cc-safety-net 2.4.5 → 2.4.6

package/dist/chunks/index-7v0rebpp.js

@@ -1,45 +0,0 @@
-var Vs="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Nn="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",te="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var js={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},lo={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},a=Object.freeze({realpathAttempts:{cap:16384,...js},processedCandidateBytes:{cap:4194304,...js},pathEnvironmentExpansion:{cap:64,...js},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...lo},trackedHeredocFiles:{cap:64,...lo},controlFlowStates:{cap:64,...lo},wrapperPeelIterations:{cap:20,...lo},derivedCommandShape:lo});class s extends Error{kind;name="AnalysisLimit";constructor(O){super(a[O].reason);this.kind=O}}function fn(){let O=new Map;return{counters:O,resolvedPaths:new Map,charge(D,B=1){let Q=(O.get(D)??0)+B;if(O.set(D,Q),Q>a[D].cap)throw new s(D)}}}import{lstatSync as Tg,realpathSync as Ig,statSync as kg}from"node:fs";import{homedir as Og,tmpdir as Mg}from"node:os";import{statSync as wg}from"node:fs";import{join as Pg}from"node:path";import{basename as Rc,dirname as qp,isAbsolute as Yp,join as Zp,normalize as Xp,resolve as vc}from"node:path";var Jp=256,si=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function mn(O,D=process.platform){if(D!=="win32")return O;return O.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Jn(O,D=process.platform){if(D!=="win32")return!1;return(O[0]==="/"||O[0]==="\\")&&(O[1]==="/"||O[1]==="\\")}function Zs(O,D){return Ks(O,0,D)}function Ks(O,D,B){let Q="",ee=0;while(ee<O.length){if(O[ee]!=="$"){Q+=O[ee],ee++;continue}if(O[ee+1]==="{"){let je=qs(O,ee+2),at=Qp(O,ee,D);if(at===null){if(si.has(je))throw new s("pathEnvironmentExpansion");Q+=O.slice(ee);break}let lt=O.slice(ee,at+1);Q+=eg(lt,D,B),ee=at+1;continue}let he=qs(O,ee+1);if(!he){Q+="$",ee++;continue}Q+=Ys(he,B)??`$${he}`,ee+=he.length+1}return Q}function Qp(O,D,B){let Q=1;for(let ee=D+2;ee<O.length;ee++){if(O[ee]==="\\"){ee++;continue}if(O[ee]==="$"&&O[ee+1]==="{"){if(Q++,B+Q>a.pathEnvironmentExpansion.cap)throw new s("pathEnvironmentExpansion");ee++;continue}if(O[ee]!=="}")continue;if(Q--,Q===0)return ee}return null}function eg(O,D,B){let Q=O.slice(2,-1),ee=qs(Q,0);if(!ee)return O;let he=Q.slice(ee.length);if(!he)return Ys(ee,B)??O;let je=[":-",":+",":=",":?","-","+","=","?"].find((ct)=>he.startsWith(ct));if(!je){if(si.has(ee))throw new s("pathEnvironmentExpansion");return O}if(!si.has(ee))return O;if(je.endsWith("="))throw new s("pathEnvironmentExpansion");let at=Ys(ee,B),lt=je.startsWith(":")?at!==null&&at!=="":at!==null;if(je.endsWith("?")&&!lt)throw new s("pathEnvironmentExpansion");if(je.endsWith("-")||je.endsWith("?"))return lt?at??"":Ks(he.slice(je.length),D+1,B);return lt?Ks(he.slice(je.length),D+1,B):""}function qs(O,D){if(!/[A-Za-z_]/.test(O[D]??""))return"";let B=D+1;while(/[A-Za-z0-9_]/.test(O[B]??""))B++;return O.slice(D,B)}function Ys(O,D){if(!si.has(O))return null;if(O==="HOME")return D.env.get("HOME")??D.home;return D.env.get(O)??null}function Lt(O,D,B){if(!O)return O;let Q=B.resolvedPaths.get(O);if(Q!==void 0)return Q;let ee=[],he=O;while(!0){xc(B,he);let je=D.realpath(he);if(je!==null)return Ec(B,O,je,ee);let at=qp(he);if(at===he||ee.length>=Jp)return Ec(B,O,he,ee);ee.push(Rc(he)),he=at}}function Ec(O,D,B,Q){let ee=Q.length===0?B:Zp(B,...Q.reverse());return O.resolvedPaths.set(D,ee),ee}function tg(O,D,B){let Q=B.resolvedPaths.get(O);if(Q!==void 0)return Q;xc(B,O);let ee=D.realpath(O);if(ee!==null)B.resolvedPaths.set(O,ee);return ee}function xc(O,D){O.charge("realpathAttempts"),O.charge("processedCandidateBytes",Buffer.byteLength(D))}function tn(O,D,B,Q){let ee=wc(O,D,B);if(!ee)return"";return Lt(ee,B.paths,Q).replace(/\\/g,"/")}function _c(O,D,B,Q,ee){let he=wc(O,D,B);if(!he)return null;if(ee(Rc(he)))return Lt(he,B.paths,Q).replace(/\\/g,"/");let je=tg(he,B.paths,Q);return je===null?null:je.replace(/\\/g,"/")}function wc(O,D,B){let Q=B.home,ee=Zs(O.trim(),B).replace(/\\/g,"/");if(!ee)return"";let he=ee==="~"?Q:ee.startsWith("~/")?vc(Q,ee.slice(2)):ee,je=mn(he);return Xp(Yp(je)?je:vc(D,je))}import{spawnSync as ng}from"node:child_process";import{existsSync as uo,lstatSync as rg,readFileSync as fo,realpathSync as Nr,statSync as co}from"node:fs";import{dirname as Xs,isAbsolute as Js,join as Lr,resolve as ai}from"node:path";var og=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],ig=5000;function Ac(O,D=Eg(),B=ig){let Q=sg(O),ee=Q===null?null:ag(Q);if(Q===null||ee===null)return null;let he=Cg(Q,ee,D,B);return he===null?null:{recursiveSubmodules:he}}function sg(O){try{let D=Nr(ai(O));return co(D).isDirectory()?D:null}catch{return null}}function ag(O){let D=Sg(O);if(!D)return null;try{let B=rg(D);if(B.isSymbolicLink()||!B.isFile())return null;let Q=Qs(D);if(!Q?.commonDir)return null;if(!ug(Q.gitDir,D))return null;return dg(Q.gitDir,Xs(D))?{gitDir:Q.gitDir,commonDir:Q.commonDir}:null}catch{return null}}function Qs(O){try{let D=lg(O);if(!D)return null;let B=Nr(Js(D)?D:ai(Xs(O),D));if(!co(B).isDirectory())return null;return{gitDir:B,commonDir:cg(B)}}catch{return null}}function lg(O){let D=fo(O,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!D.startsWith("gitdir:"))return null;return D.slice(7).trim()||null}function cg(O){try{let D=fo(Lr(O,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!D)return null;let B=Nr(Js(D)?D:ai(O,D));return co(B).isDirectory()?B:null}catch{return null}}function ug(O,D){let B=fg(O);return B===null?!1:Tc(O,B,D)}function dg(O,D){let B=mg(O);return B===null?!0:Tc(O,B,D)}function fg(O){let D=Lr(O,"gitdir");if(!uo(D))return null;let B=fo(D,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return B===""?null:B}function mg(O){let D=Lr(O,"config.worktree");return uo(D)?gg(D):null}function Tc(O,D,B){try{return pg(Js(D)?D:ai(O,D),B)}catch{return!1}}function pg(O,D){try{let B=co(O),Q=co(D);if(B.ino!==0&&Q.ino!==0&&B.dev===Q.dev&&B.ino===Q.ino)return!0}catch{}return Pc(Nr.native(O))===Pc(Nr.native(D))}function Pc(O){let D=O.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),B=D.length>1&&D.endsWith("/")?D.slice(0,-1):D;return process.platform==="win32"?B.toLowerCase():B}function gg(O){let D=fo(O,"utf-8"),B=!1,Q=null;for(let ee of D.split(/\r?\n/)){let he=ee.trim();if(he===""||he.startsWith("#")||he.startsWith(";"))continue;if(he.startsWith("[")){B=/^\[core\]$/i.test(he);continue}if(!B)continue;let je=he.match(/^worktree\s*=\s*(.*)$/i);if(je)Q=hg(je[1]??"")}return Q}function hg(O){let D=O.trim();if(!D.startsWith('"')||!D.endsWith('"'))return D;return bg(D.slice(1,-1))}var yg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function bg(O){return O.replace(/\\(.?)/gs,(D,B)=>B===""?D:yg[B]??D)}function Sg(O){try{return ea(Nr(O))}catch{return null}}function ea(O){let D=O;while(!0){let B=Lr(D,".git");if(uo(B))return B;let Q=Xs(D);if(Q===D)return null;D=Q}}function Cg(O,D,B,Q){if(vg(D))return!0;if(B===null)return!0;let ee=ng(B,["config","--get","submodule.recurse"],{cwd:O,encoding:"utf8",env:Rg(process.env),stdio:["ignore","pipe","ignore"],timeout:Q});if(ee.error!==void 0||ee.status!==0&&ee.status!==1)return null;return ee.status===0&&Ic(ee.stdout.trim())}function vg(O){return[Lr(O.commonDir,"config"),Lr(O.gitDir,"config.worktree")].filter((D)=>uo(D)).some((D)=>xg(D))}function Eg(){return og.find((O)=>uo(O))??null}function mo(O){return O==="GIT_CONFIG_COUNT"||O==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(O)}function Rg(O){return Object.fromEntries(Object.entries(O).filter(([D])=>!mo(D)))}function xg(O){let D;try{D=fo(O,"utf-8")}catch{return!0}let B="",Q=!1;for(let ee of D.split(/\r?\n/)){let he=ee.trim();if(he===""||he.startsWith("#")||he.startsWith(";"))continue;let je=he.match(/^\[([^\]]+)\]$/);if(je){B=je[1]?.trim().toLowerCase()??"";continue}let at=he.indexOf("="),lt=(at===-1?he:he.slice(0,at)).trim().toLowerCase(),ct=at===-1?"true":he.slice(at+1).trim();if(_g(B)&&lt==="path")return!0;if(B==="submodule"&&lt==="recurse")Q=Ic(ct)}return Q}function _g(O){return O==="include"||O.startsWith("includeif ")}function Ic(O){let D=O.toLowerCase();return D!=="false"&&D!=="no"&&D!=="off"&&D!=="0"}function kc(O,D){if(O==="")return null;let B=fn(),Q=ea(tn(O,O,D,B)),ee=Q?Ag(Q,O,D,B):null;if(!ee)return null;return Object.freeze({entries:Object.freeze([ee.entry]),markerFiles:Object.freeze(ee.markerFile?[ee.markerFile]:[]),directories:Object.freeze(ee.directories),hooksDirectories:Object.freeze(ee.hooksDirectories)})}function Ag(O,D,B,Q){try{let ee=tn(O,D,B,Q),he=wg(O),je=he.isFile()?ee:null,at=he.isFile()?Qs(O):null,lt=(he.isDirectory()?[ee]:[at?.gitDir,at?.commonDir]).flatMap((ut)=>ut?[Wr(tn(ut,D,B,Q))]:[]),ct=[...new Set(he.isDirectory()?[Wr(O.replace(/\\/g,"/")),...lt]:lt)];return{entry:Wr(ee),markerFile:je?Wr(je):null,directories:ct,hooksDirectories:[...new Set(ct.flatMap((ut)=>{let ft=Wr(Pg(ut,"hooks").replace(/\\/g,"/"));return[ft,Wr(tn(ft,D,B,Q))]}))]}}catch{return null}}function Wr(O){return process.platform==="win32"?O.toLowerCase():O}var Dg={realpath:(O)=>{try{return Ig(O)}catch{return null}},entryKind:(O)=>{let D=Tg(O,{throwIfNoEntry:!1});if(!D)return"missing";return D.isSymbolicLink()?"symlink":"present"},isDirectory:(O)=>{try{return kg(O).isDirectory()}catch{return!1}}};function c(){return Ng({env:new Map(Object.entries(process.env).flatMap(([O,D])=>D===void 0?[]:[[O,D]])),home:mn(process.env.HOME||Og()),tmpdir:Mg(),paths:Dg})}function Ng(O,D={}){let B=new Map,Q=new Map,ee={...O,gitMetadata:(he)=>Oc(B,he,()=>kc(he,ee)),worktreeFacts:(he)=>Oc(Q,he,()=>Ac(he)),...D};return ee}function Oc(O,D,B){let Q=O.get(D);if(Q!==void 0)return Q;let ee=B();return O.set(D,ee),ee}import{accessSync as ch,constants as Yc,statSync as uh}from"node:fs";import{isAbsolute as Xc,relative as dh,resolve as fh,sep as mh}from"node:path";var Lg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function z(O){return ke(O.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function ke(O){return Lg.reduce((D,B)=>D.replace(B,"<redacted>"),O.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function Ue(O){return Mc(O).reduceRight((D,B)=>`${D.slice(0,B.valueStart)}<redacted>${D.slice(B.valueEnd)}`,O)}function k(O){return ke(Ue(O))}function Ze(O){return Mc(O).map((D)=>O.slice(D.valueStart,D.valueEnd))}function Ge(O){return/[A-Za-z_][A-Za-z0-9_]*=/.test(O)}function Mc(O){return[...O.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((D)=>{let B=O[D.index-1];if(D.index>0&&B&&!/[\s"'([{]/.test(B))return[];let Q=D.index+D[0].length;if(Q>=O.length)return[];return[{valueStart:Q,valueEnd:Wg(O,Q)}]})}function Wg(O,D){if(O.startsWith("$(",D))return Gg(O,D);let B=O[D];if(B==='"'||B==="'"){for(let ee=D+1;ee<O.length;ee++){if(B==='"'&&O[ee]==="\\"){ee++;continue}if(O[ee]===B)return ee+1}return O.length}let Q=D;while(Q<O.length&&!/\s/.test(O[Q]??""))Q++;return Q}function Gg(O,D){let B=0,Q;for(let ee=D;ee<O.length;ee++){let he=O[ee];if(Q){if(Q==='"'&&he==="\\"){ee++;continue}if(he===Q)Q=void 0;continue}if(he==='"'||he==="'"){Q=he;continue}if(he==="$"&&O[ee+1]==="("){B++,ee++;continue}if(he!==")")continue;if(B--,B===0)return ee+1}return O.length}var Fg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function zg(O){let D=O.maxLen??200,B=O.redact??((ee)=>ee),Q=(ee)=>ee.length>D?`${ee.slice(0,D)}...`:ee;return["BLOCKED by CC Safety Net",`Reason: ${B(O.reason)}`,O.ruleId?`Rule: ${O.ruleId}`:void 0,O.toolName?`Tool: ${O.toolName}`:void 0,O.command?`Command: ${Q(B(O.command))}`:void 0,O.segment&&O.segment!==O.command?`Segment: ${Q(B(O.segment))}`:void 0,O.configWarning?`Config warning: ${B(O.configWarning)}`:void 0,Fg[O.intent??"manual_only"]].filter((ee)=>ee!==void 0).join(`
