoc))return fx;if(n.fd!==void 0&&n.fd!==0)return jt;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return jt;let r=e.redirections.some((s)=>s!==n&&gm(s.target));if(xe(e.words[0],"cat"))return r?jt:void 0;if(xe(e.words[0],"tee"))return r||e.words.slice(1).some(gm)?jt:void 0;let o=e.words[0],i=e.words[1];if(xe(o,"git")&&(xe(i,"apply")||xe(i,"commit")))return;if(xe(o,"gh")&&(xe(i,"pr")||xe(i,"issue"))&&xe(e.words[2],"create"))return;return jt}function gm(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function Px(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(Tx(e,i,n,r,o))return null;let a=Ax(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Fa(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function Ax(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!ii(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Oe(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=A(b("interpreter.one-liner-paranoid",qn),n.policy);if(c)return c}if(!Yn(s))return null;let l=A(b("interpreter.dangerous-command",cn),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function Tx(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!ii(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Ot(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return nt(a)}function Ix(e,t,n,r,o){let i=lm(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var kx=/^[A-Za-z_][A-Za-z0-9_]*$/,Ox=8;function Mx(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!kx.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=Ox&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=vn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function vn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Xd(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ti(e){let t=[];for(let n of e){if(!t.some((r)=>Nx(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function Nx(e,t){return e.effectiveCwd===t.effectiveCwd&&bn(e.shellGitContextState.env,t.shellGitContextState.env)&&bn(e.literalHeredocFiles,t.literalHeredocFiles)&&bn(e.functionDefinitions,t.functionDefinitions)&&bn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&bn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function bn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function Dx(e,t){let n=Bn(e);return n===void 0?void 0:t.get(n)}function Lx(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function Wx(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Fa(e,t){let n=A(Ye(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function hm(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:mn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var Gx=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Sm(e,t,n,r){let o=za(e,0,{...t,...Yc(t),budget:t.budget??ye(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function vm(e,t,n){try{return{decision:e()}}catch(r){let o=Fx(r,t,n);if(!o)throw r;return o}}function Fx(e,t,n){if(!(e instanceof N)||!Gx.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var zx=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),$a=new Set(["cc-safety-net","ccsn"]),Bx=new Set(["bunx","npx","pnpx"]),$x=new Set(["pnpm","yarn"]),Ux=new Set(["npm","pnpm","yarn"]),Hx=new Set(["bun","node"]);function ai(e,t,n={}){if($a.has(e))return 0;if(Bx.has(e)){if(n.broad)return Ba(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return si(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&Ux.has(e)&&n.broad&&t[r]==="exec"){let o=Ba(t.slice(r+1));return o===null?null:r+1+o}if($x.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&si(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ba(t.slice(r+1));return o===null?null:r+1+o}if(Hx.has(e)){let o=n.broad&&r!==-1?r:0;if(Em(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Em(t[o+1]))return o+2}return null}function Ba(e){let t=e.findIndex((r)=>si(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!si(r))break;n++}return n}function si(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return $a.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return $a.has(e.slice(0,t))}function Em(e){let t=e?.replaceAll("\\","/");return[...zx].some((n)=>t===n||t?.endsWith(`/${n}`))}var Rm="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function xm(e,t,n){let r=pe(e,"input-candidate");if(!r)return null;let o=dn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>jx(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function jx(e,t){let n=mt([...e],t),r=n.slice(1),o=ai(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as li}from"node:path";var Am="This path contains the protected policy config and you must not modify or delete it.",Vx=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Tm(e,t,n){let r=Jx(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return _m(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=pe(e,"input-candidate");if(e.invocation.route.kind==="command")return o?wm(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=wm(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return _m(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||wr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function _m(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>hr(a,n,r,o,i));return s?{target:s}:null}function wm(e,t,n,r,o){let i=dn(e,t,r,o,{findSegmentTarget:(s,a)=>Kx(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>hr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>Xx(s,t,n,r,o)?.target??null});return i?{target:i}:null}function Kx(e,t,n,r,o){if(er(e))return null;let i=Mt([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&qx(a)){let l=Yx(a).find((c)=>Pm(me(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Wo(i,1)||ua(i,r)){let c=(Lo(K(i))??K(["."])).find((u)=>{let f=me(u.text,t.variables);return hr(f,t.cwd,n,r,o)||Pm(f,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Ro(a).sources.find((c)=>Qx(me(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(Zx(i,s))return null;for(let l of[...e,...i])for(let c of Im(l))if(hr(me(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function qx(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function Yx(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function Zx(e,t){if(!Vx.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function Xx(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Im(i))if(hr(s,t,n,r,o))return{target:s};return null}function Im(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function Jx(e,t,n){let r=(a)=>yr(se(a,e.executionCwd,t,n)),o=r(Qt(t)),i=[r(Dn(e.executionCwd)),r(Dn(e.configCwd))],s=new Set(i.map((a)=>li(a)));for(let a=li(o);;a=li(a))if(s.add(a),li(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function hr(e,t,n,r,o){let i=gl(e,t,r,o,(s)=>yr(s)===Mr);return i!==null&&n.files.has(yr(i))}function Pm(e,t,n,r,o){return n.directoriesAndAncestors.has(yr(se(e,t,r,o)))}function Qx(e,t,n,r,o){let i=yr(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function yr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ci,posix as e_,resolve as di,win32 as t_}from"node:path";import{fileURLToPath as n_}from"node:url";var zm="Access to a sensitive path is not allowed.",Bm=new Set(["echo","printf"]),r_=new Set(["find"]),o_=new Set(["-exec","-execdir"]),i_=new Set([";","+"]),s_=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),a_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),$m=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),l_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),c_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Um=new Set(["-c","-e","-r","-E","--eval","--exec"]),u_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),d_=new Set(["grep","rg"]),km=new Set(["jq","gojq","jaq"]),Om="f",Mm="file",f_="files",m_=new Set(["e","f"]),p_=new Set(["regexp","file"]),g_=new Set(["e","f","A","B","C","m"]),h_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Ua="__CC_SAFETY_NET_PIPE_INPUT__",ja=/[\w./~@+-]*[./~][\w./~@+-]*/g,y_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,C_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,b_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,S_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,v_=/\b(?:system|exec)\s*$/,E_=/\b(?:eval|exec)\s*\(/g,R_=/\b(?:eval|exec)\s*$/,x_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Nm(e,t,n,r,o,i){for(let s of e){let a=s.target;if(Ew(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=Sw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&Rw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Hm(e,t,n,r,o={}){let i=Dm(e,n,r),s=Nm(i,t,e.invocation.context.configCwd,n,r);if(s===null)return null;let a=s.ruleId!=="secret.deny-path"&&o.strict===!1?Dm(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:Nm(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&__(e,n))return null;return l}function __(e,t){let n=pe(e,"input-candidate")??pe(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of Eo(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(Xe(a.text,t))}let o=St(r);if(o.length===0)return!1;let i=it(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>s_.has(a))}function Dm(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=pe(e,"input-candidate");return[...s?En(s.shell,e.store,r,t,o,n,w_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function w_(e){return e.program.dialect==="powershell"}function En(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new We;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...nw(Xe(e.source,r),t,n,r,o,i)],l=(c)=>Xe(W_(c,s),r);return vo(e,o,r,i,{word:l,segment:(c,u,f,d,m)=>{if(c.length===0)return null;if(a.push(...fi(c,t,n,r,u.cwd,i,m)),f!==null)a.push(...A_(f,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...jm(c.consumer,[c.body],t,n,r,u.cwd,i,(f)=>T_(c.consumer??[],f,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return Ks;return a.push({target:l(c.target),cwd:u.cwd}),null}}),a}function Va(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new We;return s.status==="complete"?En(s,t,n,r,o,i):null}function fi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(km.has(it(St(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...fi(p,t,n,r,o,i)]}let l=L_(e).map(a),c=St(e);if(c.length===0)return l;let u=c[0]??"",f=it(u).toLowerCase(),d=c.slice(1),m=P_(u,f,d);if(m)return[...l,...m.map(a)];if(Bm.has(f))return n.capturedOutput===!0?[...l,...Vm(e).map(a)]:l;if(f==="eval")return[...l,...Va(d.join(" "),t,n,r,o,i)??d.map(a)];if(f==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:ot(f,p)).map(a)];if(f==="git")return[...l,...F_(d).map(a)];if(km.has(f))return[...l,...G_(d).map(a)];if(d_.has(f))return[...l,...uw(d).map(a)];if(r_.has(f))return[...l,...U_(d,t,n,r,o,i).map(a)];if(we.has(f))return[...l,...d.flatMap((p)=>ot("awk",p)).map(a),...d.flatMap((p)=>j_(p,t,n,r,o,i)),...d.flatMap(V_).map(a)];if(f==="curl")return[...l,...d.flatMap((p)=>ot(f,p)).map(a),...z_(d).map(a)];if(tr(f)){let p=Qn.has(f)?Se([f,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new We;if(h.status==="complete")return[...l,...En(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...H_(f,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>ot(f,p)).map(a)]}function P_(e,t,n){let r=ai(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function A_(e,t,n,r,o,i,s){if(M_(t,n,r,o,i,s))return Vm(e).map((a)=>({target:a,cwd:i}));return jm(t,I_(e),n,r,o,i,s,()=>[])}function T_(e,t,n,r,o,i,s){let a=St(e);if(!tr(it(a[0]??"").toLowerCase()))return[];return Va(t,n,r,o,i,s)??[{target:t,cwd:i}]}function jm(e,t,n,r,o,i,s,a){let l=N_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>Qn.has(l)?En(n.getShellSyntax(c),n,r,o,i,s):ui(l,c,n,r,o,i,s))}function Vm(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase();if(!Bm.