-
-`)}function ye(O,D){if(O.decision.kind!=="deny")return;let B=D.includeEvidence?O.decision.evidence:void 0;return{reason:O.decision.reason,ruleId:O.decision.ruleId,intent:O.decision.intent,command:B?.command,segment:B?.segment,toolName:D.toolName,...O.configFallback?{configWarning:O.configFallback.reason}:{}}}function P(O={}){return{reason:te,intent:"stop_and_explain",command:O.command,segment:O.segment??O.command,toolName:O.toolName}}function be(O){return zg({...O,redact:z})}function Xe(O){return z(O instanceof Error?O.message:String(O))}import{types as Bg}from"node:util";var $g=new Set(["applypatch","patch"]),Ug=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Hg=new Set(["grep","grepsearch","rg"]),jg=new Set(["find","findbyname","glob"]),Vg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Kg=new Set(["command","diff","input","patch","patchtext"]),Dc=new TextEncoder,qg=new TextDecoder,Yg=/\s/,Zg=64;class f extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var po=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Fc(O){return O.replace(/[-_\s]/g,"").toLowerCase()}function ci(O){return Vg.has(Fc(O))}function V(O){let D=Fc(O);if($g.has(D))return"patch";if(Hg.has(D))return"grep";if(jg.has(D))return"glob";if(Ug.has(D))return"path";return"unknown"}function ne(O){if(!O||typeof O!=="object")return;Vc(O);let D=Object.getOwnPropertyDescriptor(O,"command");if(!D){if("command"in O)Ln();return}if(D.get||D.set)Ln();let B=D.value;return typeof B==="string"&&B!==""?B:void 0}function zc(O,D){return Bc(O,D,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Bc(O,D,B,Q){let ee=jc(O,B,Q);if(!ee)return[];let he=ee.entries.flatMap(([je,at])=>{let lt=Bc(at,D,B,Q+1);return typeof at==="string"&&D.has($c(je))?[at]:lt});return B.ancestors.delete(ee.object),he}function $c(O){return O.replace(/-/g,"_").toLowerCase()}function Uc(O){return Hc(O,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Jg)}function Hc(O,D,B,Q){let ee=jc(O,B,Q);if(typeof O==="string")return D?[O]:[];if(!ee)return[];let he=ee.entries.flatMap(([je,at])=>Hc(at,ee.array?D:Kg.has($c(je)),B,Q+1));return B.ancestors.delete(ee.object),he}function Xg(O,D,B){if(D.nodes++,O!==null&&typeof O==="object"&&B>po.maxDepth||D.nodes>po.maxNodes)Ln();if(typeof O!=="string")return;let Q=Buffer.byteLength(O);if(D.stringBytes+=Q,Q>po.maxStringBytes||D.stringBytes>po.maxAggregateStringBytes)Ln()}function jc(O,D,B){if(Xg(O,D,B),!O||typeof O!=="object")return null;let Q=Vc(O);if(D.ancestors.has(O))Ln();let ee=Reflect.ownKeys(O);if(D.keys+=ee.length,D.keys>po.maxKeys)Ln();let he=ee.flatMap((je)=>{let at=Object.getOwnPropertyDescriptor(O,je);if(!at||at.get||at.set)Ln();return typeof je==="string"&&at.enumerable?[[je,at.value]]:[]});return D.ancestors.add(O),{object:O,array:Q,entries:he}}function Vc(O){if(Bg.isProxy(O))Ln();let D=Array.isArray(O),B=Object.getPrototypeOf(O);if(D&&B!==Array.prototype||!D&&B!==Object.prototype&&B!==null)Ln();return D}function Ln(){throw new f}function Jg(O){let D=[],B=O.split(/\r?\n/),Q=!1,ee=!1,he=null,je=null,at=()=>{ee=!1,he=null,je=null};for(let lt=0;lt<B.length;lt++){let ct=B[lt]??"";if(ct==="*** Begin Patch"){Q=!0,at();continue}if(ct==="*** End Patch"){Q=!1,at();continue}if(ct.startsWith("@@")){let ut=Qg(ct);if(ee=!0,he=ut?.oldLines??null,je=ut?.newLines??null,he===0&&je===0)at();continue}if(ee&&he!==null&&je!==null){let ut=ct.startsWith(" ")||ct.startsWith("-")?1:0,ft=ct.startsWith(" ")||ct.startsWith("+")?1:0;if(he=Math.max(0,he-ut),je=Math.max(0,je-ft),he===0&&je===0)at();continue}if(ct.startsWith("*** ")){at(),D.push(...ta(ct));continue}if(ee)continue;if(ct.startsWith("diff --git ")){D.push(...ta(ct));continue}if(ct.startsWith("--- ")){let ut=B[lt+1]??"";if(!ut.startsWith("+++ "))continue;D.push(...ra(li(ct.slice(4),!0),li(ut.slice(4),!0))),lt++;continue}if(!Q)D.push(...ta(ct))}return D}function Qg(O){let D=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(O);if(!D)return null;return{oldLines:Number(D[1]??1),newLines:Number(D[2]??1)}}function ta(O){let D=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(O);if(D?.[1])return Gc(D[1]);let B=/^\*\*\* Move to: (.+)$/.exec(O);if(B?.[1])return Gc(B[1]);if(O.startsWith("diff --git "))return eh(O.slice(11));let Q=/^--- (.+)$/.exec(O);if(Q?.[1])return Wc(Q[1]);let ee=/^\+\+\+ (.+)$/.exec(O);if(ee?.[1])return Wc(ee[1]);let he=/^(?:rename|copy) (?:from|to) (.+)$/.exec(O);if(he?.[1])return ah(he[1]);return[]}function eh(O){let D=th(O);if(D.length===2&&D[0]&&D[1])return ra(D[0],D[1]);let B=nh(O);return B?ra(O.slice(B.oldStart,B.oldEnd),O.slice(B.newStart,B.newEnd)):[]}function th(O){let D=[],B=0;while(B<O.length&&D.length<2){while(dr(O[B]))B++;if(B>=O.length)break;let Q=O[B]==='"'||O[B]==="'"?O[B]:void 0;if(!Q){let he=B;while(B<O.length&&!dr(O[B]))B++;D.push(O.slice(he,B));continue}let ee=Kc(O,B,Q);if(!ee)return[];D.push(ee.value),B=ee.end}while(dr(O[B]))B++;return B===O.length?D:[]}function nh(O){let D=0;while(D<O.length&&dr(O[D]))D++;let B=O.length;while(B>D&&dr(O[B-1]))B--;let Q=0,ee=D;while(ee<B){if(!dr(O[ee])){ee++;continue}let he=ee;while(ee<B&&dr(O[ee]))ee++;if(he===D||ee===B)continue;if(Q++,Q>Zg)Ln();if(rh(O,D,he,ee,B))return{oldStart:D,oldEnd:he,newStart:ee,newEnd:B}}return null}function rh(O,D,B,Q,ee){if(na(O,D,B,Q,ee))return!0;let he=Nc(O,"/",D,B),je=Nc(O,"/",Q,ee);if(he<=D||je<=Q)return!1;if(na(O,D,he,Q,je))return!1;return na(O,he+1,B,je+1,ee)}function na(O,D,B,Q,ee){if(B-D!==ee-Q)return!1;for(let he=0;he<B-D;he++)if(O[D+he]!==O[Q+he])return!1;return!0}function Nc(O,D,B,Q){for(let ee=B;ee<Q;ee++)if(O[ee]===D)return ee;return-1}function dr(O){return O!==void 0&&Yg.test(O)}function Kc(O,D,B){let Q=[],ee=D+1;while(ee<O.length){let he=String.fromCodePoint(O.codePointAt(ee)??0);if(he===B)return{value:qg.decode(Uint8Array.from(Q)),end:ee+1};if(he!=="\\"||B==="'"){Q.push(...Dc.encode(he)),ee+=he.length;continue}let je=O.slice(ee+1),at=/^[0-7]{1,3}/.exec(je)?.[0];if(at){Q.push(Number.parseInt(at,8)),ee+=at.length+1;continue}Q.push(...Dc.encode(oh(je[0]??""))),ee+=2}return null}function oh(O){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[O]??O}function ih(O){return go(lh(O))}function ra(O,D){if(O==="/dev/null")return Lc(D);if(D==="/dev/null")return Lc(O);if(O.startsWith("a/")&&D.startsWith("b/"))return[O.slice(2),D.slice(2)].flatMap(go);let B=sh(O,D)??(O===D?qc(O):null);return[O,D,...B?[B]:[]].flatMap(go)}function Lc(O){let D=qc(O);return[O,...D?[D]:[]].flatMap(go)}function qc(O){let D=O.indexOf("/");return D>0&&D<O.length-1?O.slice(D+1):null}function sh(O,D){let B=O.indexOf("/"),Q=D.indexOf("/");if(B<1||Q<1)return null;if(O.slice(0,B)===D.slice(0,Q))return null;let ee=O.slice(B+1);return ee===D.slice(Q+1)?ee:null}function Wc(O){return ih(li(O,!0))}function ah(O){return go(li(O,!1))}function li(O,D){let B=O.trim(),Q=B[0]==='"'||B[0]==="'"?B[0]:void 0;if(Q){let ee=Kc(B,0,Q);if(ee&&(D||B.slice(ee.end).trim()===""))return ee.value}return D?B.split("\t",1)[0]?.trim()??"":B}function lh(O){return O.startsWith("a/")||O.startsWith("b/")?O.slice(2):O}function go(O){return O===""||O==="/dev/null"?[]:[O]}function Gc(O){let D=O.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return D===""||D==="/dev/null"?[]:[D]}function ce(O){try{if(!uh(O).isDirectory())return!1;return ch(O,Yc.R_OK|Yc.X_OK),!0}catch{return!1}}function et(O,D,B){if(Jn(O))return;let Q=D.flatMap((he)=>Zc(he,B));if(!Q[0])return;let ee=Zc(Xc(O)?O:fh(Q[0],O),B)[0];if(!ee)return;return Q.some((he)=>ph(ee,he))?ee:void 0}function Zc(O,D){let B=D.realpath(O);if(B===null)return[];return D.isDirectory(B)?[B]:[]}function ph(O,D){let B=dh(D,O);return B===""||B!==".."&&!B.startsWith(`..${mh}`)&&!Xc(B)}var gh=8388608;async function We(O){let D=[],B=0;for await(let Q of O){let ee=typeof Q==="string"?Buffer.from(Q,"utf-8"):Buffer.from(Q.buffer,Q.byteOffset,Q.byteLength);if(B+=ee.byteLength,B>gh)throw hh(O),Error("hook input byte limit exceeded");D.push(ee)}return Buffer.concat(D,B).toString("utf-8")}function hh(O){let D=O.destroy??O.cancel;if(!D)return;try{Promise.resolve(D.call(O)).catch(()=>{})}catch{}}function d(O,D,B,Q,ee){if(B.kind!=="command")return{toolName:O,input:D,route:B,context:Q};return{toolName:O,input:D,route:B,context:Q,command:ee}}var Gr=["fail_closed","paranoid_rm","paranoid_interpreters"],ui={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var o={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},di=["standard","strict","paranoid"];function yh(O,D){if(!D)return O;return di.indexOf(D)>di.indexOf(O)?D:O}function bh(O){let D=ve(o.level,O);if(D===void 0||D==="")return;if(di.includes(D))return D;console.error(`CC Safety Net: ignored invalid ${o.level.name}=${JSON.stringify(D.slice(0,40))}. Use ${di.join(", ")}.`);return}function He(O){if(O===void 0||O==="all")return"all";if(O==="blocked")return"blocked";return"invalid"}function xe(O){return He(ve(o.auditScope,O))==="all"}function oa(O){if(O.failClosed&&O.paranoidRm&&O.paranoidInterpreters)return"paranoid";if(O.failClosed&&!O.paranoidRm&&!O.paranoidInterpreters)return"strict";if(!O.failClosed&&!O.paranoidRm&&!O.paranoidInterpreters)return"standard";return"custom"}function R(O={},D){let B=O.safety?.level??"standard",Q=bh(D),ee=yh(B,Q),he=ui[ee],je={failClosed:he.fail_closed,paranoidRm:he.paranoid_rm,paranoidInterpreters:he.paranoid_interpreters},at={failClosed:ee===B?"preset":"environment",paranoidRm:ee===B?"preset":"environment",paranoidInterpreters:ee===B?"preset":"environment"},lt={failClosed:[`policy safety.level=${B}`],paranoidRm:[`policy safety.level=${B}`],paranoidInterpreters:[`policy safety.level=${B}`]};if(ee!==B)lt.failClosed.push(`env ${o.level.name}=${Q}`),lt.paranoidRm.push(`env ${o.level.name}=${Q}`),lt.paranoidInterpreters.push(`env ${o.level.name}=${Q}`);if(O.safety?.overrides?.failClosed!==void 0)je.failClosed=O.safety.overrides.failClosed,at.failClosed="capability_override",lt.failClosed.push("policy safety.overrides.fail_closed");if(O.safety?.overrides?.paranoidRm!==void 0)je.paranoidRm=O.safety.overrides.paranoidRm,at.paranoidRm="capability_override",lt.paranoidRm.push("policy safety.overrides.paranoid_rm");if(O.safety?.overrides?.paranoidInterpreters!==void 0)je.paranoidInterpreters=O.safety.overrides.paranoidInterpreters,at.paranoidInterpreters="capability_override",lt.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(L(o.strict,D))je.failClosed=!0,at.failClosed="environment",lt.failClosed.push(`env ${o.strict.name}`);if(L(o.paranoid,D))je.paranoidRm=!0,je.paranoidInterpreters=!0,at.paranoidRm="environment",at.paranoidInterpreters="environment",lt.paranoidRm.push(`env ${o.paranoid.name}`),lt.paranoidInterpreters.push(`env ${o.paranoid.name}`);if(L(o.paranoidRm,D))je.paranoidRm=!0,at.paranoidRm="environment",lt.paranoidRm.push(`env ${o.paranoidRm.name}`);if(L(o.paranoidInterpreters,D))je.paranoidInterpreters=!0,at.paranoidInterpreters="environment",lt.paranoidInterpreters.push(`env ${o.paranoidInterpreters.name}`);let ct=!!O.worktreeMode||L(o.worktree,D);return{strict:je.failClosed,paranoidRm:je.paranoidRm,paranoidInterpreters:je.paranoidInterpreters,worktreeMode:ct,effectiveLevel:oa(je),capabilities:{fail_closed:{enabled:je.failClosed,source:at.failClosed,sources:lt.failClosed},paranoid_rm:{enabled:je.paranoidRm,source:at.paranoidRm,sources:lt.paranoidRm},paranoid_interpreters:{enabled:je.paranoidInterpreters,source:at.paranoidInterpreters,sources:lt.paranoidInterpreters}}}}function L(O,D){let B=typeof O==="string"?ho(O,D):ve(O,D);return B==="1"||B?.toLowerCase()==="true"}function ho(O,D){return D.get(O)}function ve(O,D){let B=ho(O.name,D);if(B!==void 0)return B;if(O.legacyName)return ho(O.legacyName,D);return}function Qe(O,D){return ho(O.name,D)!==void 0||!!O.legacyName&&ho(O.legacyName,D)!==void 0}import{dirname as hr}from"node:path";import{closeSync as Sh,constants as yo,fstatSync as ia,fsyncSync as Ch,lstatSync as vn,mkdirSync as Jc,openSync as Qc,readdirSync as aa,readFileSync as vh,realpathSync as Fr,renameSync as Eh,rmdirSync as eu,statSync as sa,unlinkSync as la,writeFileSync as Rh}from"node:fs";import{isAbsolute as tu,join as fr,normalize as xh,parse as fi,relative as ca,resolve as ua,sep as mi}from"node:path";function Re(){let O=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${O()}${O()}`}var _h=Symbol("PolicyFilesystemScope"),wh=Symbol("PolicyFilesystemTarget"),nu=yo.O_NOFOLLOW??0;class r extends Error{name="PolicyFilesystemError";constructor(O){super(`Unable to access ${O} filesystem safely.`)}}function v(O,D){return{[_h]:!0,root:ua(O),label:D}}function bo(O,D){let B=xh(D);if(D===""||tu(D)||B===".."||B.startsWith(`..${mi}`))throw new r(O.label);return{[wh]:!0,scope:O,relativePath:B,path:fr(O.root,B)}}function i(O,D){return bo(O,ca(O.root,ua(D)))}function re(O,D="rules policy"){let B=ua(O),Q=fi(B).dir;return bo(v(Q,D),ca(Q,B))}function n(O){return Fn(O.scope.label,()=>{if(!Zt(O))return null;let D=Qc(O.path,yo.O_RDONLY|nu);return ou(D,()=>{let B=ia(D);if(!B.isFile())throw new r(O.scope.label);let Q=vh(D,"utf-8"),ee=vn(O.path);if(!ee.isFile()||ee.isSymbolicLink()||B.dev!==ee.dev||B.ino!==ee.ino)throw new r(O.scope.label);return Zt(O),Q})})}function g(O,D,B=384,Q){let ee=`${O.path}.${Re()}.tmp`;Fn(O.scope.label,()=>{Ah(O),Zt(O);let he=Qc(ee,yo.O_CREAT|yo.O_EXCL|yo.O_WRONLY|nu,B),je=ou(he,()=>{let at=ia(he);if(!at.isFile())throw new r(O.scope.label);Rh(he,D,"utf-8"),Ch(he);let lt=ia(he);if(!lt.isFile()||lt.dev!==at.dev||lt.ino!==at.ino)throw new r(O.scope.label);return lt});Zt(O),Ih(O,ee,je.dev,je.ino),Eh(ee,O.path),Q?.(O.path),Zt(O)},()=>kh(ee))}function ru(O,D){if(O.path===D.path)return!0;return Fn(O.scope.label,()=>{if(!Zt(O)||!Zt(D))return!1;let B=(Q)=>fr(Fr(fi(Q).dir),fi(Q).base);return B(O.path)===B(D.path)})}function le(O){let D=Fn(O.scope.label,()=>{if(!Zt(O,"directory"))return null;let B=aa(O.path);return Zt(O,"directory"),B});if(!D)return null;return Fn(O.scope.label,()=>{let B=D.map((Q)=>{let ee=bo(O.scope,fr(O.relativePath,Q)),he=vn(ee.path);if(he.isSymbolicLink()||!he.isFile()&&!he.isDirectory())throw new r(O.scope.label);return pi(da(O.scope),Fr(ee.path),O.scope.label),{name:Q,kind:he.isDirectory()?"directory":"file"}});return Zt(O,"directory"),B})}function N(O){Fn(O.scope.label,()=>{if(!Zt(O))return;la(O.path),Zt(O)})}function tt(O){Fn(O.scope.label,()=>{if(!Ph(O))return;su(O),Zt(O,"directory")})}function nt(O){Fn(O.scope.label,()=>{if(!Zt(O,"directory"))return;eu(O.path),Zt(O,"directory")})}function Ph(O){return Fn(O.scope.label,()=>{if(!Zt(O,"directory"))return!1;return iu(O),!0})}function Fn(O,D,B){try{return D()}catch(Q){if(B?.(),Q instanceof r)throw Q;throw new r(O)}}function ou(O,D){try{return D()}finally{Sh(O)}}function Zt(O,D="file"){let B=au(O.scope);if(!B)return!1;let Q=O.relativePath.split(mi);for(let ee of Q.keys()){let he=fr(O.scope.root,...Q.slice(0,ee+1)),je=vn(he,{throwIfNoEntry:!1});if(!je)return!1;if(je.isSymbolicLink())throw new r(O.scope.label);if(ee<Q.length-1&&!je.isDirectory())throw new r(O.scope.label);if(ee===Q.length-1&&(D==="file"?!je.isFile():!je.isDirectory()))throw new r(O.scope.label);pi(B,Fr(he),O.scope.label)}return!0}function iu(O){for(let D of aa(O.path)){let B=bo(O.scope,fr(O.relativePath,D)),Q=vn(B.path);if(Q.isSymbolicLink()||!Q.isDirectory()&&!Q.isFile())throw new r(O.scope.label);if(Q.isDirectory())iu(B)}Zt(O,"directory")}function su(O){for(let D of aa(O.path)){let B=bo(O.scope,fr(O.relativePath,D)),Q=vn(B.path);if(Q.isSymbolicLink())throw new r(O.scope.label);if(Q.isDirectory()){su(B);continue}if(!Q.isFile())throw new r(O.scope.label);la(B.path)}eu(O.path)}function Ah(O){Th(O.scope);let D=da(O.scope),B=O.relativePath.split(mi).slice(0,-1);for(let Q of B.keys()){let ee=fr(O.scope.root,...B.slice(0,Q+1));if(!vn(ee,{throwIfNoEntry:!1}))Jc(ee,{mode:448});let he=vn(ee);if(!he.isDirectory()||he.isSymbolicLink())throw new r(O.scope.label);pi(D,Fr(ee),O.scope.label)}}function Th(O){if(vn(O.root,{throwIfNoEntry:!1})){if(!sa(O.root).isDirectory())throw new r(O.label);return}let D=[],B=O.root;while(!vn(B,{throwIfNoEntry:!1})){D.unshift(B);let Q=fi(B).dir;if(Q===B)throw new r(O.label);B=Q}if(!sa(B).isDirectory())throw new r(O.label);for(let Q of D){Jc(Q,{mode:448});let ee=vn(Q);if(!ee.isDirectory()||ee.isSymbolicLink())throw new r(O.label)}}function au(O){if(!vn(O.root,{throwIfNoEntry:!1}))return null;if(!sa(O.root).isDirectory())throw new r(O.label);return Fr(O.root)}function da(O){let D=au(O);if(!D)throw new r(O.label);return D}function Ih(O,D,B,Q){let ee=vn(D);if(!ee.isFile()||ee.isSymbolicLink()||ee.dev!==B||ee.ino!==Q)throw new r(O.scope.label);pi(da(O.scope),Fr(D),O.scope.label)}function pi(O,D,B){let Q=ca(O,D);if(Q===".."||Q.startsWith(`..${mi}`)||tu(Q))throw new r(B)}function kh(O){try{la(O)}catch{}}import{dirname as mr,isAbsolute as Lh,join as gr,relative as Wh,resolve as pr,sep as Gh}from"node:path";var l=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,ue="rulebook.json",de=".cc-safety-net/rules";var lu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,Oh=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,cu=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Mh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Dh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),rt=new RegExp(`^${Mh}/(${l.source.slice(1,-1)})/${Dh}$`);function Nh(O){return`.cc-safety-net/rules/${O}/rulebook.json`}function uu(O){if(S(O))try{return A(O),null}catch(D){return D instanceof Error?D.message:String(D)}return l.test(O)?null:`Local rulebook sources must be bare names matching ${l}: ${O}`}function A(O){if(O.startsWith("github:"))throw Error(`Invalid rulebook source: ${O}`);let D=O.match(lu);if(!D?.[1]||!D[2]||!D[3])throw Error(`Invalid GitHub rulebook source: ${O}`);let B=D[3].lastIndexOf("/");if(B<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${O}`);let Q=D[3].slice(0,B),ee=D[3].slice(B+1);if(!Q||!cu.test(Q))throw Error(`GitHub rulebook refs must use valid path segments: ${O}`);if(!ee||!l.test(ee))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${O}`);return{owner:D[1],repo:D[2],ref:Q,path:Nh(ee),name:ee}}function q(O){return Oh.test(O)}function oe(O){return cu.test(O)}function S(O){return lu.test(O)}function ot(O){if(!l.test(O))throw Error(`Local rulebook sources must be bare names matching ${l}: ${O}`)}var du="rule.json",gi="policy.json",fu=".cc-safety-net",Fh="rules",zh="CC_SAFETY_NET_HOME",mu="`cc-safety-net rule update`";function Bh(O){return pr(O,de)}function F(O){return gr(Bh(O),du)}function b(O){return gr(pr(O),fu,gi)}function Se(O,D={}){return D.userConfigDir??(D.userConfigPath?mr(D.userConfigPath):gr($h(O),Fh))}function $h(O){let D=O.env.get(zh);return D?pr(mn(D)):gr(O.home,fu)}function M(O,D={}){return gr(Se(O,D),du)}function u(O,D={}){return gr(mr(Se(O,D)),gi)}function K(O,D){let B=D.userConfigPath??M(O,D),Q=D.projectConfigPath??F(D.cwd),ee=Be(O,D),he=ze(Q,D.cwd);return{userConfigPath:B,projectConfigPath:Q,userScope:ee,projectScope:he,userConfigTarget:i(ee,B),projectConfigTarget:i(he,Q)}}function Be(O,D){let B=D.userConfigPath?mr(mr(pr(D.userConfigPath))):mr(pr(D.userConfigDir??Se(O,D)));return v(B,"user policy")}function ze(O,D){let B=pr(D),Q=pr(O),ee=Wh(B,Q);if(ee!==".."&&!ee.startsWith(`..${Gh}`)&&!Lh(ee))return v(B,"project policy");return v(mr(mr(Q)),"project policy")}function I(O,D){return gr(O,D,ue)}var pn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),w=/^[a-zA-Z][a-zA-Z0-9_-]*$/,T=256,Kt=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),pu=new Set(["python","python3","python2","node","ruby","perl"]),hi=/^python(?:[23](?:\.\d+)*)?$/,En=new Set(["awk","gawk","nawk","mawk"]),yi=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var gu="Rulebook exceeds CC Safety Net's safe validation limits.",hu="Additional rulebook validation errors were omitted.",wn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function yu(O){if(fa(O.allowed_commands,wn.maxAllowedCommands)||fa(O.rules,wn.maxRules)||fa(O.tests,wn.maxTests))return!1;let{maxAggregateStringCodeUnits:D,maxTotalBlockArgs:B}=wn,Q=(ee,he=!1)=>{if(typeof ee!=="string")return!0;if(ee.length>wn.maxStringCodeUnits||he&&ee.length>wn.maxFixtureCommandCodeUnits||ee.length>D)return!1;return D-=ee.length,!0};if(!Q(O.name)||!Q(O.version)||!Q(O.description)||!Q(O.author)||!Q(O.migrated_from))return!1;if(Array.isArray(O.allowed_commands)){for(let ee of O.allowed_commands)if(!Q(ee))return!1}if(Array.isArray(O.rules))for(let ee of O.rules){if(!ee||typeof ee!=="object")continue;let he=ee;if(!Q(he.name)||!Q(he.command)||!Q(he.subcommand)||!Q(he.reason)||!Q(he.intent))return!1;let je=he.match&&typeof he.match==="object"?he.match:{};for(let at of[he.block_args,je.command_path,je.any_args,je.exclude_args]){if(!Array.isArray(at))continue;if(at.length>wn.maxBlockArgsPerRule||at.length>B)return!1;B-=at.length;for(let lt of at)if(!Q(lt))return!1}}if(Array.isArray(O.tests))for(let ee of O.tests){if(!ee||typeof ee!=="object")continue;let he=ee;if(!Q(he.command,!0)||!Q(he.expect)||!Q(he.rule))return!1}return!0}function fa(O,D){return Array.isArray(O)&&O.length>D}var ma=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var pe=64,fe="Rule config exceeds CC Safety Net's safe source limit.";function kt(O){return Tt(O).toLowerCase()}function Tt(O){return O.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??O}function sn(O,D){let B=new Set,Q=!1;for(let ee of O){if(ee==="--"){Q=!0;continue}if(Q)continue;if(ee.startsWith("-")&&!ee.startsWith("--")&&ee.length>1)for(let he=1;he<ee.length;he++){let je=ee[he];if(!je||!/[a-zA-Z]/.test(je))break;let at=`-${je}`;if(B.add(at),D?.shortOptsWithValue?.has(at))break}}return B}var Uh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},pa=new Set(["--init-file","--rcfile"]);function ga(O,D,B,Q){let ee=!1,he=0,je=!1,at=!1,lt=!1;for(let ct=1;ct<D.length;ct++){let ut=D[ct];if(ut===void 0)break;if(O==="ksh"&&ut==="o"&&ct+1<D.length){if(Q==="argv"){let ft=D.slice(ct+1);if(D[0]==="-"&&(ft==="c"||ft[0]==="-"&&ft.endsWith("c")))je=!0}break}if(O==="ksh"&&ut==="o"&&ct+1===D.length&&(B?.startsWith("-")||B?.startsWith("+")))break;if(O==="zsh"&&ut==="o"&&ct+1<D.length)break;if(Q==="startup"&&ut==="i")ee=D[0]==="-";if(Q==="argv"&&D[0]==="-"&&ut==="c")je=!0;if(Q==="argv"&&ut==="n")lt=D[0]==="-";if(Q==="argv"&&ut==="s")at=D[0]==="-";if(!Uh[O]?.includes(ut))continue;if(ct+1===D.length)he++;break}return{interactive:ee,followingValues:he,commandSelected:je,stdinMode:at,syntaxCheck:lt}}function gn(O){let D=Tt(O[0]??"").toLowerCase(),B=!1,Q=!1,ee=!1;for(let he=1;he<O.length;he++){let je=O[he];if(je===void 0)break;if(je==="--"){let lt=B&&O[he+1]!==void 0?he+1:null;return{command:lt===null?null:O[lt]??null,commandIndex:lt,scriptIndex:!B&&!Q&&O[he+1]!==void 0?he+1:null,readsStdinAsCommands:!B&&(Q||O[he+1]===void 0),syntaxCheck:ee}}if(je==="-"||je[0]!=="-"&&je[0]!=="+")return{command:B?je:null,commandIndex:B?he:null,scriptIndex:!B&&!Q&&je!=="-"?he:null,readsStdinAsCommands:!B&&(Q||je==="-"),syntaxCheck:ee};if(je.startsWith("--")){let lt=je.split("=",1)[0]??je;if(D==="bash"&&pa.has(lt)&&!je.includes("="))he++;continue}let at=ga(D,je,O[he+1],"argv");if(at.commandSelected)B=!0;if(at.syntaxCheck)ee=!0;if(at.stdinMode)Q=!0;he+=at.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!B,syntaxCheck:ee}}function So(O,D){if(D.escaped)return D.escaped=!1,!0;if(O==="\\"&&!D.inSingle)return D.escaped=!0,!0;if(O==="'"&&!D.inDouble)return D.inSingle=!D.inSingle,!0;if(O==='"'&&!D.inSingle)return D.inDouble=!D.inDouble,!0;return!1}function bi(O){let D={inSingle:!1,inDouble:!1,escaped:!1};for(let B of Hh(O))So(B,D);return D.inSingle||D.inDouble}function Hh(O){let D="",B={inSingle:!1,inDouble:!1,escaped:!1},Q=!1,ee=!0;for(let he=0;he<O.length;he++){let je=O[he];if(!je)break;if(Q){if(je===`