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Ka(r.replaceAll("%%","%"))];return t.slice(1)}function I_(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return k_(r);return[]}function k_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ka(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>O_(t,r.slice(i*n,(i+1)*n)))}function O_(e,t){let n=0;return Ka(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ka(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function M_(e,t,n,r,o,i){let s=St(e);if(s.length===0||it(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Ut(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Ua]:l.map((f)=>f.split(c).join(Ua));return fi(u,t,n,r,o,i).some((f)=>f.target.includes(Ua))}function N_(e){let t=St(e);if(t.length===0)return null;let n=it(t[0]??"").toLowerCase();if(!tr(n))return null;return D_(n,t.slice(1))?n:null}function D_(e,t){let n=qa(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Um.has(o)||Km(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(x_.get(n)?.has(o))r++;continue}return!1}return!0}function qa(e){return/^python\d/.test(e)?"python":e}function L_(e){let t=[];for(let n of e){if(Ym(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Lm=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function W_(e,t){if(!t||!Lm.test(e))return e;return`~${e.replace(Lm,"").replace(/\\/g,"/")}`}function ot(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function G_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>ot("jq",i))}return e.flatMap((r,o)=>o===t?[]:ot("jq",r))}function F_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>ot("git",i))];if(t.push(...ot("git",r)),!be.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:ot("git",o)),n++}return t}function z_(e){return e.flatMap((t,n)=>{let r=$_(t);if(r!==null)return Wm(r.flag,r.value);let o=B_(e[n-1]);return o===null?[]:Wm(o,t)})}function Wm(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ha(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ha(t.slice(n+1))}return t.startsWith("@")?Ha(t.slice(1)):[]}function B_(e){if(e===void 0)return null;if($m.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function $_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return $m.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ha(e){return e===""||e==="-"?[]:[e]}function U_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!o_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((m)=>i_.has(m)),f=u===-1?c:c.slice(0,u),d=fi(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...d.filter((m)=>m!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,h)=>{if(!a_.has(m))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function H_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Um.has(c)||Km(e,c)){let f=t[l+1];if(f!==void 0)a.push(...ui(e,f,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...ui(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Km(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return u_.get(t[t.length-1]??"")?.has(qa(e))??!1}function j_(e,t,n,r,o,i){if(!e.includes("system"))return[];return sa(e)?.commands.flatMap((s)=>En(t.getShellSyntax(s),t,n,r,o,i))??[]}function V_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function K_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Ya),...e.match(ja)??[]]}function ui(e,t,n,r,o,i,s){let a=(m)=>({target:m,cwd:i}),l=Y_(t,q_(e));if(l===null)return K_(t).map(a);let c=l.masked.match(S_)!==null||l.literals.some((m)=>v_.test(l.masked.slice(0,m.start))),u=l.masked.match(E_)!==null||l.literals.some((m)=>R_.test(l.masked.slice(0,m.start))),f=r.refineInlineData===!0&&!Qn.has(e),d=f&&!(Q_(l.masked)||c||u)?[]:l.literals;return[...d.map((m)=>m.text).filter((m)=>m!=="").map(a),...d.flatMap((m)=>Ya(m.text)).map(a),...f?[]:l.literals.flatMap((m)=>m.text.match(ja)??[]).map(a),...c?l.literals.flatMap((m)=>Va(m.text,n,r,o,i,s)??[a(m.text)]):[],...u?l.literals.flatMap((m)=>ui(e,m.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
-`:h),n,r,o,i,s)):[],...(l.masked.match(ja)??[]).map(a)]}function q_(e){let t=qa(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function Y_(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(C_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&J_(e,o))return null;let a=t==="python"?Z_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=X_(e,c,l);if(u===null)return null;let f=e.slice(c,u);if(/[fF]/.test(a)&&f.includes("{"))return null;if(t==="simple"&&s==='"'&&b_.test(f))return null;r.push({start:c,text:f});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function Z_(e,t){return y_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function X_(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function J_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Q_(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(l_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>c_.has(i)))continue;if(o.length>1)return!0;if(ew(e,r)===".")return!0;if(tw(e,r+n.length)==="(")return!0}return!1}function ew(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function tw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function nw(e,t,n,r,o,i){return aw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...En(a,t,{...n,capturedOutput:!0},r,o,i),...rw(a,r)?ow(a,r).map((l)=>({target:l,cwd:o})):[]]})}function rw(e,t){let n=Eo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||it(Xe(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Xe(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function ow(e,t){return Eo(e).flatMap((n)=>n.kind==="word"?[Xe(n.text,t)]:n.kind==="redirection"&&n.target?[Xe(n.target,t)]:[]).flatMap(Ya)}function Ya(e){let t=sw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||iw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function iw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function sw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function aw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Ln(o,n))continue;if(qm(e,r,n)){let i=lw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=cw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function lw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Ln(i,n))continue;if(qm(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function cw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function qm(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function uw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let f=u[1]??"",d=u[2];if(f===f_)o=!0;if(p_.has(f))r=!0;if(d!==void 0){if(f===Mm)t.push(d);continue}if(h_.has(f)){let m=e[l+1];if(f===Mm&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),d="",m="";for(let h=0;h<f.length;h++){let g=f[h]??"";if(m_.has(g))r=!0;if(g_.has(g)){d=g,m=f.slice(h+1);break}}if(d==="")continue;if(m.length>0){if(d===Om)t.push(m);continue}let p=e[l+1];if(d===Om&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function St(e){let t=e.findIndex((n)=>!Ym(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Ym(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var dw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),fw=".env.",mw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),pw=[".env.example.",".env.sample."];function gw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function hw(e){return e.length>0&&!/\s/.test(e)}function yw(e,t,n,r){try{let o=Sr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof N)throw o;return!1}}var Cw=new Set(["node_modules","__pycache__"]),bw=[["vendor","bundle"],["vendor","cache"]];function Sw(e,t,n,r,o){if(gw(e))return null;let i=He(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>hw(s)||yw(e,t,r,o);if(mw.has(s)||pw.some((d)=>s.startsWith(d)))return null;let c=B(ww(e,t,r,o));for(let d of is){let m=`~/${d.suffixParts.join("/")}`;if((Fm(a,m)||Fm(c,m))&&rt(d.id,n))return d.id}let u=vw(i,t,n,r,o);if(u)return u;if(dw.has(s))return null;for(let d of os)if(s===d.basename&&rt(d.id,n))return d.id;if(s.startsWith(fw)&&rt(zr.id,n)&&l())return zr.id;for(let d of ss)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let m=s.slice(d.prefix.length)[0];if((m==="-"||m==="_")&&rt(d.id,n)&&l())return d.id}for(let d of as)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&rt(d.id,n))return d.id}if(xw(a))return null;if(!s.includes(".")&&Wn.pattern.test(s)&&rt(Wn.id,n))return Wn.id;let f=_w(s,n);if(f)return f;return null}function vw(e,t,n,r,o){return Br.find((i)=>{if(!rt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||br(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,He("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Cr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?br(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,He(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Cr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Cr(e,s,["credentials"])||Cr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>br(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?z(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?br(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,He(u,t,r,o),l))}case"secret.cli.pi":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=He("~",t,r,o);return[le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),le(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Cr(e,le(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),le(He("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?br(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=le(z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,He("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&Vt(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,He("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Gm=new WeakMap;function z(e,t,n,r,o){let i=Gm.get(o)??new Map;Gm.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=He(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>Zm(e,le(t,r)))}function Cr(e,t,n){return n.some((r)=>Vt(B(e),B(le(t,r))))}function br(e,t,n,r,o){return Zm(e,He(t,n,r,o))}function Zm(e,t){return B(e)===B(t)}function le(e,...t){return Be([e,...t].filter(Boolean).join("/"))}function Ew(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Sr(e,t,o,i));return n.some((a)=>Vt(s,B(Sr(a,r,o,i))))}function Rw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Sr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Be(F(Ce(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),f=B(u?Be(F(di(Ce(u)),o.paths,i)):l&&Be(F(`${l}/.cc-safety-net`,o.paths,i)));if(f&&Vt(s,f))return!1;return n.some((d)=>{let m=B(Sr(d,r,o,i));if(!m)return!1;if(c&&(c===m||c.startsWith(m.endsWith("/")?m:`${m}/`)))return!1;return Vt(s,m)})}function xw(e){let t=e.split("/");return t.some((n)=>Cw.has(n))||bw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function _w(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ls)if(r===o.extension&&rt(o.id,t))return o.id;for(let o of cs)if(o.pattern.test(r)&&rt(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function rt(e,t){return!t?.disabledRules?.includes(e)}function He(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i)return"";if(!o)return i;let s=Xa(i,o),a=ci(s)?s:Be(di(t,s)),l=Be(F(a,n.paths,r));if(!Vt(l,o)){if(ci(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Fm(e,t){return e===t||e.startsWith(`${t}/`)}function ww(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i||!o)return"";let s=Xa(i,o),a=e_.normalize(ci(s)?s:Be(di(t,s))),l=Be(Ce(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Vt(c(a),c(d)));if(u===void 0)return"";let f=a.slice(u.length);return f?