-`||je==="\r")D+=je,Q=!1,B.escaped=!1;continue}if(je==="#"&&!B.inSingle&&!B.inDouble&&ee){Q=!0;continue}if(D+=je,!B.inSingle&&!B.inDouble&&!B.escaped)ee=/[\s;&|()<>]/.test(je);So(je,B)}return D}var ha=new Set(["rm","find","xargs","parallel"]),jh=new Set(["git","busybox",...ha,...Kt,...pu,...En]),Vh=new Set(["python","node","ruby","perl"]);function Le(O){let D=kt(O);return jh.has(D)||Pn(D)}function Pn(O){return Vh.has(Kh(O))}function Kh(O){let D=Tt(O).toLowerCase();return hi.test(D)?"python":D}var it={version:1,rules:[],overrides:{},transparent_wrappers:[]};function m(O){try{let D=n(qh(O));if(D===null)return{config:null,errors:[]};if(!D.trim())return{config:null,errors:["Config file is empty"]};let B=JSON.parse(D),Q=Ve(B);if(Q.errors.length>0)return{config:null,errors:Q.errors};return{config:{version:1,rules:B.rules??[],overrides:B.overrides??{},transparent_wrappers:B.transparent_wrappers??[]},errors:[]}}catch(D){if(D instanceof r)return{config:null,errors:[D.message]};let B=D instanceof Error?D.message:String(D);return{config:null,errors:[D instanceof SyntaxError?"Invalid JSON":B]}}}function qh(O){return typeof O==="string"?re(O):O}var e=(O,D)=>({path:O,message:D,kind:"typed"}),Xt=(O,D)=>({path:O,message:D,kind:"custom"});function Te(O){let D=new Set;return O.flatMap((B,Q)=>{let ee=zr(B)?B.name:void 0;if(typeof ee!=="string")return[];if(D.has(ee.toLowerCase()))return[Xt(["rules",Q,"name"],`duplicate rule name "${ee}"`)];return D.add(ee.toLowerCase()),[]})}var we=`must be one of ${ma.join(", ")}`,Yh=/^[^/]+\/[^/]+$/,Zh=["version","rules","overrides","transparent_wrappers"];function Ve(O){let D=Xh(O);return{errors:ie(qe(D,Zh,(B)=>B.kind==="custom"),": "," "),sources:iy(O,D)}}function Xh(O){if(!zr(O))return[e([],"Config must be an object")];let D=Array.isArray(O.rules)&&O.rules.length>pe;return[...O.version===1?[]:[e(["version"],"must be 1")],...Jh(O.rules,D),...ty(O.overrides),...ry(O.transparent_wrappers),...D?[]:ey(O.rules),...zr(O.overrides)?Object.keys(O.overrides).filter((B)=>!Yh.test(B)).map((B)=>Xt(["overrides",B],"must use <rulebook-name>/<rule-name>")):[],...oy(O.transparent_wrappers)]}function Jh(O,D){if(O===void 0)return[];if(!Array.isArray(O))return[e(["rules"],"must be an array of rulebook source strings"),...bu(O,pe)?[e(["rules"],fe)]:[]];if(D)return[{path:["rules"],message:fe,kind:"limit"}];return O.flatMap((B,Q)=>{if(typeof B!=="string")return[e(["rules",Q],"must be a rulebook source string"),...Qh(B,1)?[e(["rules",Q],"must be a non-empty rulebook source string")]:[]];return B===""?[e(["rules",Q],"must be a non-empty rulebook source string")]:[]})}function bu(O,D){let B=Su(O);return B!==void 0&&!(B<=D)}function Qh(O,D){let B=Su(O);return B!==void 0&&!(B>=D)}function Su(O){if(O===null||O===void 0)return;let D=O.length;return D===void 0?void 0:Number(D)}function ey(O){if(!Array.isArray(O))return[];let D=new Set;return O.flatMap((B,Q)=>{if(typeof B!=="string"||B==="")return[];if(B.trim()==="")return[Xt(["rules",Q],"must be a non-empty rulebook source string")];let ee=uu(B);if(ee)return[Xt(["rules",Q],ee)];if(D.has(B))return[Xt(["rules",Q],`duplicate rulebook source "${B}"`)];return D.add(B),[]})}function ty(O){if(O===void 0)return[];if(!zr(O))return[e(["overrides"],"must be an object if provided")];return Object.keys(O).flatMap((D)=>{let B=O[D];if(B==="off")return[];if(!zr(B))return[e(["overrides",D],'must be "off" or an object')];return[...ny(B.reason,["overrides",D,"reason"]),...B.intent===void 0||Ce(B.intent)?[]:[e(["overrides",D,"intent"],we)]]})}function ny(O,D){if(typeof O!=="string")return[e(D,"required non-empty string"),...bu(O,T)?[e(D,`must be at most ${T} characters`)]:[]];if(O==="")return[e(D,"required non-empty string")];return O.length>T?[e(D,`must be at most ${T} characters`)]:[]}function ry(O){if(O===void 0)return[];if(!Array.isArray(O))return[e(["transparent_wrappers"],"must be an array of command strings")];return O.flatMap((D,B)=>{if(typeof D!=="string")return[e(["transparent_wrappers",B],"must be a command string")];return w.test(D)?[]:[e(["transparent_wrappers",B],"must match command pattern")]})}function oy(O){if(!Array.isArray(O))return[];let D=new Set;return O.flatMap((B,Q)=>{if(typeof B!=="string"||!w.test(B))return[];if(D.has(B))return[Xt(["transparent_wrappers",Q],`duplicate command "${B}"`)];if(Le(B))return[Xt(["transparent_wrappers",Q],`reserved command "${B}" cannot be a wrapper`)];return D.add(B),[]})}function iy(O,D){let B=zr(O)?O.rules:void 0;if(!Array.isArray(B))return new Set;if(D.some((ee)=>ee.path.length===1&&ee.path[0]==="rules"))return new Set;let Q=new Set(D.filter((ee)=>ee.path[0]==="rules"&&typeof ee.path[1]==="number").map((ee)=>ee.path[1]));return new Set(B.filter((ee,he)=>typeof ee==="string"&&!Q.has(he)))}function qe(O,D,B){let Q=O.map((je)=>je.path[1]),ee=[...new Set(Q.filter((je)=>typeof je==="string"))],he=(je,at)=>[je.path.length===0?-1:D.indexOf(String(je.path[0])),typeof at==="number"?at:ee.indexOf(String(at)),B(je)?0:1];return O.map((je,at)=>({issue:je,rank:he(je,Q[at])})).sort((je,at)=>je.rank[0]-at.rank[0]||je.rank[1]-at.rank[1]||je.rank[2]-at.rank[2]).map((je)=>je.issue)}function ie(O,D,B){return[...new Set(O.map((Q)=>{let ee=ya(Q.path);if(Q.kind==="unknownKeys")return`${ee?`${ee}.`:""}unknown field "${Q.message}"`;if(Q.kind==="key"||Q.kind==="limit"||Q.path.length===0)return Q.message;return`${ee}${Q.path.length===1?B:D}${Q.message}`}))]}function ya(O){return O.map((D,B)=>{if(typeof D==="number")return`[${D}]`;return B===0?String(D):`.${String(D)}`}).join("")}function Ce(O){return ma.includes(O)}function zr(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function se(O){let D=ly(O);if(D.errors.length>0)throw Error(D.errors.join("; "));return O}var sy=`required non-empty string up to ${T} characters`,Cu="must be a non-empty array of unique non-empty strings",ay="required non-empty array of non-empty strings";function ly(O){if(!Qn(O))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!yu(O))return{errors:[gu],ruleNames:new Set};let D=[...O.rulebook_version===1||O.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ie(cy(O,O.rulebook_version===2),": ",": ")];return{errors:D.length>wn.maxValidationErrors?[...D.slice(0,wn.maxValidationErrors),hu]:D,ruleNames:new Set(_e(O).map((B)=>B.toLowerCase()))}}function _e(O){let D=Qn(O)?O.rules:void 0;return(Array.isArray(D)?D:[]).flatMap((B)=>{let Q=Qn(B)?B.name:void 0;return typeof Q==="string"?[Q]:[]})}function cy(O,D){return[...typeof O.name==="string"&&l.test(O.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof O.version==="string"&&O.version!==""?[]:[e(["version"],"required non-empty string")],...uy(O.allowed_commands),...dy(O.rules,D),...gy(O.tests),...hy(O),...yy(O)]}function uy(O){if(!Array.isArray(O))return[e(["allowed_commands"],"required array")];let D=new Set;return[...O.flatMap((B,Q)=>typeof B==="string"&&w.test(B)?[]:[e(["allowed_commands",Q],"must match command pattern")]),...O.flatMap((B,Q)=>{if(typeof B!=="string"||!w.test(B))return[];if(D.has(B))return[Xt(["allowed_commands",Q],`duplicate command "${B}"`)];return D.add(B),[]})]}function dy(O,D){if(!Array.isArray(O))return[e(["rules"],"required array")];return[...O.flatMap((B,Q)=>{if(!Qn(B))return[e(["rules",Q],"must be an object")];return D?my(B,["rules",Q]):fy(B,["rules",Q])}),...Te(O)]}function fy(O,D){return[...vu(O.name,D),...Eu(O.command,D),...O.subcommand===void 0||typeof O.subcommand==="string"&&w.test(O.subcommand)?[]:[e([...D,"subcommand"],"must match command pattern")],...Si(O.block_args,[...D,"block_args"],"required non-empty array",!1),...Ru(O.reason,D),...xu(O.intent,D)]}function my(O,D){return[...vu(O.name,D),...Eu(O.command,D),...Ru(O.reason,D),...xu(O.intent,D),...py(O.match,[...D,"match"]),...O.subcommand===void 0?[]:[e([...D,"subcommand"],"not supported in rulebook_version 2")],...O.block_args===void 0?[]:[e([...D,"block_args"],"not supported in rulebook_version 2")]]}function vu(O,D){if(typeof O!=="string")return[e([...D,"name"],"required string")];return l.test(O)?[]:[e([...D,"name"],"must match rule name pattern")]}function Eu(O,D){return typeof O==="string"&&w.test(O)?[]:[e([...D,"command"],"required string matching command pattern")]}function Ru(O,D){return typeof O==="string"&&O!==""&&O.length<=T?[]:[e([...D,"reason"],sy)]}function xu(O,D){return O===void 0||Ce(O)?[]:[e([...D,"intent"],we)]}function py(O,D){if(!Qn(O))return[e(D,"required object")];return[...Si(O.command_path,[...D,"command_path"],ay,!1),...O.any_args===void 0?[]:Si(O.any_args,[...D,"any_args"],Cu,!0),...O.exclude_args===void 0?[]:Si(O.exclude_args,[...D,"exclude_args"],Cu,!0)]}function Si(O,D,B,Q){if(!Array.isArray(O))return[e(D,B)];let ee=O.flatMap((he,je)=>{if(typeof he!=="string")return[e([...D,je],"must be a non-empty string")];return he===""?[Xt([...D,je],"must be a non-empty string")]:[]});if(O.some((he)=>typeof he!=="string"))return ee;return[...ee,...O.length===0?[Xt(D,B)]:[],...Q&&new Set(O).size!==O.length?[Xt(D,"must not contain duplicate values")]:[]]}function gy(O){if(O===void 0)return[];if(!Array.isArray(O))return[e(["tests"],"must be an array if provided")];return O.flatMap((D,B)=>{if(!Qn(D))return[e(["tests",B],"must be an object")];return[...typeof D.command==="string"&&D.command.trim()!==""?[]:[e(["tests",B,"command"],"required non-empty string")],...D.expect==="blocked"||D.expect==="allowed"?[]:[e(["tests",B,"expect"],'must be "blocked" or "allowed"')],...D.rule===void 0||typeof D.rule==="string"?[]:[e(["tests",B,"rule"],"must be a string if provided")],...D.expect==="blocked"&&typeof D.rule!=="string"?[Xt(["tests",B,"rule"],"required string for blocked fixtures")]:[]]})}function hy(O){if(!Array.isArray(O.tests))return[];let D=new Set(_e(O));return[...new Set(O.tests.flatMap((B)=>Qn(B)&&B.expect==="blocked"&&typeof B.rule==="string"?[B.rule]:[]))].filter((B)=>!D.has(B)).map((B)=>Xt(["tests"],`blocked fixture references unknown rule "${B}"`))}function yy(O){if(!Array.isArray(O.allowed_commands)||!Array.isArray(O.rules))return[];let D=new Set(O.allowed_commands.filter((B)=>typeof B==="string"));return O.rules.flatMap((B,Q)=>{let ee=Qn(B)?B.command:void 0;if(typeof ee!=="string"||D.has(ee))return[];return[Xt(["rules",Q,"command"],`"${ee}" must be listed in allowed_commands`)]})}function Qn(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function J(O,D){let B=K(O,D),Q=!1;try{Q=ru(B.userConfigTarget,B.projectConfigTarget)}catch(mt){if(mt instanceof r)return wy(B,mt.message);throw mt}let ee=m(B.userConfigTarget),he=Q?{config:null,errors:[]}:m(B.projectConfigTarget),je=wu(B.userConfigPath,ee.errors),at=wu(B.projectConfigPath,he.errors),lt=new Set,ct=ee.config?ba(ee.config,hr(B.userConfigPath),"user",B.userScope,lt):Pu(),ut=he.config?ba(he.config,hr(B.projectConfigPath),"project",B.projectScope,lt):Pu(),ft=ee.config?.overrides??{},dt=he.config?.overrides??{};return{rules:[..._u(ct.rules,ft),..._u(ut.rules,dt)],transparent_wrappers:xy(ee.config,he.config),rulebooks:[...ct.rulebooks,...ut.rulebooks],errors:[...je,...at,...ct.errors,...ut.errors],warnings:[...ct.warnings,...ut.warnings,...ct.canValidateOverrides?Sa(ft,ct.knownRuleIds,B.userConfigPath):[],...ct.canValidateOverrides?_y(dt,ct.knownRuleIds,B.projectConfigPath):[],...ut.canValidateOverrides?Sa(dt,ut.knownRuleIds,B.projectConfigPath):[]],userConfig:ee.config??void 0,projectConfig:he.config??void 0,...B}}function j(O,D){let B=by(O,D);if(!B)return[];return[...B.scope.errors,...B.scope.warnings,...Sy(B.config,B.scope,O)]}function by(O,D){let B=D??v(hr(hr(O)),"rules policy"),Q=m(i(B,O)).config;if(!Q)return null;return{config:Q,scope:ba(Q,hr(O),"project",B)}}function Sy(O,D,B){return D.canValidateOverrides?Sa(O.overrides??{},D.knownRuleIds,B):[]}function ba(O,D,B,Q=v(hr(hr(D)),B==="user"?"user policy":"project policy"),ee=new Set){let he=[],je=[],at=O.rules.flatMap((ct)=>{let ut=vy(ct,D,Q);if(ut.errors.length>0||!ut.rulebook)return he.push(...ut.errors),[];let ft=ut.rulebook;if(ee.has(ft.name))return je.push(`duplicate active rulebook name "${ft.name}" for ${ct}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return ee.add(ft.name),[{rules:Cy(ft),rulebook:{source:B,spec:ct,name:ft.name,version:ft.version,rules:ft.rules.map((dt)=>`${ft.name}/${dt.name}`)}}]}),lt=at.flatMap((ct)=>ct.rules);return{rules:lt,rulebooks:at.map((ct)=>ct.rulebook),knownRuleIds:new Set(lt.map((ct)=>ct.name)),errors:he,warnings:je,canValidateOverrides:he.length===0}}function Cy(O){if(O.rulebook_version===2)return O.rules.map((D)=>({name:`${O.name}/${D.name}`,command:D.command,block_args:[],match:D.match,reason:D.reason,intent:D.intent}));return O.rules.map((D)=>({...D,name:`${O.name}/${D.name}`,match:void 0}))}function vy(O,D,B){let Q=Pe(O),ee=I(D,Q),he=Ry(ee,B);if("error"in he)return{rulebook:null,errors:[he.error]};if(he.content===null)return{rulebook:null,errors:[`missing rulebook file ${ee} for ${O}; ${Ey(O)}`]};let je=me(he.content);if("problem"in je)return{rulebook:null,errors:[`invalid rulebook ${ee}: ${je.problem}; fix that file`]};if(je.rulebook.name!==Q)return{rulebook:null,errors:[`rulebook name "${je.rulebook.name}" in ${ee} must match source "${O}"; fix that file`]};return{rulebook:je.rulebook,errors:[]}}function Pe(O){return S(O)?A(O).name:O}function Ey(O){return S(O)?`run ${mu} to vendor ${O}`:"create that file or remove that source from the rules config"}function Ry(O,D){try{return{content:n(i(D,O))}}catch(B){if(B instanceof r)return{error:B.message};throw B}}function me(O){let D;try{D=JSON.parse(O)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:se(D)}}catch(B){return{problem:B instanceof Error?B.message:"invalid rulebook"}}}function xy(O,D){return[...new Set([...O?.transparent_wrappers??[],...D?.transparent_wrappers??[]])]}function _u(O,D){return O.flatMap((B)=>{let Q=D[B.name];if(Q==="off")return[];if(Q&&typeof Q==="object")return[{...B,intent:Q.intent??B.intent,reason:Q.reason}];return[B]})}function Sa(O,D,B){return Object.keys(O).filter((Q)=>!D.has(Q)).map((Q)=>`unknown override key "${Q}" in ${B}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function _y(O,D,B){return Object.keys(O).filter((Q)=>D.has(Q)).map((Q)=>`project override cannot target user-scoped rule "${Q}" in ${B}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function wu(O,D){return D.map((B)=>B.startsWith("Unable to access ")?B:`${O}: ${B}`)}function wy(O,D){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[D],warnings:[],userConfigPath:O.userConfigPath,projectConfigPath:O.projectConfigPath}}function Pu(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Gy,readFileSync as Fy}from"node:fs";var Au=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Ca=new Set(Au.map((O)=>O.id)),U=Au,Py=new Map(U.map((O)=>[O.id,O.intent]));function St(O,D){return{id:O,reason:D,intent:Py.get(O)??"manual_only"}}var va=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Ci={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Ay=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Ty=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ea=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Ty.flatMap((O)=>Ay.map((D)=>({id:["secret.home",O.idSlug,D.slice(1)].join("."),category:"Home path",label:[O.label,D].join(""),description:["Blocks home ",O.label,D," credential backup files."].join(""),suffixParts:[...O.directoryParts,[O.basename,D].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var vi=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Tu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Iy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Ra=Tu.map((O)=>({id:`secret.variant.${O.slug}.separator`,category:"Variant",label:`${O.label}-* / ${O.label}_*`,description:`Blocks ${O.label} variants with dash or underscore suffixes.`,prefix:O.prefix})),xa=Tu.flatMap((O)=>Iy.map((D)=>({id:`secret.variant.${O.slug}.${D.slice(1)}`,category:"Variant",label:`${O.label}${D}`,description:`Blocks ${O.label}${D} private credential variants.`,prefix:O.prefix,suffix:D}))),Co={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},_a=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((O)=>({id:`secret.ext.${O}`,category:"Extension",label:`.${O}`,description:`Blocks files with the .${O} extension.`,extension:O})),wa=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Ke=[...va,Ci,...Ea,...Ra,...xa,Co,..._a,...wa,...vi].map((O)=>({id:O.id,category:O.category,label:O.label,...O.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in O?{paths:O.paths}:{description:O.description}})),Ei=new Set(vi.flatMap((O)=>O.category==="Coding CLI config"?[O.id]:[])),Pa=new Set(Ke.map((O)=>O.id));import{isAbsolute as Aa,join as ky,normalize as Oy,sep as Ri}from"node:path";var Iu=process.platform==="win32",My=/[*?]/;function vo(O,D){if(O==="~")return D;if(O.startsWith("~/"))return`${D}${O.slice(1)}`;return O}function Ta(O,D){if(typeof O!=="string"||O.trim()==="")return"must be a non-empty path string";let B=vo(O.trim(),D);if(!Aa(B))return"must be an absolute path or start with ~/";return Eo(B,D)}function Ia(O,D){let B=ku(O,D);if(B===null)return"must be a non-empty path string";if(!Aa(B))return null;if(Eo(B,D)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Dy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Ny="cannot cover the guard's own configuration";function ku(O,D){if(typeof O!=="string"||O.trim()==="")return null;return vo(O.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),D)}function ka(O,D){let B=ku(O,D);if(B===null)return"must be a non-empty path string";if(My.test(B))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!Aa(B))return null;if(Eo(B,D)!==null)return Dy;return Ly(B,D)?Ny:null}function Ly(O,D){let B=xi(O),Q=xi(ky(D,".cc-safety-net"));return B===Q||B.startsWith(`${Q}${Ri}`)}function Eo(O,D){let B=xi(O),Q=xi(D);if(B===Q)return"cannot be the home directory";let ee=B.endsWith(Ri)?B:`${B}${Ri}`;if(Q.startsWith(ee))return"cannot contain the home directory";return null}function xi(O){let D=Oy(O);if(Iu)D=D.replace(/\//g,"\\").toLowerCase();if(D.length>(Iu?3:1)&&D.endsWith(Ri))D=D.slice(0,-1);return D}var Ou=30,_i=1,wi=365;function Mu(O){if(typeof O!=="number"||!Number.isInteger(O))return 30;if(O<1)return 1;return O>365?365:O}var Du=new Set(U.filter((O)=>O.catastrophic).map((O)=>O.id));function wt(O,D){if(!O)return null;if(Du.has(O.id))return O;if(D?.destructiveCommandProtectionEnabled===!1)return null;let B=D?.effectiveDestructiveCommandRules[O.id];return B&&!B.enabled?null:O}function Jt(O,D,B){if(Du.has(D))return!0;if(O?.destructiveCommandProtectionEnabled===!1)return!1;return O?.effectiveDestructiveCommandRules[D]?.enabled??B}function G(O,D){return Object.freeze(Object.fromEntries(U.map((B)=>{let Q=B.activationCapability?D[B.activationCapability]:void 0,ee=Q?.enabled??!0,he=O.destructiveCommandRuleOverrides[B.id],je=B.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...he?{override:he}:{}}:O.destructiveCommandProtectionEnabled?he?{enabled:he==="on",inheritedEnabled:ee,changesInherited:he==="on"!==ee,source:"rule_override",...B.activationCapability?{activationCapability:B.activationCapability}:{},override:he}:{enabled:ee,inheritedEnabled:ee,changesInherited:!1,source:Q?.source??"built_in_default",...B.activationCapability?{activationCapability:B.activationCapability}:{}}:{enabled:!1,inheritedEnabled:ee,changesInherited:!1,source:"master_disabled",...B.activationCapability?{activationCapability:B.activationCapability}:{},...he?{override:he}:{}};return[B.id,Object.freeze(je)]})))}function Nu(O,D){return Object.freeze({...O,effectiveDestructiveCommandRules:G(O,D)})}var Lu={standard:0,strict:1,paranoid:2};function Y(O,D){return{policy:{version:1,safety:{level:D.safety?.level??O.safety.level,overrides:{...O.safety.overrides,...D.safety?.overrides}},workflow:{worktree_mode:D.workflow?.worktree_mode??O.workflow.worktree_mode},destructive_command_protection:{enabled:D.destructive_command_protection?.enabled??O.destructive_command_protection.enabled,overrides:{...O.destructive_command_protection.overrides,...D.destructive_command_protection?.overrides},allow_paths:Oa(O.destructive_command_protection.allow_paths,D.destructive_command_protection?.allow_paths)},secret_protection:{enabled:D.secret_protection?.enabled??O.secret_protection.enabled,overrides:{...O.secret_protection.overrides,...D.secret_protection?.overrides},deny_paths:Oa(O.secret_protection.deny_paths,D.secret_protection?.deny_paths),allow_paths:Oa(O.secret_protection.allow_paths,D.secret_protection?.allow_paths)},audit:O.audit},weakenings:Wy(O,D)}}function Oa(O,D){return[...new Set([...O,...D??[]])]}function Wy(O,D){let B=D.safety?.level,Q=ui[O.safety.level];return[...B&&Lu[B]<Lu[O.safety.level]?[`project policy lowers level: ${O.safety.level} -> ${B}`]:[],...Gr.flatMap((ee)=>D.safety?.overrides?.[ee]===!1&&(O.safety.overrides[ee]??Q[ee])?[`project policy disables ${ee}`]:[]),...D.workflow?.worktree_mode===!0&&!O.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...D.destructive_command_protection?.enabled===!1&&O.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...D.secret_protection?.enabled===!1&&O.secret_protection.enabled?["project policy disables secret protection"]:[],...Wu(D.destructive_command_protection?.overrides,(ee)=>O.destructive_command_protection.enabled&&O.destructive_command_protection.overrides[ee]!=="off"),...Wu(D.secret_protection?.overrides,(ee)=>O.secret_protection.enabled&&(O.secret_protection.overrides[ee]==="on"?!0:O.secret_protection.overrides[ee]!