`~${f}`:"~"}function Sr(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i)return"";let s=o?Xa(i,o):i;return Be(F(ci(s)?s:di(t,s),n.paths,r))}function Za(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Be(F(Ce(r),t.paths,n)):"",i=Be(Ce(Pw(Xe(e,t))));return{home:o,normalized:i}}function Pw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return n_(e)}catch{return e}}function Xa(e,t){if(e==="~")return t;if(e.startsWith("~/"))return le(t,e.slice(2));return e}function Aw(e){if(process.platform==="win32")return!0;return t_.parse(e).root.length>1}function Be(e){let t=e.trim(),n=(t.includes("\\")&&Aw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Vt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function it(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Kt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Tw={findPolicyMutation:Tm,findGitMetadataMutation:ad,resolveGitMetadata:Iw,loadPolicySnapshot:qc,findSensitiveTarget:Hm,analyzeCommand:Sm,getModes:Mi};function Xm(e,t){let n={...Tw,...t.dependencies},r=Mw(e),o=vr(e)?e.command:r,i=vt("policy-protection",o,()=>nr(e)),s=pe(i,"input-candidate"),a=pe(i,"declared-command");if(vr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:$e,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:wd,intent:"stop_and_explain"}};let l=ye(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Am,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let f=vt("policy-protection",o,()=>xm(i,t.environment,l));if(f){let E=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Rm,intent:"hard_stop",evidence:{command:E,segment:f.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ae,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let m=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...kw(m)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:vr(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:zm,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!vr(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Ja("command-validation",o),...g};let v=vt("command-analysis",o,()=>vm(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Ow(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function Iw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function kw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Ow(e){return pe(e,"declared-command")?.program}function Mw(e){try{return An(e.input)}catch(t){let n=vr(e)?e.command:void 0;throw new Kt("policy-protection",Ja("policy-protection",t instanceof Ve?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Kt(e,Ja(e,r instanceof Ve?void 0:t,r),r)}}function Ja(e,t,n){let r=n instanceof N||n instanceof We;return{stage:e,decision:{kind:"deny",reason:r?Ci:xn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function vr(e){return e.route.kind==="command"}import{appendFileSync as Vw,mkdirSync as Kw}from"node:fs";import{isAbsolute as qw,join as tl}from"node:path";import{lstatSync as Qm,readdirSync as Nw,readFileSync as Dw,rmdirSync as Lw,statSync as ep,unlinkSync as Ww,utimesSync as Gw,writeFileSync as Fw}from"node:fs";import{join as Er}from"node:path";function Jm(e,t={}){return Yr(Qt(e,t),e.home).policy.audit.retention_days}var el=86400000,zw=".last-prune",Bw=/^\d{4}-\d{2}$/,$w=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,tp=(e)=>Math.floor(e/el);function rp(e,t,n=()=>new Date){try{let r=n().getTime();if(!ep(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Er(t,zw),i=ep(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&tp(i)===tp(r))return;let s=r-Jm(e)*el,a=new Date(r).toISOString().slice(0,7);for(let l of Qa(t)){if(l.isDirectory()){Uw(Er(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))Hw(Er(t,l.name),s)}Fw(o,"",{mode:384}),Gw(o,r/1000,r/1000)}catch{}}function Uw(e,t,n){for(let r of Qa(e)){if(!r.isDirectory()||!Bw.test(r.name))continue;let o=Er(e,r.name);for(let i of Qa(o)){if(!i.isFile())continue;let s=$w.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+el;if(!Number.isFinite(a)||a>=t)continue;op(Er(o,i.name))}if(r.name!==n)np(o)}np(e)}function Hw(e,t){try{let n=Qm(e);if(n.mtimeMs>=t)return;let r=Dw(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(jw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Qm(e).mtimeMs!==n.mtimeMs)return;op(e)}catch{}}function jw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Qa(e){try{return Nw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function op(e){try{Ww(e)}catch{}}function np(e){try{Lw(e)}catch{}}var Yw="2.4.4",Zw=1e4,Xw=2000,Jw=256,Qw=32768;function eP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function tP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function nl(e,t,n,r,o,i,s={}){let a=eP(t);if(!a)return;let l=rP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=mi(st(n),s.failureStage?Number.POSITIVE_INFINITY:Zw),f=mi(st(r),Xw),d=s.toolName?mi(st(s.toolName),Jw):void 0,m=i===null?void 0:mi(st(i),Qw),p=tl(l,tP(m?.value??null),c.slice(0,7));Kw(p,{recursive:!0,mode:448});let h=tl(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Di)(),v:Yw,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};Vw(h,`${JSON.stringify(g)}
-`,{encoding:"utf-8",mode:384}),rp(e,l,s.now)}catch{}}function mi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function nP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&qw(n)?n:null}function rP(e){let t=nP(e);return t?tl(t,".cc-safety-net","logs"):null}function sp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=ip(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?ip(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function ip(e){return"command"in e?e.command??"":""}function ap(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;nl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function lp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;nl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function up(e,t,n){try{let r=Xm(t,{environment:e,...n.guard});return cp(e,t,r,n),r}catch(r){if(!(r instanceof Kt))throw r;throw cp(e,t,r.evaluation,n,!(r.cause instanceof Ve),{stage:r.stage,errorCode:oP(r.cause)}),r}}function cp(e,t,n,r,o=!0,i){ap(e,sp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function oP(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Ve)return"tool-input-limit";if(e instanceof We)return"structural-shell-syntax-limit";return"unexpected-error"}function Et(e,t={}){return{malformed:!0,denial:_n(t),cwd:e}}function dp(e,t={}){return(n,r)=>{try{return iP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(_n())}}}function iP(e,t,n,r){let o=Fl();if(n.cancelled?.(t))return n.block(_n());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return lp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=ll(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=up(o,i,{guard:{auditAllowed:zl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Kt))throw l;if(xt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${ul(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var fp="exec",sP=new Set(["auto","gateway"]);function mp(e){e.on("before_tool_call",aP(e),{matcher:[fp],priority:50})}function aP(e,t={}){return dp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>lP(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>dP(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function lP(e,t,n,r){if(!e||typeof e!=="object")return Et(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Et(null);if(o!==fp)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Et(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Et(null,{toolName:o});if(s.host!==void 0&&!sP.has(s.host))return Et(null,{command:a,toolName:o});let l=cP(n,t.agentId,r);if(!l)return Et(null,{command:a,toolName:o});let c=uP(l,s,r);if(!c)return Et(l,{command:a,segment:typeof s.workdir==="string"?s.workdir:void 0,toolName:o});return Tn(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function cP(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return wi(".",[r],n)}catch{return}}function uP(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return wi(r,[e],n)}function dP(e){return{block:!0,blockReason:cl(e)}}var yL={...al,register:mp};export{yL as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Vo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function mr(e){return e?w(e):""}function ux(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function _a(e,t){return xa(Me(e,"posix"),t)}function pr(e){return _a(e,new Set(Array.from(e.matchAll(pm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function xa(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(xa(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>xa(o,n))||Cm(r.words,n))return!0;gx(r,n)}return!1}function Cm(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(fr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return fm(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Se(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&fm(s[l],t)}let i=dx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Cm(e.slice(i),t)}function dx(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return mx(e,t+1);if(r==="exec")return fx(e,t+1);if(r==="env")return px(e,t+1,n);return null}function mx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function fx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function px(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return fr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return fr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function gx(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(fr(n,t))t.add(r.name)}}function fr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(pm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(tx.test(o)||t.has(o))}))}function fm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||fr(e,t))}var hx=["--init-file","--rcfile"],yx=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function tt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return bm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=bm(e,t,!1);if(r!==null)return r}}return null}function nt(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Se(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function bm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Sm(e){let t=k(e[0]??"").toLowerCase(),n=Cx(e,t),r=yx.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Cx(e,t){let n=Se(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?hx.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Yi.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Zi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var wa="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Pa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",bx="__CC_SAFETY_NET_XARGS_INPUT__",Ko="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",qo="rm",Sx=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,vx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Ex=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,xx=/^(?:[0-9]+|[@*])$/;function xm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Ut(n),i=n.slice(r),s=b("xargs.shell-dynamic",Pa);if(_x(i,o,t)&&A(s,t.policy))return A(s,t.policy);for(let a of Fe(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?A(s,t.policy):null;if(c)return c;let u=Am(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&wm(l,o),d=t.analyzeChild(l,{...zt(a,t),dynamicInput:u,dynamicSourceInput:m||_m(l,a.head,o,a.wrapperEnvAssignments,u,t.environment),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",wa)});if(d)return d;let f=Rx(l,o,t.policy?.rules??[],A(s,t.policy));if(f)return f;if(a.head==="git"){let h=o===null?[...l,bx]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...zt(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=Je(l,t.policy?.rules??[]);if(p)return p}return null}function Rx(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Rm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=cm(e,r,t.length,n);return o===null?[]:[o]}function _m(e,t,n,r,o,i){if(J.has(t)){if(nt(e))return!1;if(n!==null&&wx(e,n))return!0;let s=tt(e);if(!s){let a=et(K(e));if(a.kind==="literal")return n!==null&&a.source.includes(n);return a.kind==="none"&&o}if(n!