=="off"&&!Ei.has(ee))),...O.destructive_command_protection.enabled?Gu(O.destructive_command_protection.allow_paths,D.destructive_command_protection?.allow_paths).map((ee)=>`project policy adds destructive allow path: ${ee}`):[],...O.secret_protection.enabled?Gu(O.secret_protection.allow_paths,D.secret_protection?.allow_paths).map((ee)=>`project policy adds secret allow path: ${ee}`):[]]}function Wu(O,D){return Object.entries(O??{}).flatMap(([B,Q])=>Q==="off"&&D(B)?[`project policy disables rule ${B}`]:[])}function Gu(O,D){return(D??[]).filter((B)=>!O.includes(B))}var Na=new Set(["standard","strict","paranoid"]),Z={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Ou}};function $u(O,D){let B=jy(u(O,D),O.home),Q=Ie(b(D.cwd),O.home),ee=ae(Q.parsed,O.home),he=Object.keys(ee.policy).length>0?Y(B.gui??Z,ee.policy):void 0,je=[...B.errors,...Q.errors,...ee.diagnostics],at=(B.fallback==="defaults"&&he?"salvaged":B.fallback)??(B.gui?void 0:Q.fallback)??(je.length>0?"salvaged":void 0),lt=ee.policy.safety?.level?"project":B.levelPresent?"user":"default";return{...he?Da(he.policy):B.policy,errors:je,...at?{fallback:at}:{},...Q.exists?{policyScopes:{levelScope:lt,weakenings:he?.weakenings??[]}}:{}}}var zy="project policy audit settings are ignored; audit is user scope only";function ae(O,D){if(!hn(O))return{policy:{},diagnostics:[]};let B=hn(O.safety)?O.safety:{},Q=hn(O.workflow)?O.workflow:{},ee=hn(O.destructive_command_protection)?O.destructive_command_protection:{},he=hn(O.secret_protection)?O.secret_protection:{},je={...Na.has(B.level)?{level:B.level}:{},...hn(B.overrides)?Fu({overrides:Uu(B.overrides,Gr,["safety","overrides"],yr)}):{}},at={...typeof ee.enabled==="boolean"?{enabled:ee.enabled}:{},...ee.overrides!==void 0?{overrides:Pi(ee.overrides,Ca,ju,yr)}:{},...ee.allow_paths!==void 0?{allow_paths:$r(ee.allow_paths,Ta,D,["destructive_command_protection","allow_paths"],yr)}:{}},lt={...typeof he.enabled==="boolean"?{enabled:he.enabled}:{},...he.overrides!==void 0?{overrides:Pi(he.overrides,Pa,Vu,yr)}:{},...he.deny_paths!==void 0?{deny_paths:$r(he.deny_paths,Ia,D,["secret_protection","deny_paths"],yr)}:{},...he.allow_paths!==void 0?{allow_paths:$r(he.allow_paths,ka,D,["secret_protection","allow_paths"],yr)}:{}};return{policy:Fu({safety:je,workflow:typeof Q.worktree_mode==="boolean"?{worktree_mode:Q.worktree_mode}:{},destructive_command_protection:at,secret_protection:lt}),diagnostics:O.audit===void 0?[]:[zy]}}function Uu(O,D,B,Q){return Object.fromEntries(D.flatMap((ee)=>{let he=O[ee];if(typeof he==="boolean")return[[ee,he]];if(he!==void 0)Q(e([...B,ee],La));return[]}))}function Fu(O){return Object.fromEntries(Object.entries(O).flatMap((D)=>Object.keys(D[1]).length>0?[D]:[]))}var yr=()=>{return},La="must be a boolean",Wa="must be an object if provided",Hu=`must be an integer between ${_i} and ${wi}`,ju={path:["destructive_command_protection","overrides"],label:"destructive command"},Vu={path:["secret_protection","overrides"],label:"secret protection"},Je=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Ye(O,D){let B=[];return{policy:Ku(O,D,(ee)=>{B.push(ee)}),issues:B}}function C(O,D){return Ku(O,D,yr)}function Ku(O,D,B){if(!hn(O))return B(e([],"Config must be an object")),H();if(O.version!==1)B(e(["version"],"must be 1"));let Q=Br(O.safety,["safety"],["level","overrides"],B),ee=Br(Q.overrides,["safety","overrides"],Gr,B),he=Br(O.workflow,["workflow"],["worktree_mode"],B),je=Br(O.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],B),at=Br(O.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],B),lt=Br(O.audit,["audit"],["retention_days"],B);return qu(O,Je,[],B),{version:1,safety:{level:By(Q.level,B),overrides:Uu(ee,Gr,["safety","overrides"],B)},workflow:{worktree_mode:Ma(he.worktree_mode,["workflow","worktree_mode"],!1,B)},destructive_command_protection:{enabled:Ma(je.enabled,["destructive_command_protection","enabled"],!0,B),overrides:Pi(je.overrides,Ca,ju,B),allow_paths:$r(je.allow_paths,Ta,D,["destructive_command_protection","allow_paths"],B)},secret_protection:{enabled:Ma(at.enabled,["secret_protection","enabled"],!0,B),overrides:Pi(at.overrides,Pa,Vu,B),deny_paths:$r(at.deny_paths,Ia,D,["secret_protection","deny_paths"],B),allow_paths:$r(at.allow_paths,ka,D,["secret_protection","allow_paths"],B)},audit:{retention_days:$y(lt.retention_days,B)}}}function Br(O,D,B,Q){if(O===void 0)return{};if(!hn(O))return Q(e(D,Wa)),{};return qu(O,B,D,Q),O}function qu(O,D,B,Q){for(let ee of Object.keys(O).filter((he)=>!D.includes(he)))Q({path:B,message:ee,kind:"unknownKeys"})}function By(O,D){if(O===void 0)return"standard";if(Na.has(O))return O;return D(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Ma(O,D,B,Q){if(typeof O==="boolean")return O;if(O!==void 0)Q(e(D,La));return B}function $y(O,D){if(!(O===void 0||typeof O==="number"&&Number.isInteger(O)&&O>=_i&&O<=wi))D(e(["audit","retention_days"],Hu));return Mu(O)}function Pi(O,D,B,Q){if(O===void 0)return{};if(!hn(O))return Q(e(B.path,Wa)),{};return Object.fromEntries(Object.entries(O).flatMap(([ee,he])=>{if(!D.has(ee))return Q({path:[...B.path,ee],message:`unknown ${B.label} rule id "${ee}"`,kind:"key"}),[];if(he==="on"||he==="off")return[[ee,he]];return Q(e([...B.path,ee],'must be "on" or "off"')),[]}))}function $r(O,D,B,Q,ee){if(O===void 0)return[];if(!Array.isArray(O))return ee(e(Q,"must be an array of paths")),[];return O.flatMap((he,je)=>{let at=D(he,B);if(at===null)return[he];return ee(typeof he==="string"?Xt([...Q,je],at):e([...Q,je],at)),[]})}function hn(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function H(){return structuredClone(Z)}function Ae(O,D){let B=R({safety:De(O.safety)},D),Q=G({destructiveCommandProtectionEnabled:O.destructive_command_protection.enabled,destructiveCommandRuleOverrides:O.destructive_command_protection.overrides},B.capabilities),ee=Object.values(Q),he=ee.filter((je)=>je.source!=="catastrophic");return{selectedPreset:O.safety.level,effectiveLevel:B.effectiveLevel,capabilities:B.capabilities,rules:Q,counts:{enabled:he.filter((je)=>je.enabled).length,disabled:he.filter((je)=>!je.enabled).length,effectiveCustomizations:ee.filter((je)=>je.changesInherited).length}}}function Ie(O,D){if(!Gy(O))return{exists:!1,policy:H(),errors:[]};try{let B=Fy(O,"utf-8");if(!B.trim())return{exists:!0,policy:H(),errors:[`${O}: Config file is empty`],fallback:"defaults"};let Q=JSON.parse(B),ee=Ye(Q,D);if(ee.issues.length===0)return{exists:!0,parsed:Q,policy:ee.policy,errors:[]};return{exists:!0,parsed:Q,policy:ee.policy,errors:ee.issues.map((he)=>`${O}: ${Hy(he)}`),fallback:hn(Q)?"salvaged":"defaults"}}catch(B){let Q=B instanceof Error?B.message:String(B);return{exists:!0,policy:H(),errors:[`${O}: ${B instanceof SyntaxError?"Invalid JSON":Q}`],fallback:"defaults"}}}var Uy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Wa,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[La,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Hu,`not an integer between ${_i} and ${wi}`]]);function Hy(O){let D=ya(O.path);if(O.kind==="unknownKeys")return`${D===""?"":`${D}.`}${O.message}: unknown field`;if(O.kind==="key")return`${D}: unknown rule id`;let B=Uy.get(O.message)??O.message;return D===""?B:`${D}: ${B}`}function jy(O,D){let B=Ie(O,D);if(!B.exists){let Q=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!hn(Q))return{policy:Bu(),errors:[]};let ee=C(Q,D);return{policy:Da(ee),gui:ee,errors:[],levelPresent:zu(Q)}}if(B.parsed===void 0)return{policy:Bu(),errors:B.errors,...B.fallback?{fallback:B.fallback}:{}};return{policy:Da(B.policy),gui:B.policy,errors:B.errors,...B.fallback?{fallback:B.fallback}:{},levelPresent:zu(B.parsed)}}function zu(O){let D=hn(O)&&hn(O.safety)?O.safety:{};return Na.has(D.level)}function Oe(O){let D=Object.entries(O),B=new Set(D.flatMap(([Q,ee])=>ee==="on"?[Q]:[]));return[...new Set([...[...Ei].filter((Q)=>!B.has(Q)),...D.flatMap(([Q,ee])=>ee==="off"?[Q]:[])])]}function Bu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Oe({}),denyPaths:[],allowPaths:[]}}}function Da(O){return{safety:De(O.safety),worktreeMode:O.workflow.worktree_mode,destructiveCommandProtectionEnabled:O.destructive_command_protection.enabled,destructiveCommandRuleOverrides:O.destructive_command_protection.overrides,destructiveCommandAllowPaths:O.destructive_command_protection.allow_paths,secretProtection:{enabled:O.secret_protection.enabled,disabledRules:Oe(O.secret_protection.overrides),denyPaths:O.secret_protection.deny_paths,allowPaths:O.secret_protection.allow_paths}}}function De(O){let D={...O.overrides.fail_closed!==void 0?{failClosed:O.overrides.fail_closed}:{},...O.overrides.paranoid_rm!==void 0?{paranoidRm:O.overrides.paranoid_rm}:{},...O.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:O.overrides.paranoid_interpreters}:{}};return{level:O.level,...Object.keys(D).length>0?{overrides:D}:{}}}function E(O,D){let B=J(O,D),Q=$u(O,D),ee={rules:B.rules,transparentWrappers:B.transparent_wrappers,safety:Q.safety,worktreeMode:Q.worktreeMode,destructiveCommandProtectionEnabled:Q.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:Q.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:Q.destructiveCommandAllowPaths,secretProtection:{enabled:Q.secretProtection.enabled??!0,disabledRules:Q.secretProtection.disabledRules??[],denyPaths:Q.secretProtection.denyPaths,allowPaths:Q.secretProtection.allowPaths??[]}},he={...B.userConfig?.overrides??{},...B.projectConfig?.overrides??{}},je=Object.freeze(Object.fromEntries(ee.rules.map((at)=>{let lt=B.rulebooks.find((ut)=>ut.rules.includes(at.name)),ct=he[at.name];return[at.name,Object.freeze({id:at.name,...lt?{rulebook:Object.freeze({name:lt.name,version:lt.version}),...Yy(lt.spec)?{source:lt.spec}:{}}:{},...ct&&typeof ct==="object"?{override:Object.freeze({type:"reason",reason:ct.reason})}:{}})]})));return Ee(ee,Vy(B,Q),je,Q.policyScopes)}function Ne(O){if(O.state==="ready")return{state:O.state};return{state:O.state,reason:O.reason}}function Vy(O,D){let B=qy(D);if(O.errors.length===0&&O.warnings.length===0&&!B)return;return{diagnostics:[...O.errors,...O.warnings,...D.errors],reason:Zy(O.errors.length>0?Ky(O.errors):void 0,O.warnings.length>0?Fa(O.warnings.join("; ")):void 0,B)}}function Ky(O){return`${Fa(O.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function qy(O){if(O.errors.length===0)return;let D=O.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${O.errors.join("; ")}. Enforcing ${D}; the invalid values are not active. Fix the policy file manually`}function Yy(O){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(O)}function Ee(O,D,B=Object.freeze({}),Q){let ee=Ga(structuredClone(O)),he=Q?{policyScopes:Ga(structuredClone(Q))}:{};if(!D)return Object.freeze({state:"ready",policy:ee,diagnostics:Object.freeze([]),ruleMetadata:B,...he});return Object.freeze({state:"degraded",policy:ee,diagnostics:Object.freeze([...D.diagnostics]),reason:D.reason,ruleMetadata:B,...he})}function Ga(O){if(typeof O!=="object"||O===null)return O;for(let D of Object.values(O))Ga(D);return Object.freeze(O)}function Zy(...O){return Fa(O.filter((D)=>!!D).join("; "))}function Fa(O){return/[.!?]$/.test(O)?O:`${O}.`}function Fe(O){let D=O.effectiveCapabilities,B=O.strict??D.fail_closed.enabled,Q=O.paranoidRm??D.paranoid_rm.enabled,ee=O.paranoidInterpreters??D.paranoid_interpreters.enabled,he={fail_closed:za(D.fail_closed,O.strict,"strict"),paranoid_rm:za(D.paranoid_rm,O.paranoidRm,"paranoidRm"),paranoid_interpreters:za(D.paranoid_interpreters,O.paranoidInterpreters,"paranoidInterpreters")};return{policy:Nu(O.policySnapshot.policy,he),effectiveCapabilities:he,effectiveLevel:oa({failClosed:B,paranoidRm:Q,paranoidInterpreters:ee}),strict:B,paranoidRm:Q,paranoidInterpreters:ee,worktreeMode:O.worktreeMode??!1}}function za(O,D,B){if(D===void 0||D===O.enabled)return O;return{enabled:D,source:"capability_override",sources:[...O.sources,`analysis options.${B}`]}}function Ro(O,D){if(O!=="powershell")return D[0]?.provenance==="command-substitution";let B=D[0]?.text==="&"||D[0]?.text==="."?1:0,Q=D[B]?.provenance;return Q!==void 0&&Q!=="literal"}var Xy=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ai(O,D){return O?.provenance==="literal"&&!O.quoted&&O.raw===D&&O.text===D}function xo(O){let D=Ai(O.words[0],"time")?1:0,B=D===1&&Ai(O.words[D],"-p")?D+1:D,Q=D===1&&Ai(O.words[B],"--")?B+1:B,ee=Ai(O.words[Q],"!")?Q+1:Q,he=O.words.slice(ee).find((je)=>!Xy.test(je.text));return he?.provenance==="literal"?he.text:void 0}var er=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Ti(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Jy(O){return Object.freeze({...O,span:Object.freeze(O.span),words:Object.freeze(O.words),redirections:Object.freeze(O.redirections.map((D)=>Object.freeze({...D,span:Object.freeze(D.span),...D.heredoc?{heredoc:Object.freeze({...D.heredoc,bodySpan:Object.freeze(D.heredoc.bodySpan),terminatorSpan:Object.freeze(D.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(O.nested.map((D)=>an(D)))})}function Ii(O,D,B){O.push(B),D.reset()}function ki(O){let D=[];return{parts:D,push:(B,Q,ee)=>{if(Q<=B)return;D.push({raw:O.slice(B,Q),span:{start:B,end:Q},provenance:ee})}}}function Ba(O){let D=O.parts??[{raw:O.raw,span:O.span,provenance:O.provenance}];return Object.freeze({kind:"word",...O,span:Object.freeze(O.span),parts:Object.freeze(D.map((B)=>Object.freeze({...B,span:Object.freeze(B.span)})))})}function Ur(O,D,B,Q,ee,he,je){return Ba({text:Q,raw:O.slice(D,B),span:{start:D,end:B},provenance:ee,quoted:he,...je?{parts:je}:{}})}function an(O){return Object.freeze({...O,span:Object.freeze(O.span),issues:Object.freeze(O.issues.map((D)=>Object.freeze({...D}))),nodes:Object.freeze(O.nodes.map((D)=>{if(D.kind==="command")return Jy(D);if(D.kind==="group"||D.kind==="function")return Object.freeze({...D,span:Object.freeze(D.span),body:an(D.body)});return Object.freeze({...D,span:Object.freeze(D.span)})}))})}function $a(O,D,B){if(D>=B||Zu(O[D]??""))return null;let Q="",ee=!1,he=!1,je=D;while(je<B&&!Zu(O[je]??"")){let at=O[je]??"";if(at==="'"){ee=!0;let lt=Yu(O,je+1,B,"'");Q+=lt.text,he||=!lt.closed,je=lt.next;continue}if(at==='"'){ee=!0;let lt=Yu(O,je+1,B,'"');Q+=lt.text,he||=!lt.closed,je=lt.next;continue}if(at==="\\"){ee=!0;let lt=O[je+1];if(!lt||lt===`
-`||lt==="\r"){he=!0;break}Q+=lt,je+=2;continue}if(at==="`"||O.startsWith("$(",je)||O.startsWith("${",je)||O.startsWith("<(",je)||O.startsWith(">(",je))he=!0;Q+=at,je++}return{delimiter:Q,quoted:ee,next:je,ambiguous:he}}function Ua(O,D,B,Q){let ee=[],he=D;for(let je of Q){let at=he,lt=!1;while(he<B){let ct=Qy(O,he,B);if((je.stripTabs?ct.text.replace(/^\t+/,""):ct.text)===je.delimiter){je.attach({body:je.stripTabs?eb(O.slice(at,he)):O.slice(at,he),delimiter:je.delimiter,quotedDelimiter:je.quotedDelimiter,bodySpan:{start:at,end:he},terminatorSpan:{start:he,end:ct.contentEnd}}),he=ct.next,lt=!0;break}if(ct.next<=he)break;he=ct.next}if(lt)continue;return ee.push({code:"unterminated-heredoc",message:`heredoc delimiter ${je.delimiter} was not found`}),{next:B,issues:ee,terminated:!1}}return{next:he,issues:ee,terminated:!0}}function Yu(O,D,B,Q){let ee="",he=D;while(he<B&&O[he]!==`
-`&&O[he]!=="\r"){let je=O[he]??"";if(je===Q)return{text:ee,next:he+1,closed:!0};if(Q==='"'&&je==="\\"&&O[he+1]){let at=O[he+1]??"";ee+=["$","`",'"',"\\"].includes(at)?at:`\\${at}`,he+=2;continue}ee+=je,he++}return{text:ee,next:he,closed:!1}}function Zu(O){return O!=="\r"&&(/[\s;&|<>)]/u.test(O)||O==="`")}function Qy(O,D,B){let Q=D;while(Q<B&&O[Q]!==`
-`)Q++;let ee=Q>=B?B:Q+1;return{text:O.slice(D,Q),contentEnd:Q,next:ee}}function eb(O){return O.replace(/(^|\r\n?|\n)\t+/g,"$1")}var ed=new Set(["&&","||","|","|&"]);function td(O,D){let B={start:0,end:O.length};if(O.length>D.maxInputLength)return an({kind:"program",dialect:"posix",source:O,span:B,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${D.maxInputLength} UTF-16 code units`}],nodes:[]});let Q=Di(O,0,O.length,D,{used:0,max:D.maxWords},0);return an({kind:"program",dialect:"posix",source:O,span:B,status:Wi(Q.issues,Q.limited),issues:Q.issues,nodes:Q.nodes})}function Di(O,D,B,Q,ee,he,je){let at=[],lt=[],ct=Ti(),ut=[],ft=()=>{if(ct.words.length===0&&ct.redirections.length===0)return;let mt={start:ct.start,end:ct.end},pt=ct.words.map((ht)=>ht.text);Ii(at,ct,{kind:"command",dialect:"posix",source:O.slice(mt.start,mt.end),span:mt,words:ct.words,redirections:ct.redirections,nested:ct.nested,displayText:lt.length>0&&at.length===0?O.slice(D,B):pt.join(" ")})},dt=D;while(dt<B){let mt=O[dt];if(!mt)break;if(je&&mt===je)return ft(),Qu(at,lt),{nodes:at,issues:lt,next:dt+1,closed:!0,limited:!1,pendingHeredocs:ut};if(Li(mt)){if(mt===`
-`||mt==="\r"){ft();let Ct=mt==="\r"&&O[dt+1]===`
-`?dt+2:dt+1,Pt=at.at(-1);if(Pt?.kind!=="connector"||!ed.has(Pt.operator))at.push(Object.freeze({kind:"connector",operator:O.slice(dt,Ct),span:Object.freeze({start:dt,end:Ct})}));if(ut.length>0){let Rt=Ua(O,Ct,B,ut.splice(0));lt.push(...Rt.issues),dt=Rt.next;continue}dt=Ct;continue}dt++;continue}if(mt==="#"){while(dt<B&&O[dt]!==`
-`&&O[dt]!=="\r")dt++;continue}let pt=ct.start===-1?vb(O,dt,B):void 0;if(pt){if(ja(at,lt),he>=Q.maxDepth)return Hr(at,lt,dt,"depth-limit",Q.maxDepth);if(!Ha(ee))return Hr(at,lt,dt,"word-limit",Q.maxWords);let Ct=Di(O,pt.braceIndex+1,B,Q,ee,he+1,"}"),Pt=Ct.next,Rt={start:pt.braceIndex+1,end:Ct.closed?Pt-1:Pt},_t=Xu(O,Rt,Ct);if(at.push({kind:"function",name:pt.name,span:{start:dt,end:Pt},body:_t}),lt.push(...Ct.issues),Ct.pendingHeredocs.length>0||wo(Ct.nodes))lt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(ut.push(...Ct.pendingHeredocs),Ct.limited)return Mi(at,lt,Ct.next);if(!Ct.closed)lt.push({code:"unclosed-function-body",message:"function body is not closed"});dt=Pt;continue}let ht=Ni(O,dt);if(ht){if(ft(),!cd(at.at(-1)))lt.push({code:"unexpected-connector",message:`connector ${ht} has no preceding command`});at.push(Object.freeze({kind:"connector",operator:ht,span:Object.freeze({start:dt,end:dt+ht.length})})),dt+=ht.length;continue}if(mt===")"){ft(),lt.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),at.push({kind:"unknown",source:mt,span:{start:dt,end:dt+1}}),dt++;continue}if((mt==="("||mt==="{"&&lb(O,dt,B))&&ct.start===-1){if(ja(at,lt),he>=Q.maxDepth)return Hr(at,lt,dt,"depth-limit",Q.maxDepth);let Ct=mt==="("?")":"}",Pt=Di(O,dt+1,B,Q,ee,he+1,Ct),Rt=Pt.next,_t={start:dt+1,end:Pt.closed?Rt-1:Rt},Ut=Xu(O,_t,Pt);if(at.push({kind:"group",style:mt==="("?"subshell":"brace",span:{start:dt,end:Rt},body:Ut}),lt.push(...Pt.issues),Pt.pendingHeredocs.length>0||wo(Pt.nodes))lt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(ut.push(...Pt.pendingHeredocs),Pt.limited)return Mi(at,lt,Pt.next);if(!Pt.closed)lt.push({code:mt==="("?"unclosed-subshell":"unclosed-brace-group",message:`${mt} group is not closed`});dt=Rt;continue}let gt=(mt==="<"||mt===">")&&O[dt+1]!=="("?ob(O,dt):null;if(gt){let Ct=ct.words.at(-1),Pt=Ct&&Ct.span.end===dt&&/^[0-9]+$/.test(Ct.raw)?Number(Ct.raw):void 0;if(Pt!==void 0)ct.words.pop();let Rt=Pt===void 0?dt:Ct?.span.start??dt;ct.start=ct.start===-1?dt:ct.start;let _t=dt+gt.length;while(_t<B&&/[ \t]/.test(O[_t]??""))_t++;let Ut=O[_t],jt=_t>dt+gt.length&&Ut==="#",qt=!Ut||Li(Ut)||!!Ni(O,_t)||Ut===je||Ut===")"||jt||(Ut==="<"||Ut===">")&&O[_t+1]!=="(",Vt=gt==="<<"||gt==="<<-",Ft=Vt?$a(O,_t,B):void 0,Ot=Ft?{word:Ur(O,_t,Ft.next,Ft.delimiter,"literal",Ft.quoted),nested:[],issues:[],next:Ft.next,limited:!1}:!qt?Va(O,_t,B,Q,ee,he):void 0;if(Ot){if(lt.push(...Ot.issues),Ot.limited)return Mi(at,lt,Ot.next);if(!Ha(ee))return Hr(at,lt,Ot.next,"word-limit",Q.maxWords)}let rn=Ot?.next??dt+gt.length,Cn={kind:"redirection",operator:gt,span:{start:Rt,end:rn},...Pt===void 0?{}:{fd:Pt},...Ot?{target:Ot.word}:{}};if(ct.redirections.push(Cn),Vt&&!Ft)lt.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(Ft){if(Ft.ambiguous||Ft.delimiter.length===0)lt.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Gn=ct.nested;ut.push({delimiter:Ft.delimiter,quotedDelimiter:Ft.quoted,stripTabs:gt==="<<-",attach:(_n)=>{if(Cn.heredoc=_n,_n.quotedDelimiter)return;Gn.push(...nb(O,_n.bodySpan.start,_n.bodySpan.end,Q,ee,he+1))}})}if(!Vt&&!Ot)lt.push({code:"missing-redirection-target",message:`redirection ${gt} requires a target word`});if(Ot)ct.nested.push(...Ot.nested);ct.end=rn,dt=rn;continue}if(ct.start===-1)ja(at,lt);let yt=Va(O,dt,B,Q,ee,he);if(lt.push(...yt.issues),yt.limited)return Mi(at,lt,yt.next);let vt=db(ct.words)?hb(O,yt.word,ee.max-ee.used,Q.maxDepth,Q.maxInputLength):void 0;if(vt?.limitCode)return Hr(at,lt,yt.next,vt.limitCode,vt.limitCode==="word-limit"?Q.maxWords:vt.limitCode==="depth-limit"?Q.maxDepth:Q.maxInputLength);let Et=vt?.words??[yt.word];for(let Ct of Et){if(!Ha(ee))return Hr(at,lt,yt.next,"word-limit",Q.maxWords);ct.words.push(Ct)}ct.start=ct.start===-1?dt:ct.start,ct.end=yt.next,ct.nested.push(...yt.nested),dt=yt.next>dt?yt.next:dt+1}return ft(),Qu(at,lt),lt.push(...Eb(ut)),{nodes:at,issues:lt,next:dt,closed:je===void 0,limited:!1,pendingHeredocs:[]}}function Xu(O,D,B){return{kind:"program",dialect:"posix",source:O.slice(D.start,D.end),span:D,status:Wi(B.issues,B.limited),issues:B.issues,nodes:B.nodes}}function Va(O,D,B,Q,ee,he){let je="",at=D,lt=!1,ct="literal",ut=[],ft=[],dt=!1;while(at<B){let mt=O[at],pt=(mt==="<"||mt===">")&&O[at+1]==="(";if(!mt||Li(mt)||(mt===";"||mt==="|"||mt==="&")&&Ni(O,at)||(mt==="<"||mt===">")&&!pt)break;if(mt===")")break;if(mt==="'"){lt=!0;let gt=O.indexOf("'",at+1);if(gt===-1||gt>=B){je+=O.slice(at+1,B),ft.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),at=B;break}je+=O.slice(at+1,gt),at=gt+1;continue}if(mt==='"'){lt=!0;let gt=tb(O,at,B,Q,ee,he);if(je+=gt.text,ut.push(...gt.nested),ft.push(...gt.issues),dt||=gt.limited,ct=_o(ct,gt.provenance),at=gt.next,dt)break;continue}if(O.startsWith("$'",at)){lt=!0;let gt=ib(O,at+2,B);if(je+=gt.text,ft.push(...gt.issues),!gt.closed)ft.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});at=gt.next;continue}if(mt==="\\"){let gt=O[at+1];if(!gt){ft.push({code:"trailing-escape",message:"escape has no following character"}),at++;break}if(gt===`
-`){at+=2;continue}je+=gt,at+=2;continue}let ht=mt==="$"||mt==="<"||mt===">"||mt==="`"?Gi(O,at,B,Q,ee,he):null;if(ht){let gt=nd(ht,ut,ft);if(dt||=gt.limited,ct=_o(ct,gt.provenance),at=gt.next,dt)break;continue}if(mt==="$"){let gt=id(O,at,B,je,ct);je=gt.text,ct=gt.provenance,at=gt.next;continue}if(mt==="*"||mt==="?"||mt==="[")ct=_o(ct,"glob");je+=mt,at++}return{word:Ur(O,D,at,je,ct,lt,ct==="literal"?void 0:ab(O,D,at)),nested:ut,issues:ft,next:at,limited:dt}}function tb(O,D,B,Q,ee,he){let je="",at="literal",lt=[],ct=[],ut=!1,ft=D+1;while(ft<B){let dt=O[ft];if(dt==='"')return{text:je,provenance:at,nested:lt,issues:ct,next:ft+1,limited:ut};if(dt==="\\"&&O[ft+1]){let pt=O[ft+1]??"";if(pt===`
-`){ft+=2;continue}if(pt==="\r"&&O[ft+2]===`