==null&&s.includes(n))return!0;if(Ye(s))return!0;return Px(s,n,r)}if(Oe(t))return vm(e,n,po,Mu(t));if(we.has(t))return vm(e,n,ia,Od);if(t==="eval"){let s=Ho(K(e));if(s.kind==="dynamic")return!0;if(n!==null)return s.kind==="literal"&&s.source.includes(n);return o}if(t==="find")return Ax(e,n,i);if(t==="git"){let s=xe(e);return n===null?s.subcommand===null:(s.subcommand?.includes(n)??!1)||s.subcommand!==null&&pn.has(s.subcommand.toLowerCase())&&Pm(s.rest,n).some((a)=>a.includes(n))}return!1}function vm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Ko]).sources.some((a)=>a.value===Ko);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Ko}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Ko}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Rm(l,t,a))));return $o(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function _x(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Fe(e,n),(i)=>i.head)),o=t===null?[...e,qo]:e.map((i,s)=>s===0?i:i.replaceAll(t,qo));return Array.from(Fe(o,n)).some((i)=>i.head===qo&&!r.has(qo))}function wm(e,t){return Pm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Pm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Am(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function wx(e,t){let n=Se(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return Rm(i,t,o).some((l)=>{let c=e.map((m,d)=>d===s?m.replaceAll(t,l):m),u=Se(c);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(n.commandIndex===null&&u.commandIndex!==null)return!0;if(n.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(c[u.commandIndex]??"").includes(l))return!0;return u.scriptIndex!==null&&(c[u.scriptIndex]??"").includes(l)})}))}function Px(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Sx))if(Em(o,r))return!0;for(let o of e.matchAll(vx))for(let i of(o[1]??"").matchAll(Ex))if(Em(i,r))return!0;return _a(e,r)}function Em(e,t){let n=e[1]??e[2];return n!==void 0&&(xx.test(n)||t.has(n))}function Ax(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Qe(s)){let l=cr(e,i);i=l.nextIndex-1;for(let c of Fe(l.tokens,{environment:n,cwd:void 0})){let u=Am(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&wm(c.tokens,t)||_m(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=ht(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Ut(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var gr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",hr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Ix="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",kx="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Zo=/\{[^{}\s]*\}/g,Tm=/\{\}|\{-?\d+\}/g,Ox=["e","f","source","file","-e","-f","--source","--file"],Mx=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Nx=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Dx=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Im=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Lx=new Set(["--workdir","--wd"]),km="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Te(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Lm(e){return Te([...e],(t)=>Ye(t))}function Wm(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=hn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Vm(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=hn(t);if(p)return p;let h=Lm(t.envAssignments?.values()??[]);if(h)return h}if(l){let p=$x(t);if(p)return p}if(u!==void 0&&a){let p=hn(t);if(p)return p}let d=Ux(u,t.cwd,t.environment.paths);if(d===null){let p=hn(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...Fe(i,f)].flatMap((h)=>[...h.envAssignments.values()]).some(Ia)){let h=hn(t);if(h)return h}return null}if(i.length===0){let p=s.map((g)=>g[0]??"");t.budget.charge("derivedTokens",p.length);let h=Bm(f.envAssignments,f.cwd,a);return Te(p,(g)=>t.analyzeNested(g,h))}return Te(Fe(i,f),(p)=>Wx(p,o,t,f))}function Wx(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(Hm)){let g=hn(n);if(g)return g}let u=Lm(c);if(u)return u;let m=c.some(G),d=i||m,f=a&&d,p=Bm(e.envAssignments,e.wrapperCwd,s||f);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Te(o,(E)=>n.analyzeChild(Yo(l,E,n.budget),zt(e,r)))};if(nt(l))return g();let y=tt(l);if(y){if(jm(y)){let x=bt(n);if(x)return x;if(o.length===0)return null;return Te(o,(P)=>n.analyzeNested(Nm(y,P,n.budget),p))}if(G(y)){if(o.length>0)return Te(o,(q)=>n.analyzeNested(Nm(y,q,n.budget),p));let x=ur(y);if(x?.[0]&&M(x[0])==="rm"&&ze(x)){let q=Mm(n);if(q)return q}let P=x?n.analyzeChild(x,{...zt(e,r),dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",hr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",gr)}):null;if(P)return P;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>jo(K(x===void 0?l:i?l.map((P)=>$m(P,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=bt(n);if(x)return x}let S=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(S.length>0)return n.budget.charge("derivedTokens",S.length),Te(S,(x)=>n.analyzeNested(x,p));if(pr(y)){let x=bt(n);if(x)return x}let T=n.analyzeNested(y,p);if(T)return T;if(d)return bt(n);return null}let v=et(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&G(v.source))return bt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=bt(n);if(E)return E;let S=g();if(S)return S;if(i)return null;let T=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",T.length),Te(T,(x)=>n.analyzeNested(x,p))}if(d||a)return bt(n)??g();return null}if(e.head==="rm"&&ze(l)){if(i&&o.length>0)return Te(o,(y)=>Aa(Yo(l,y,n.budget,Tm),e.cwd,r));if(o.length>0)return Te(o,(y)=>Aa(Dm(l,y,n.budget),e.cwd,r));let g=Aa(l.flatMap((y,v)=>{if(v===0||!G(y))return[y];return y.startsWith("-")?[y.replace(Tm,"")]:[]}),e.cwd,r);if(g)return g;return Mm(n)}let h=o.length>0?o:[void 0];return Te(h,(g)=>{let y=g===void 0?l:i?Yo(l,g,n.budget):Dm(l,g,n.budget),v=b("parallel.shell-dynamic",hr),E=a&&e.head==="find"?Bx(y,r):null,S=Fm(y,a,n)??E?.customResult??null,T=M(e.head),x=a&&(T==="rm"&&Ta(y)||T==="xargs"&&zm(y)||E?.rmOptions===!0),P=a&&(x||E?.executedSource===!0||E===null&&Gm(y,T)),q=n.analyzeChild(y,{...zt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:x,dynamicSourceInput:S!==null||P,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",gr)});if(P){let Z=A(v,n.policy);if(Z)return Z}return q??S??Je(y,n.policy?.rules??[])})}function Gm(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return zx(e);if(t==="git")return Gx(e);if(t==="find")return!0;if(we.has(t))return Om(e,Ox,lr);if(Oe(t))return Om(e,Mx,fo);return!1}function Ta(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||jm(o)))}function Gx(e){if(Fx(e))return!0;let t=xe(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!pn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function Fx(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function zx(e){if(nt(e))return!1;let t=tt(e);if(t!==null)return G(t);let n=et(K(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function Om(e,t,n){let r=n(e);if(r.some((o)=>G(o.value)))return!0;if(!e.some(G))return n([...e,km]).some((o)=>o.value===km);return $o(r,t,(o)=>n(e.map((i)=>$m(i,[o]))))}function Fm(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(G))return bt(n);return Te(o,(i)=>Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function Bx(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of Fe(i,t))n.executedSource||=Gm(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ta(a.tokens)||a.head==="xargs"&&zm(a.tokens),n.customResult??=Fm(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Qe(a)){i=[],n.executedSource||=G(a);continue}let l=ht(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function zm(e){let t=e.slice(Ut(e).childStart);return M(t[0]??"")==="rm"&&Ta(t)}function Xo(e,t){return(n)=>A(b(e,t),n.policy)}var bt=Xo("parallel.shell-dynamic",hr),$x=Xo("parallel.command-stream-dynamic",Ix),hn=Xo("parallel.command-stream-dynamic",kx),Mm=Xo("parallel.rm-recursive-force-dynamic",gr);function Aa(e,t,n){return A(Uo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Lt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Bm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function $m(e,t){return e.replace(Zo,(n)=>Um(n,t))}function Yo(e,t,n,r=Zo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Um(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Nm(e,t,n){return Yo([e],t,n)[0]??""}function Dm(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Um(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function G(e){return e.search(Zo)!==-1}function Hm(e){if(Ia(e))return!0;for(let t of e.matchAll(Zo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Ia(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function jm(e){return/^\{[^{}\s]*\}$/.test(e)}function Ux(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Tx(e))return null;try{return mt(t??e,e,n)}catch{return null}}function Vm(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=la(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=la(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||Dx.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(Im.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=Im.has(p)?2:1;continue}if(Lx.has(y)){c=!0;let E=v??h;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(Nx.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Ia:Hm);let u=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){u.push(p),p=[];continue}if(g!==void 0)p.push(g)}u.push(p)}c||=u.length>1;let m=Hx(u),d=n.some(G),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function Hx(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function Km(e){return Vm(e).childStart}var jx="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Jo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Oa(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function ka(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Ym(e,t,n,r,o=!1,i){let a=(Bn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",jx):null;return A(a,i)??Zm(e,t,n,o,i)}function Zm(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Oa(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=sn(e,t),l=Kx(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return A(b("shell.dynamic-structure",Jo),o);if(A(Bo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&pn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return A(b("shell.dynamic-structure",Jo),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&qx(t)?A(b("shell.dynamic-structure",Jo),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=ze(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?A(b("shell.dynamic-structure",Jo),o):null}if(s==="xargs")return qm(e,t.slice(Ut(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return qm(e,t.slice(Km(t.map(w))),"parallel",n,r,o);return null}function qm(e,t,n,r,o,i){if(t.length===0)return null;let s=Vx(t,r);if(Bn(e,s)){let l=A(b(`${n}.shell-dynamic`,n==="xargs"?Pa:hr),i);if(l)return l}let a=Zm(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Oa(l)&&ka(l)))return A(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?wa:gr),i);return null}function Vx(e,t){let n=Ot(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function Kx(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(be.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function qx(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Oa(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||ka(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||ka(s)))return!0;continue}if(t=!0,a)return!0;let l=ht(s.text);if(l>0){n=l;continue}if(Qe(s.text))o=!0,r=!0}return!1}function Ma(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!lo(t[n.tokenIndex],n.value)})}var Yx="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",Zx="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",Xx="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Xm(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",Yx);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",Zx);if(e==="shred"&&n.length>0)return b("shred.target",Xx);return null}var Qm=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Uo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Bo(e.words,Na(e))},{heads:new Set(["find"]),analyze:(e)=>Gd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>xm(e.words,{...Jm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Wm(e.words,{...Jm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})}];function Jm(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ht(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Na(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var rf="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function of(e){return Qm.find((t)=>t.heads.has(e))?.analyze}function Cn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=yo(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=Ot(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let R=[...p,...i(f.words)].join(" "),I=Ye(R);if(I)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:I.reason}),ue(I);if(n.strict)return he(r);let L=Co(p,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(te)return te}}let h=f.rewritten?K(i(f.words)):sn(o,f.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>h.length){let R=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),E=g[0];if(!E)return null;if(Ft(E))throw new N("wrapperPeelIterations");let S=M(E),T=f.cwd===null?void 0:f.cwd??u,x=f.cwd===null?void 0:m,P=f.cwd===void 0?n.effectiveCwd:f.cwd,q=s?s.allowTmpdirVar:!or(v,n.environment),Z=Ym(o,f.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),ue(Z);let ee=Do(g,n.policy);if(ee){for(let R of[ee.childIndex,...ee.alternativeChildIndices]){ef(y.wrapperNormalizationBudget);let I=h.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=Cn(I,t,{...y,effectiveCwd:P,envAssignments:v});if(L)return L}return null}let X=l?void 0:S==="eval"?Ho(h):S==="trap"&&!a?hm(h):void 0;if(a&&s&&S==="eval"){if(X?.kind==="dynamic")return yn(s,n.policy);if(X?.kind==="literal"){let R=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v});if(R)return R}return bn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!Ra(n.commandView)))return he(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:S==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let R=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?J.has(S):af(E,S)){if(nt(g))return null;if(a&&s){let R=tt(g);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=yn(s,n.policy);if(L)return L}if(pr(R)){let L=yn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:P,envAssignments:v})}let I=et(h);if(I.kind==="dynamic")return yn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?yn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?yn(s,n.policy):null}if(l){let R=tt(g),I=R?n.analyzeNested(R,{effectiveCwd:P,envAssignments:v}):et(h).kind==="dynamic"?he(r):null;if(I)return I}if(s===void 0){let R=tR(g,v,P,n,r,t);if(R)return R;let I=tt(g);if(I){let qt=jo(h,I);if(qt.kind==="dynamic")return he(r);let hi=qt.kind==="literal"?qt.source:I,il=nR(hi);r?.recordSegment({type:"shell-wrapper",wrapper:S,innerCommand:il}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:il,depth:t+1});let sl=n.analyzeNested(hi,{effectiveCwd:P,envAssignments:v});if(sl)return sl;return pr(hi)?he(r):null}let L=et(h);if(L.kind==="dynamic")return he(r);if(L.kind==="literal")return Qo(L.source,P,v,n,r,t);let te=ym(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return he(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:P,envAssignments:v})}}if(!s&&(S==="source"||S===".")){let R=g[1]==="-p"?2:null;if(R!==null){let qt=n.commandView?h[R]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return he(r)}let I=R===null?1:3,L=g[I]==="--"?I+1:I,te=n.commandView?h[L]:void 0;if(!te)return null;if(te.provenance==="literal")return Qo(te.text,P,v,n,r,t);if(n.strict||!n.commandView||!Ra(n.commandView))return he(r)}if(we.has(S)&&!l){if(!s&&n.strict&&Ma(lr(g),h))return he(r);let R=Md(g,(L)=>Ht(n.analyzeNested(L,{effectiveCwd:P,envAssignments:v}))),I=A(R,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),ue(I)}if(Oe(S)&&!l){if(!s&&n.strict&&Ma(fo(g),h))return he(r);let R=Ou(g);if(a&&s)return Qx(S,R,P,v,n,s);if(R){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:S,codeArg:R,paranoidBlocked:I}),I){let te=A(b("interpreter.one-liner-paranoid",Yn),n.policy);if(te)return ue(te)}if(zs(S,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:P,envAssignments:v});if(L&&!sf(L,R))return L;if(Zn(R)){let te=A(b("interpreter.dangerous-command",cn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:cn}),ue(te)}r=void 0}}if(S==="busybox"&&g.length>1)return ef(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),Cn(h.slice(1),t,{...y,effectiveCwd:P,envAssignments:v});let D=s?null:A(Xm(S,g),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),ue(D);let ce=r===y.trace?y:{...y,trace:r},_e={words:h,head:S,cwd:T,originalCwd:x,envAssignments:v,allowTmpdirVar:q,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:P,options:ce,analyzeChildTokens:(R,I)=>a&&s?Da(R,t,ce,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ht(Cn(K(R),t+1,{...ce,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:v}))??Je(R,ce.policy.rules),analyzeChild:(R,I)=>Da(R,t,ce,I)},je=s&&(S==="xargs"||S==="parallel")?void 0:of(S);if(S==="rm"||S==="xargs"||S==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let Ie=r&&S==="git"?lm(_e.words,Na(_e)):void 0,pi=tf(Ie?Ie.match:je?.(_e)??null,n.policy);if(r)rR(_e,pi,Ie?.relaxation??null);if(pi)return ue(pi);if(a&&s&&(S==="rm"||S==="rmdir")){if(!(S==="rm"&&(ze(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?bn(s,n.policy):null)??eR(s,n.policy)}let rl=je!==void 0,ol=!s&&!rl&&!Lr.has(S),gi=r&&ol?[]:void 0;if(ol)for(let R=1;R<g.length;R++){let I=g[R];if(!I)continue;gi?.push(I);let L=tf(Jx(g,R,t,ce,T,x,P,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[],embeddedCommandFound:M(I)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&rl)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let Rr=Je(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Rr,reason:Rr?.reason}),Rr)return ue(Rr);return a&&s?bn(s,n.policy):null}function Da(e,t,n,r){return Ht(Cn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function Jx(e,t,n,r,o,i,s,a){for(let l of Fe(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=M(c);if(af(c,u)||of(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=Da(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!or(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function Qx(e,t,n,r,o,i){if(!t)return bn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=A(b("interpreter.one-liner-paranoid",Yn),o.policy);if(a)return ue(a)}if(zs(e,t))return bn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!sf(s,t))return s;if(Zn(t)){let a=A(b("interpreter.dangerous-command",cn),o.policy);if(a)return ue(a)}return bn(i,o.policy)}function sf(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Oo)||e.reason===fn)&&!Wr(t)}function yn(e,t){let n=e.shellDynamicMatch?A(e.shellDynamicMatch,t):null;return n?ue(n):null}function bn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?A(e.dynamicSourceMatch,t):null;return n?ue(n):null}function eR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?A(e.rmDynamicMatch,t):null;return n?ue(n):null}function tR(e,t,n,r,o,i){let s=Sm(e);if(s.argvSource?.kind==="absent")return he(o);if(s.argvSourceApplies&&s.argvSource){let l=Qo(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Qo(a,n,t,r,o,i,!0)}function Qo(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return he(o);let a=qn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?he(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function nR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function rR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function ef(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function he(e){return e?.recordSegment({type:"error",message:rf}),ue(oR())}function oR(){return{id:"",reason:rf,intent:"stop_and_explain"}}function af(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function tf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:A(e,t)}var iR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,sR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function aR(e,t){let n=uf(e,t);if(n.length===0)return!1;let r=n[cf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return iR.test(e.join(" "))}function lf(e,t,n,r,o){if(e.dialect==="powershell"){let g=cR(e.words,o);if(g.kind==="none")return;if(!t||g.kind==="unknown")return null;return nf(fR(g.target),t,n.paths)}let i=e.words.map(w),s=i.some((g)=>/^CDPATH\+?=/.test(g));if(!aR(i,n))return s?null:void 0;if(!t)return null;let a=uf(i,n,t),l=cf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((g)=>g.length<=1||!g.startsWith("-")||g==="--");if((u===-1?c:c.slice(0,u)).some((g)=>!/^-[LP]+$/.test(g)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length!==1)return null;let p=f[0]??"",h=e.words.some((g)=>g.provenance==="variable"&&g.text===p)?lR(p,r):p;if(h===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(h)&&(s||n.env.has("CDPATH")))return null;return nf(h,t,n.paths)}function lR(e,t){let n=dr(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function nf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return mt(t,e,n)}catch{return null}}function cR(e,t){let n=uR(e[0])?1:0,r=e[n];if(!dR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!sR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return mR(e.slice(n+1),t)}function uR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function dR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function mR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function fR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function cf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function uf(e,t,n){let r=pR(e);return ft([...r],t,n)}function pR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var gR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",jt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function za(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Me(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Fa(e,n);let u=`${Oo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return hf(e,n),{reason:fn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return hf(e,n),{reason:fn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Fa(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Zd(n.environment.env,n.envAssignments);return ni(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ni(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,d=hR(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=f||vn(m);if(c.kind==="function"){let Z=h.flatMap((X)=>{let U=En(X);return U.functionDefinitions.set(c.name,c.body),La(X,[U],d,m==="&",vn(m))}),ee=Wa(Z,[],g,y,a,m);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of h){let D=ni(c.body,t,n,r,[En(U)]);if(D.result)return D;if(Z.push(...La(U,D.states,d,m==="&",vn(m))),v)ee.push(U,...d?D.states.map((ce)=>ei(U,ce)):D.states)}let X=Wa(Z,ee,g,y,a,m);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),S=e.nodes[l-2],T=ri(a)&&S?.kind==="command"?gm(S)??CR(S):void 0,x=[],P=[];for(let Z of h){let ee=bR(c,t,n,r,[En(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ei(Z,U));for(let U of X){let D=En(U),ce=ER(c,t,n.trace?{...n,trace:yf(n.trace,E)}:n,r,D,ri(a),T);if(ce)return{result:ce,states:i};let _e=GR(c,D.functionDefinitions);if(_e)n.budget.charge("derivedTokens",oi(_e));let je=_e?t+1>=V.recursionDepth.cap?Ga(c.displayText,n,[D]):ni(_e,t+1,n,r,[D]):{result:null,states:LR(c,D)};if(je.result)return je;if(x.push(...La(Z,je.states,d,m==="&",vn(m))),v)P.push(Z),P.push(...je.states.map((Ie)=>d?ei(Z,Ie):Ie))}}let q=Wa(x,P,g,y,a,m);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function hR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ri(r)||ri(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&yR(e,t)}function La(e,t,n,r,o){let i=n?t.map((a)=>ei(e,a)):[...t],s=o?i.flatMap((a)=>Sn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ei(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function yR(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(SR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ri(e){return e==="|"||e==="|&"}function CR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function vn(e){return e==="&&"||e==="||"}function Wa(e,t,n,r,o,i){let s={success:ti([...n,...e]),failure:ti([...r,...t])},a=vn(i)?s:void 0;return{states:vn(o)||a?ti([...s.success,...s.failure]):s.success,conditionalStates:a}}function yf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function bR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=vR(e);if(s){if(t+1>=V.recursionDepth.cap)return Ga(s,n,o);let a=Me(s,"powershell");if(a.status==="limited")return Ga(s,n,o);if(a.status!=="complete")return df(i,n,r,o);n.budget.charge("derivedTokens",oi(a)),i.push({program:a,depth:t+1})}}return df(i,n,r,o)}function SR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function df(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ni(i.program,i.depth,t,n,[En(a)]);if(l.result)return l;s.push(...l.states)}o=ti(s)}return{result:null,states:o}}function vR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function oi(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+oi(o),0):n.kind==="group"||n.kind==="function"?oi(n.body):0),0)}function Ga(e,t,n){return t.trace?.recordSegment({type:"error",message:$e}),{result:{reason:$e,segment:e,intent:"stop_and_explain"},states:[...n]}}function ER(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=TR(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Cf(e,o,"before-consumer",a.environment.paths,a.budget);let c=sn(e.dialect,e.words),u=c.map(w),m=e.displayText,d=Yd(c,o.shellGitContextState),f=Jd(d,o.shellGitContextState);if(e.dialect==="powershell"){let g=A(_d(e,i,zR(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!g,reason:g?.reason}),g)return FR(m,g)}if(u.length===1&&u[0]?.includes(" ")&&!Bn(e.dialect,e.words)){let g=A(Ye(u[0]),a.policy),y=g!==null&&!a.strict&&Pu(e,a.rootProgram);if(g&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:g.reason}),{reason:g.reason,segment:m,ruleId:g.id,intent:g.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let v=mf(e,l,o,f,s,a);if(v)return v;return Ca(d,o.shellGitContextState),null}let p=Cn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(g,y)=>{let v=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=za(g,t+1,{...a,effectiveCwd:v,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?yf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:m};let h=mf(e,l,o,f,s,a);if(h)return h;return Ca(d,o.shellGitContextState),null}function mf(e,t,n,r,o,i){let s=IR(e,t,n,r??new Map,i);if(s)return s;return Cf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),_R(e,t,n,i.environment.paths,i.budget),MR(e,n,o,i.environment,i.trace),null}var xR=new Set([">>","<>"]);function Cf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?RR(s):xR.has(s.operator)))continue;ff(s.target,t,r,o)}if(n!=="before-consumer"||!Re(e.words[0],"tee"))return;let i=bf(e.words.slice(1));if(!i)return;for(let s of i.operands)ff(s,t,r,o)}function RR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function ff(e,t,n,r){let o=e?.provenance==="literal"?qn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function _R(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!ii(i))return;for(let s of wR(e)){let a=qn(s.text,n.effectiveCwd,r,o);if(!a||!Iu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function wR(e){let t=AR(e.redirections)?.target,n=pf(t)?[t]:[];if(Re(e.words[0],"cat"))return PR(e.words)?n:[];if(!Re(e.words[0],"tee"))return[];let r=bf(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(pf))return[];return[...r.operands,...n]}function PR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function AR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function bf(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&Re(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function pf(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function Re(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function ii(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function TR(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return jt;let n=t[0];if(!n?.heredoc)return jt;if(!ii(n.heredoc))return gR;if(n.fd!==void 0&&n.fd!==0)return jt;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return jt;let r=e.redirections.some((s)=>s!==n&&gf(s.target));if(Re(e.words[0],"cat"))return r?jt:void 0;if(Re(e.words[0],"tee"))return r||e.words.slice(1).some(gf)?jt:void 0;let o=e.words[0],i=e.words[1];if(Re(o,"git")&&(Re(i,"apply")||Re(i,"commit")))return;if(Re(o,"gh")&&(Re(i,"pr")||Re(i,"issue"))&&Re(e.words[2],"create"))return;return jt}function gf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function IR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(OR(e,i,n,r,o))return null;let a=kR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Fa(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function kR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!ii(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Oe(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=A(b("interpreter.one-liner-paranoid",Yn),n.policy);if(c)return c}if(!Zn(s))return null;let l=A(b("interpreter.dangerous-command",cn),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function OR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!ii(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Ot(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return nt(a)}function MR(e,t,n,r,o){let i=lf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var NR=/^[A-Za-z_][A-Za-z0-9_]*$/,DR=8;function LR(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!NR.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=DR&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=En(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function En(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Xd(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ti(e){let t=[];for(let n of e){if(!t.some((r)=>WR(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function WR(e,t){return e.effectiveCwd===t.effectiveCwd&&Sn(e.shellGitContextState.env,t.shellGitContextState.env)&&Sn(e.literalHeredocFiles,t.literalHeredocFiles)&&Sn(e.functionDefinitions,t.functionDefinitions)&&Sn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Sn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function Sn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function GR(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function FR(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function zR(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Fa(e,t){let n=A(Ye(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function hf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:fn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var BR=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Sf(e,t,n,r){let o=za(e,0,{...t,...Yc(t),budget:t.budget??ye(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function vf(e,t,n){try{return{decision:e()}}catch(r){let o=$R(r,t,n);if(!o)throw r;return o}}function $R(e,t,n){if(!(e instanceof N)||!BR.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var UR=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),$a=new Set(["cc-safety-net","ccsn"]),HR=new Set(["bunx","npx","pnpx"]),jR=new Set(["pnpm","yarn"]),VR=new Set(["npm","pnpm","yarn"]),KR=new Set(["bun","node"]);function ai(e,t,n={}){if($a.has(e))return 0;if(HR.has(e)){if(n.broad)return Ba(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return si(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&VR.has(e)&&n.broad&&t[r]==="exec"){let o=Ba(t.slice(r+1));return o===null?null:r+1+o}if(jR.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&si(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ba(t.slice(r+1));return o===null?null:r+1+o}if(KR.has(e)){let o=n.broad&&r!==-1?r:0;if(Ef(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Ef(t[o+1]))return o+2}return null}function Ba(e){let t=e.findIndex((r)=>si(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!si(r))break;n++}return n}function si(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return $a.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return $a.has(e.slice(0,t))}function Ef(e){let t=e?.replaceAll("\\","/");return[...UR].some((n)=>t===n||t?.endsWith(`/${n}`))}var xf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Rf(e,t,n){let r=pe(e,"input-candidate");if(!r)return null;let o=dn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>qR(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function qR(e,t){let n=ft([...e],t),r=n.slice(1),o=ai(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as li}from"node:path";var Af="This path contains the protected policy config and you must not modify or delete it.",YR=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Tf(e,t,n){let r=t_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return _f(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=pe(e,"input-candidate");if(e.invocation.route.kind==="command")return o?wf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=wf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return _f(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Pr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function _f(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>yr(a,n,r,o,i));return s?{target:s}:null}function wf(e,t,n,r,o){let i=dn(e,t,r,o,{findSegmentTarget:(s,a)=>ZR(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>yr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>e_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function ZR(e,t,n,r,o){if(tr(e))return null;let i=Mt([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&XR(a)){let l=JR(a).find((c)=>Pf(fe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Go(i,1)||ua(i,r)){let c=(Wo(K(i))??K(["."])).find((u)=>{let m=fe(u.text,t.variables);return yr(m,t.cwd,n,r,o)||Pf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Ro(a).sources.find((c)=>n_(fe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(QR(i,s))return null;for(let l of[...e,...i])for(let c of If(l))if(yr(fe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function XR(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function JR(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function QR(e,t){if(!YR.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function e_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of If(i))if(yr(s,t,n,r,o))return{target:s};return null}function If(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function t_(e,t,n){let r=(a)=>Cr(se(a,e.executionCwd,t,n)),o=r(Qt(t)),i=[r(Ln(e.executionCwd)),r(Ln(e.configCwd))],s=new Set(i.map((a)=>li(a)));for(let a=li(o);;a=li(a))if(s.add(a),li(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function yr(e,t,n,r,o){let i=gl(e,t,r,o,(s)=>Cr(s)===Nr);return i!==null&&n.files.has(Cr(i))}function Pf(e,t,n,r,o){return n.directoriesAndAncestors.has(Cr(se(e,t,r,o)))}function n_(e,t,n,r,o){let i=Cr(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Cr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ci,posix as r_,resolve as di,win32 as o_}from"node:path";import{fileURLToPath as i_}from"node:url";var zf="Access to a sensitive path is not allowed.",Bf=new Set(["echo","printf"]),s_=new Set(["find"]),a_=new Set(["-exec","-execdir"]),l_=new Set([";","+"]),c_=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),u_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),$f=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),d_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),m_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Uf=new Set(["-c","-e","-r","-E","--eval","--exec"]),f_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),p_=new Set(["grep","rg"]),kf=new Set(["jq","gojq","jaq"]),Of="f",Mf="file",g_="files",h_=new Set(["e","f"]),y_=new Set(["regexp","file"]),C_=new Set(["e","f","A","B","C","m"]),b_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Ua="__CC_SAFETY_NET_PIPE_INPUT__",ja=/[\w./~@+-]*[./~][\w./~@+-]*/g,S_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,v_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,E_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,x_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,R_=/\b(?:system|exec)\s*$/,__=/\b(?:eval|exec)\s*\(/g,w_=/\b(?:eval|exec)\s*$/,P_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Nf(e,t,n,r,o,i){for(let s of e){let a=s.target;if(_w(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=xw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&ww(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Hf(e,t,n,r,o={}){let i=Df(e,n,r),s=Nf(i,t,e.invocation.context.configCwd,n,r);if(s===null)return null;let a=s.ruleId!=="secret.deny-path"&&o.strict===!1?Df(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:Nf(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&A_(e,n))return null;return l}function A_(e,t){let n=pe(e,"input-candidate")??pe(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of xo(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(Xe(a.text,t))}let o=St(r);if(o.length===0)return!1;let i=it(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>c_.has(a))}function Df(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=pe(e,"input-candidate");return[...s?xn(s.shell,e.store,r,t,o,n,T_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function T_(e){return e.program.dialect==="powershell"}function xn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new We;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...iw(Xe(e.source,r),t,n,r,o,i)],l=(c)=>Xe(z_(c,s),r);return Eo(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...mi(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...k_(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...jf(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>O_(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return Ks;return a.push({target:l(c.target),cwd:u.cwd}),null}}),a}function Va(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new We;return s.status==="complete"?xn(s,t,n,r,o,i):null}function mi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(kf.has(it(St(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...mi(p,t,n,r,o,i)]}let l=F_(e).map(a),c=St(e);if(c.length===0)return l;let u=c[0]??"",m=it(u).toLowerCase(),d=c.slice(1),f=I_(u,m,d);if(f)return[...l,...f.map(a)];if(Bf.has(m))return n.capturedOutput===!0?[...l,...Vf(e).map(a)]:l;if(m==="eval")return[...l,...Va(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:ot(m,p)).map(a)];if(m==="git")return[...l,...$_(d).map(a)];if(kf.has(m))return[...l,...B_(d).map(a)];if(p_.has(m))return[...l,...fw(d).map(a)];if(s_.has(m))return[...l,...V_(d,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...d.flatMap((p)=>ot("awk",p)).map(a),...d.flatMap((p)=>q_(p,t,n,r,o,i)),...d.flatMap(Y_).map(a)];if(m==="curl")return[...l,...d.flatMap((p)=>ot(m,p)).map(a),...U_(d).map(a)];if(nr(m)){let p=er.has(m)?Se([m,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new We;if(h.status==="complete")return[...l,...xn(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...K_(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>ot(m,p)).map(a)]}function I_(e,t,n){let r=ai(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function k_(e,t,n,r,o,i,s){if(L_(t,n,r,o,i,s))return Vf(e).map((a)=>({target:a,cwd:i}));return jf(t,M_(e),n,r,o,i,s,()=>[])}function O_(e,t,n,r,o,i,s){let a=St(e);if(!nr(it(a[0]??"").toLowerCase()))return[];return Va(t,n,r,o,i,s)??[{target:t,cwd:i}]}function jf(e,t,n,r,o,i,s,a){let l=W_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>er.has(l)?xn(n.getShellSyntax(c),n,r,o,i,s):ui(l,c,n,r,o,i,s))}function Vf(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase();if(!Bf.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Ka(r.replaceAll("%%","%"))];return t.slice(1)}function M_(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return N_(r);return[]}function N_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ka(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>D_(t,r.slice(i*n,(i+1)*n)))}function D_(e,t){let n=0;return Ka(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ka(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function L_(e,t,n,r,o,i){let s=St(e);if(s.length===0||it(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Ut(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Ua]:l.map((m)=>m.split(c).join(Ua));return mi(u,t,n,r,o,i).some((m)=>m.target.includes(Ua))}function W_(e){let t=St(e);if(t.length===0)return null;let n=it(t[0]??"").toLowerCase();if(!nr(n))return null;return G_(n,t.slice(1))?n:null}function G_(e,t){let n=qa(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Uf.has(o)||Kf(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(P_.get(n)?.has(o))r++;continue}return!1}return!0}function qa(e){return/^python\d/.test(e)?"python":e}function F_(e){let t=[];for(let n of e){if(Yf(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Lf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function z_(e,t){if(!t||!Lf.test(e))return e;return`~${e.replace(Lf,"").replace(/\\/g,"/")}`}function ot(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function B_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>ot("jq",i))}return e.flatMap((r,o)=>o===t?[]:ot("jq",r))}function $_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>ot("git",i))];if(t.push(...ot("git",r)),!be.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:ot("git",o)),n++}return t}function U_(e){return e.flatMap((t,n)=>{let r=j_(t);if(r!==null)return Wf(r.flag,r.value);let o=H_(e[n-1]);return o===null?[]:Wf(o,t)})}function Wf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ha(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ha(t.slice(n+1))}return t.startsWith("@")?Ha(t.slice(1)):[]}function H_(e){if(e===void 0)return null;if($f.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function j_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return $f.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ha(e){return e===""||e==="-"?[]:[e]}function V_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!a_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>l_.has(f)),m=u===-1?c:c.slice(0,u),d=mi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,h)=>{if(!u_.has(f))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function K_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Uf.has(c)||Kf(e,c)){let m=t[l+1];if(m!==void 0)a.push(...ui(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...ui(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Kf(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return f_.get(t[t.length-1]??"")?.has(qa(e))??!1}function q_(e,t,n,r,o,i){if(!e.includes("system"))return[];return sa(e)?.commands.flatMap((s)=>xn(t.getShellSyntax(s),t,n,r,o,i))??[]}function Y_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function Z_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Ya),...e.match(ja)??[]]}function ui(e,t,n,r,o,i,s){let a=(f)=>({target:f,cwd:i}),l=J_(t,X_(e));if(l===null)return Z_(t).map(a);let c=l.masked.match(x_)!==null||l.literals.some((f)=>R_.test(l.masked.slice(0,f.start))),u=l.masked.match(__)!==null||l.literals.some((f)=>w_.test(l.masked.slice(0,f.start))),m=r.refineInlineData===!0&&!er.has(e),d=m&&!(nw(l.masked)||c||u)?[]:l.literals;return[...d.map((f)=>f.text).filter((f)=>f!=="").map(a),...d.flatMap((f)=>Ya(f.text)).map(a),...m?[]:l.literals.flatMap((f)=>f.text.match(ja)??[]).map(a),...c?l.literals.flatMap((f)=>Va(f.text,n,r,o,i,s)??[a(f.text)]):[],...u?l.literals.flatMap((f)=>ui(e,f.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
+`:h),n,r,o,i,s)):[],...(l.masked.match(ja)??[]).map(a)]}function X_(e){let t=qa(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function J_(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(v_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&tw(e,o))return null;let a=t==="python"?Q_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=ew(e,c,l);if(u===null)return null;let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&E_.test(m))return null;r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function Q_(e,t){return S_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function ew(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function tw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function nw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(d_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>m_.has(i)))continue;if(o.length>1)return!0;if(rw(e,r)===".")return!0;if(ow(e,r+n.length)==="(")return!0}return!1}function rw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function ow(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function iw(e,t,n,r,o,i){return uw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...xn(a,t,{...n,capturedOutput:!0},r,o,i),...sw(a,r)?aw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function sw(e,t){let n=xo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||it(Xe(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Xe(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function aw(e,t){return xo(e).flatMap((n)=>n.kind==="word"?[Xe(n.text,t)]:n.kind==="redirection"&&n.target?[Xe(n.target,t)]:[]).flatMap(Ya)}function Ya(e){let t=cw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||lw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function lw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function cw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function uw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Wn(o,n))continue;if(qf(e,r,n)){let i=dw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=mw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function dw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Wn(i,n))continue;if(qf(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function mw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function qf(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function fw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===g_)o=!0;if(y_.has(m))r=!0;if(d!==void 0){if(m===Mf)t.push(d);continue}if(b_.has(m)){let f=e[l+1];if(m===Mf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let h=0;h<m.length;h++){let g=m[h]??"";if(h_.has(g))r=!0;if(C_.has(g)){d=g,f=m.slice(h+1);break}}if(d==="")continue;if(f.length>0){if(d===Of)t.push(f);continue}let p=e[l+1];if(d===Of&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function St(e){let t=e.findIndex((n)=>!Yf(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Yf(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var pw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),gw=".env.",hw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),yw=[".env.example.",".env.sample."];function Cw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function bw(e){return e.length>0&&!/\s/.test(e)}function Sw(e,t,n,r){try{let o=vr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof N)throw o;return!1}}var vw=new Set(["node_modules","__pycache__"]),Ew=[["vendor","bundle"],["vendor","cache"]];function xw(e,t,n,r,o){if(Cw(e))return null;let i=He(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>bw(s)||Sw(e,t,r,o);if(hw.has(s)||yw.some((d)=>s.startsWith(d)))return null;let c=B(Tw(e,t,r,o));for(let d of is){let f=`~/${d.suffixParts.join("/")}`;if((Ff(a,f)||Ff(c,f))&&rt(d.id,n))return d.id}let u=Rw(i,t,n,r,o);if(u)return u;if(pw.has(s))return null;for(let d of os)if(s===d.basename&&rt(d.id,n))return d.id;if(s.startsWith(gw)&&rt(Br.id,n)&&l())return Br.id;for(let d of ss)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&rt(d.id,n)&&l())return d.id}for(let d of as)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&rt(d.id,n))return d.id}if(Pw(a))return null;if(!s.includes(".")&&Gn.pattern.test(s)&&rt(Gn.id,n))return Gn.id;let m=Aw(s,n);if(m)return m;return null}function Rw(e,t,n,r,o){return $r.find((i)=>{if(!rt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Sr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,He("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||br(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Sr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,He(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||br(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||br(e,s,["credentials"])||br(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>Sr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?z(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?Sr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,He(u,t,r,o),l))}case"secret.cli.pi":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=He("~",t,r,o);return[le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),le(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||br(e,le(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),le(He("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Sr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=le(z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,He("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&Vt(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,He("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Gf=new WeakMap;function z(e,t,n,r,o){let i=Gf.get(o)??new Map;Gf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=He(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>Zf(e,le(t,r)))}function br(e,t,n){return n.some((r)=>Vt(B(e),B(le(t,r))))}function Sr(e,t,n,r,o){return Zf(e,He(t,n,r,o))}function Zf(e,t){return B(e)===B(t)}function le(e,...t){return Be([e,...t].filter(Boolean).join("/"))}function _w(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(vr(e,t,o,i));return n.some((a)=>Vt(s,B(vr(a,r,o,i))))}function ww(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(vr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Be(F(Ce(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=B(u?Be(F(di(Ce(u)),o.paths,i)):l&&Be(F(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Vt(s,m))return!1;return n.some((d)=>{let f=B(vr(d,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return Vt(s,f)})}function Pw(e){let t=e.split("/");return t.some((n)=>vw.has(n))||Ew.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Aw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ls)if(r===o.extension&&rt(o.id,t))return o.id;for(let o of cs)if(o.pattern.test(r)&&rt(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function rt(e,t){return!t?.disabledRules?.includes(e)}function He(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i)return"";if(!o)return i;let s=Xa(i,o),a=ci(s)?s:Be(di(t,s)),l=Be(F(a,n.paths,r));if(!Vt(l,o)){if(ci(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Ff(e,t){return e===t||e.startsWith(`${t}/`)}function Tw(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i||!o)return"";let s=Xa(i,o),a=r_.normalize(ci(s)?s:Be(di(t,s))),l=Be(Ce(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Vt(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function vr(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i)return"";let s=o?Xa(i,o):i;return Be(F(ci(s)?s:di(t,s),n.paths,r))}function Za(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Be(F(Ce(r),t.paths,n)):"",i=Be(Ce(Iw(Xe(e,t))));return{home:o,normalized:i}}function Iw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return i_(e)}catch{return e}}function Xa(e,t){if(e==="~")return t;if(e.startsWith("~/"))return le(t,e.slice(2));return e}function kw(e){if(process.platform==="win32")return!0;return o_.parse(e).root.length>1}function Be(e){let t=e.trim(),n=(t.includes("\\")&&kw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Vt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function it(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Kt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Ow={findPolicyMutation:Tf,findGitMetadataMutation:ad,resolveGitMetadata:Mw,loadPolicySnapshot:qc,findSensitiveTarget:Hf,analyzeCommand:Sf,getModes:Mi};function Xf(e,t){let n={...Ow,...t.dependencies},r=Lw(e),o=Er(e)?e.command:r,i=vt("policy-protection",o,()=>rr(e)),s=pe(i,"input-candidate"),a=pe(i,"declared-command");if(Er(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:$e,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:wd,intent:"stop_and_explain"}};let l=ye(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Af,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=vt("policy-protection",o,()=>Rf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:xf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ae,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let f=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...Nw(f)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:Er(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:zf,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!Er(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Ja("command-validation",o),...g};let v=vt("command-analysis",o,()=>vf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Dw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function Mw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Nw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Dw(e){return pe(e,"declared-command")?.program}function Lw(e){try{return Tn(e.input)}catch(t){let n=Er(e)?e.command:void 0;throw new Kt("policy-protection",Ja("policy-protection",t instanceof Ve?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Kt(e,Ja(e,r instanceof Ve?void 0:t,r),r)}}function Ja(e,t,n){let r=n instanceof N||n instanceof We;return{stage:e,decision:{kind:"deny",reason:r?Ci:_n,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Er(e){return e.route.kind==="command"}import{appendFileSync as Yw,mkdirSync as Zw}from"node:fs";import{isAbsolute as Xw,join as tl}from"node:path";import{lstatSync as Qf,readdirSync as Ww,readFileSync as Gw,rmdirSync as Fw,statSync as ep,unlinkSync as zw,utimesSync as Bw,writeFileSync as $w}from"node:fs";import{join as xr}from"node:path";function Jf(e,t={}){return Zr(Qt(e,t),e.home).policy.audit.retention_days}var el=86400000,Uw=".last-prune",Hw=/^\d{4}-\d{2}$/,jw=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,tp=(e)=>Math.floor(e/el);function rp(e,t,n=()=>new Date){try{let r=n().getTime();if(!ep(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=xr(t,Uw),i=ep(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&tp(i)===tp(r))return;let s=r-Jf(e)*el,a=new Date(r).toISOString().slice(0,7);for(let l of Qa(t)){if(l.isDirectory()){Vw(xr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))Kw(xr(t,l.name),s)}$w(o,"",{mode:384}),Bw(o,r/1000,r/1000)}catch{}}function Vw(e,t,n){for(let r of Qa(e)){if(!r.isDirectory()||!Hw.test(r.name))continue;let o=xr(e,r.name);for(let i of Qa(o)){if(!i.isFile())continue;let s=jw.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+el;if(!Number.isFinite(a)||a>=t)continue;op(xr(o,i.name))}if(r.name!==n)np(o)}np(e)}function Kw(e,t){try{let n=Qf(e);if(n.mtimeMs>=t)return;let r=Gw(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(qw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Qf(e).mtimeMs!==n.mtimeMs)return;op(e)}catch{}}function qw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Qa(e){try{return Ww(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function op(e){try{zw(e)}catch{}}function np(e){try{Fw(e)}catch{}}var Jw="2.4.5",Qw=1e4,eP=2000,tP=256,nP=32768;function rP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function oP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function nl(e,t,n,r,o,i,s={}){let a=rP(t);if(!a)return;let l=sP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=fi(st(n),s.failureStage?Number.POSITIVE_INFINITY:Qw),m=fi(st(r),eP),d=s.toolName?fi(st(s.toolName),tP):void 0,f=i===null?void 0:fi(st(i),nP),p=tl(l,oP(f?.value??null),c.slice(0,7));Zw(p,{recursive:!0,mode:448});let h=tl(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Di)(),v:Jw,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Yw(h,`${JSON.stringify(g)}
+`,{encoding:"utf-8",mode:384}),rp(e,l,s.now)}catch{}}function fi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function iP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&Xw(n)?n:null}function sP(e){let t=iP(e);return t?tl(t,".cc-safety-net","logs"):null}function sp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=ip(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?ip(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function ip(e){return"command"in e?e.command??"":""}function ap(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;nl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function lp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;nl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function up(e,t,n){try{let r=Xf(t,{environment:e,...n.guard});return cp(e,t,r,n),r}catch(r){if(!(r instanceof Kt))throw r;throw cp(e,t,r.evaluation,n,!(r.cause instanceof Ve),{stage:r.stage,errorCode:aP(r.cause)}),r}}function cp(e,t,n,r,o=!0,i){ap(e,sp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function aP(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Ve)return"tool-input-limit";if(e instanceof We)return"structural-shell-syntax-limit";return"unexpected-error"}function Et(e,t={}){return{malformed:!0,denial:wn(t),cwd:e}}function dp(e,t={}){return(n,r)=>{try{return lP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(wn())}}}function lP(e,t,n,r){let o=Fl();if(n.cancelled?.(t))return n.block(wn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return lp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=ll(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=up(o,i,{guard:{auditAllowed:zl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Kt))throw l;if(Rt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${ul(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var mp="exec",cP=new Set(["auto","gateway"]);function fp(e){e.on("before_tool_call",uP(e),{matcher:[mp],priority:50})}function uP(e,t={}){return dp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>dP(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>pP(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function dP(e,t,n,r){if(!e||typeof e!=="object")return Et(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Et(null);if(o!==mp)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Et(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Et(null,{toolName:o});if(s.host!==void 0&&!cP.has(s.host))return Et(null,{command:a,toolName:o});let l=mP(n,t.agentId,r);if(!l)return Et(null,{command:a,toolName:o});let c=fP(l,s,r);if(!c)return Et(l,{command:a,segment:typeof s.workdir==="string"?s.workdir:void 0,toolName:o});return In(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function mP(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return wi(".",[r],n)}catch{return}}function fP(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return wi(r,[e],n)}function pP(e){return{block:!0,blockReason:cl(e)}}var EL={...al,register:fp};export{EL as default};