-`){ft+=3;continue}je+=["$","`",'"',"\\"].includes(pt)?pt:`\\${pt}`,ft+=2;continue}if(O.startsWith("$((",ft)){let pt=Ka(O,ft+3,B,"))"),ht=pt===-1?B:pt+2;if(je+=O.slice(ft,ht),pt===-1)ct.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});ft=ht;continue}let mt=Gi(O,ft,B,Q,ee,he);if(mt){let pt=nd(mt,lt,ct);if(ft=pt.next,ut||=pt.limited,at=_o(at,pt.provenance),ut)return{text:je,provenance:at,nested:lt,issues:ct,next:ft,limited:ut};continue}if(dt==="$"){let pt=id(O,ft,B,je,at);je=pt.text,at=pt.provenance,ft=pt.next;continue}je+=dt??"",ft++}return ct.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:je,provenance:at,nested:lt,issues:ct,next:B,limited:ut}}function Gi(O,D,B,Q,ee,he){let je=O.startsWith("$((",D),at=O.startsWith("$(",D)&&!je,lt=O.startsWith("<(",D)||O.startsWith(">(",D),ct=O[D]==="`";if(!je&&!at&&!lt&&!ct)return null;let ut=je?3:ct?1:2,ft=je?"))":ct?"`":")",dt=Ka(O,D+ut,B,ft),mt=dt===-1?B:dt,pt=dt===-1?B:dt+ft.length;if(he>=Q.maxDepth)return{program:Cb(O,D+ut,mt,"depth-limit"),next:pt,provenance:je?"arithmetic":"command-substitution"};if(je){let vt=[],Et=[],Ct=!1,Pt=D+ut;while(Pt<mt){let Rt=Gi(O,Pt,mt,Q,ee,he+1);if(!Rt){Pt++;continue}if(vt.push(...Rt.program.nodes),Et.push(...Rt.program.issues),Ct||=Rt.program.status==="limited",Pt=Rt.next,Ct)break}if(dt===-1)Et.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:an({kind:"program",dialect:"posix",source:O.slice(D+ut,mt),span:{start:D+ut,end:mt},status:Wi(Et,Ct),issues:Et,nodes:vt}),next:pt,provenance:"arithmetic"}}let ht=Di(O,D+ut,mt,Q,ee,he+1),gt=dt===-1?[{code:"unclosed-command-substitution",message:`${O.slice(D,D+ut)} substitution is not closed`}]:[],yt=(ct||lt)&&wo(ht.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:an({kind:"program",dialect:"posix",source:O.slice(D+ut,mt),span:{start:D+ut,end:mt},status:Wi([...ht.issues,...gt,...yt],ht.limited),issues:[...ht.issues,...gt,...yt],nodes:ht.nodes}),next:pt,provenance:"command-substitution"}}function nb(O,D,B,Q,ee,he){let je=[],at=D;while(at<B){let lt=O[at];if(lt==="\\"){at+=2;continue}let ct=lt==="$"||lt==="`"?Gi(O,at,B,Q,ee,he):null;if(!ct){at++;continue}if(je.push(ct.program),at=ct.next,ct.program.status==="limited")break}return je}function nd(O,D,B){return D.push(O.program),B.push(...O.program.issues),{provenance:O.provenance,next:O.next,limited:O.program.status==="limited"}}function Ka(O,D,B,Q){if(Q==="`"){for(let at=D;at<B;at++){if(O[at]==="\\"){at++;continue}if(O[at]==="`")return at}return-1}let ee=1,he={single:!1,double:!1},je=[];for(let at=D;at<B;at++){let lt=O[at];if((lt===`
-`||lt==="\r")&&je.length>0){let ut=lt==="\r"&&O[at+1]===`
-`?at+2:at+1,ft=Ua(O,ut,B,je.splice(0));if(!ft.terminated)return-1;at=ft.next-1;continue}let ct=rd(O,at,D,B,he);if(ct!==null){at=ct;continue}if(!he.double&&O.startsWith("$((",at)){let ut=rb(O,at+3,B);if(ut===-1)return-1;at=ut+1;continue}if(Q===")"&&!he.double&&lt==="<"&&O[at+1]==="<"&&O[at+2]!=="<"){let ut=O[at+2]==="-",ft=at+(ut?3:2);while(ft<B&&/[ \t]/.test(O[ft]??""))ft++;let dt=$a(O,ft,B);if(dt){je.push({delimiter:dt.delimiter,quotedDelimiter:dt.quoted,stripTabs:ut,attach:()=>{return}}),at=dt.next-1;continue}}if(O.startsWith("$(",at)&&!O.startsWith("$((",at)){ee++,at++;continue}if(lt==="("&&!he.double)ee++;if(lt===")"&&!he.double){if(ee--,ee===0)return Q==="))"&&O[at+1]!==")"?-1:at}}return-1}function rb(O,D,B){let Q=1,ee={single:!1,double:!1};for(let he=D;he<B;he++){let je=O[he],at=rd(O,he,D,B,ee);if(at!==null){he=at;continue}if(O.startsWith("$(",he)&&!O.startsWith("$((",he)){Q++,he++;continue}if(je==="("&&!ee.double)Q++;if(je!==")"||ee.double)continue;if(Q--,Q===0)return O[he+1]===")"?he:-1}return-1}function rd(O,D,B,Q,ee){let he=O[D];if(he==="\\"&&!ee.single)return D+1;if(!ee.double&&he==="'")ee.single=!ee.single;if(!ee.single&&he==='"')ee.double=!ee.double;if(ee.single)return D;if(ee.double||he!=="#"||!Rb(O,D,B))return null;let je=D;while(je+1<Q&&O[je+1]!==`
-`&&O[je+1]!=="\r")je++;return je}function Ni(O,D){let B=O[D];if(B===";")return";";if(B==="&")return O[D+1]==="&"?"&&":"&";if(B==="|")return O[D+1]==="|"?"||":O[D+1]==="&"?"|&":"|";return null}function ob(O,D){let B=O[D];if(B===">"){if(O[D+1]===">")return">>";if(O[D+1]==="&")return">&";return O[D+1]==="|"?">|":">"}if(B!=="<")return null;if(O.startsWith("<<<",D))return"<<<";if(O.startsWith("<<-",D))return"<<-";if(O[D+1]==="<")return"<<";if(O[D+1]==="&")return"<&";if(O[D+1]===">")return"<>";return"<"}function Li(O){let D=O.charCodeAt(0);if(D===32||D>=9&&D<=13)return!0;if(D<128)return!1;return/\s/u.test(O)}function od(O,D,B){if(O[D+1]==="{"){let ee=O.indexOf("}",D+2);return ee===-1||ee>=B?B:ee+1}let Q=D+1;while(Q<B&&/[A-Za-z0-9_?@#$!*-]/.test(O[Q]??""))Q++;return Q===D+1?D+1:Q}function ib(O,D,B){let Q="",ee=[],he=D;while(he<B){let je=O[he];if(je==="'")return{text:Q,next:he+1,closed:!0,issues:ee};if(je!=="\\"){Q+=je??"",he++;continue}let at=sb(O,he+1,B);if(Q+=at.text,at.invalidCodePoint!==void 0)ee.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${at.invalidCodePoint}`});he=at.next}return{text:Q,next:B,closed:!1,issues:ee}}function sb(O,D,B){let Q=O[D];if(!Q||D>=B)return{text:"\\",next:D};let ee=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(ee.has(Q))return{text:ee.get(Q)??Q,next:D+1};if(Q==="x")return Oi(O,D+1,B,16,2,D+1);if(Q==="u")return Oi(O,D+1,B,16,4,D+1);if(Q==="U")return Oi(O,D+1,B,16,8,D+1);if(/[0-7]/.test(Q))return Oi(O,D,B,8,3,D+1);return{text:Q,next:D+1}}function Oi(O,D,B,Q,ee,he){let je=Q===16?/[0-9a-fA-F]/:/[0-7]/,at="",lt=D;while(lt<B&&at.length<ee&&je.test(O[lt]??""))at+=O[lt],lt++;if(!at)return{text:O[he-1]??"",next:he};let ct=Number.parseInt(at,Q);return ct>1114111||ct>=55296&&ct<=57343?{text:"�",next:lt,invalidCodePoint:ct}:{text:String.fromCodePoint(ct),next:lt}}function Wi(O,D=!1){if(D)return"limited";if(O.some((B)=>B.code==="invalid-ansi-c-code-point"||B.code==="missing-heredoc-delimiter"||B.code==="ambiguous-heredoc-delimiter"||B.code==="unterminated-heredoc"||B.code==="unsupported-heredoc-context"))return"invalid";return O.length>0?"partial":"complete"}function id(O,D,B,Q,ee){let he=od(O,D,B);return{text:Q+O.slice(D,he),provenance:_o(ee,"variable"),next:he}}function ab(O,D,B){let Q=ki(O),ee=D,he=!1,je=!1,at=D;while(at<B){let lt=O[at];if(lt==="\\"&&!he){at+=2;continue}if(!je&&lt==="'"){he=!he,at++;continue}if(!he&&lt==='"'){je=!je,at++;continue}if(he){at++;continue}let ct=O.startsWith("$((",at),ut=O.startsWith("$(",at)&&!ct,ft=!je&&(O.startsWith("<(",at)||O.startsWith(">(",at)),dt=lt==="`";if(ct||ut||ft||dt){let mt=ct?3:dt?1:2,pt=ct?"))":dt?"`":")",ht=Ka(O,at+mt,B,pt),gt=ht===-1?B:ht+pt.length;Q.push(ee,at,"literal"),Q.push(at,gt,ct?"arithmetic":"command-substitution"),at=gt,ee=gt;continue}if(lt==="$"){let mt=od(O,at,B);if(mt>at+1){Q.push(ee,at,"literal"),Q.push(at,mt,"variable"),at=mt,ee=mt;continue}}if(!je&&(lt==="*"||lt==="?"||lt==="[")){Q.push(ee,at,"literal"),Q.push(at,at+1,"glob"),at++,ee=at;continue}at++}return Q.push(ee,B,"literal"),Q.parts}function _o(O,D){if(D==="command-substitution"||O==="command-substitution")return"command-substitution";if(D==="arithmetic"||O==="arithmetic")return"arithmetic";if(D==="variable"||O==="variable")return"variable";if(D==="glob"||O==="glob")return"glob";return O}function lb(O,D,B){return D+1>=B||Li(O[D+1]??"")||Ni(O,D+1)!==null}var cb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),ub=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function db(O){let D=0;while(D<=O.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(O[D]?.text??""))D++;if(D===O.length)return!0;let B=fb(O,D);if(B===void 0||B===null)return!1;D=B}return!1}function fb(O,D){let B=O[D]?.text.toLowerCase();if(B==="command")return mb(O,D);if(B==="env")return pb(O,D);if(B==="sudo")return gb(O,D);return}function mb(O,D){if(O[D+1]?.text==="-v")return null;for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(Q==="-p"||Q==="-v"||Q==="-V"||/^-[pvV]+$/.test(Q))continue;return B}return O.length}function pb(O,D){for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(cb.has(Q)){if(O[B+1]===void 0)return null;B++;continue}if(Q.startsWith("-u=")||Q.startsWith("--unset=")||Q.startsWith("-C")&&Q.length>2||Q.startsWith("--chdir=")||Q.startsWith("-S")&&Q.length>2||Q.startsWith("--split-string=")||Q.startsWith("-P"))continue;if(Q.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(Q))continue;return B}return O.length}function gb(O,D){for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(ub.has(Q)){if(O[B+1]===void 0)return null;B++;continue}if(Q.startsWith("-"))continue;return B}return O.length}function sd(O,D,B,Q){if(O.provenance!=="literal"||!O.raw.includes("{"))return;let ee=ad(O.raw,D,B,Q,!0);if(!ee)return;if("limited"in ee)return{limited:!0};let he=ee.values.map((je)=>ld(je,B));if(he.some((je)=>je===null))return{limited:!0};return{words:[...new Set(he.filter((je)=>je!==null&&je!==""))]}}function hb(O,D,B,Q,ee){if(D.provenance!=="literal"||!D.raw.includes("{"))return;let he=ad(D.raw,B,Q,ee,!1);if(!he)return;if("limited"in he){if(he.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:he.limited==="length"?"brace-expansion-limit":"word-limit"}}let je=he.values.map((at)=>ld(at,Q));if(je.some((at)=>at===null))return;return{words:je.filter((at)=>at!==null&&at!=="").map((at)=>Ur(O,D.span.start,D.span.end,at,"literal",!1))}}function ad(O,D,B,Q,ee){let he=[O],je=O.length,at=0;while(!0){let lt=he.findIndex((mt)=>Ju(mt,ee));if(lt===-1)break;if(++at>B)return{limited:"expansions"};let ct=he[lt]??"",ut=Ju(ct,ee);if(!ut||ut.kind==="range")return{limited:"expansions"};let ft=ut.start+ct.length-ut.end,dt=ut.alternatives.reduce((mt,pt)=>mt+ft+pt.length,0);if(je-ct.length+dt>Q)return{limited:"length"};if(he.length-1+ut.alternatives.length>D)return{limited:"words"};he.splice(lt,1,...yb(ct,ut)),je+=dt-ct.length}return at===0?void 0:{values:he}}function Ju(O,D){let B=[],Q,ee=null,he=!1;for(let je=0;je<O.length;je++){let at=O[je];if(he){he=!1;continue}if(at==="\\"&&ee!=="'"){he=!0;continue}if(at===ee){ee=null;continue}if(ee===null&&(at==="'"||at==='"')){ee=at;continue}if(ee!==null)continue;if(at==="{"){B.push({start:je,commas:[]});continue}if(at===","&&B.length>0){B.at(-1)?.commas.push(je);continue}if(at!=="}"||B.length===0)continue;let lt=B.pop();if(!lt)continue;let ct=lt.commas.length>0?{kind:"alternatives",start:lt.start,end:je+1,commas:lt.commas}:D&&Sb(O.slice(lt.start+1,je))?{kind:"range",start:lt.start,end:je+1}:void 0;if(ct&&(!Q||ct.start<Q.start))Q=ct}if(!Q||Q.kind==="range")return Q;return{kind:Q.kind,start:Q.start,end:Q.end,alternatives:bb(O,Q)}}function yb(O,D){return D.alternatives.map((B)=>`${O.slice(0,D.start)}${B}${O.slice(D.end)}`)}function bb(O,D){let B=[D.start,...D.commas,D.end-1];return B.slice(0,-1).map((Q,ee)=>O.slice(Q+1,B[ee+1]))}function Sb(O){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(O)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(O)}function ld(O,D){let B=`x${O}`,Q=Va(B,0,B.length,{maxInputLength:B.length,maxWords:1,maxDepth:D},{used:0,max:1},0);if(Q.limited||Q.issues.length>0||Q.next!==B.length||Q.word.provenance!=="literal")return null;return Q.word.text.slice(1)}function Cb(O,D,B,Q){return an({kind:"program",dialect:"posix",source:O.slice(D,B),span:{start:D,end:B},status:"limited",issues:[{code:Q,message:"command structure exceeds parser limit"}],nodes:[]})}function Hr(O,D,B,Q,ee){return{nodes:O,issues:[...D,{code:Q,message:`command structure exceeds parser limit ${ee}`}],next:B,closed:!1,limited:!0,pendingHeredocs:[]}}function Mi(O,D,B){return{nodes:O,issues:D,next:B,closed:!1,limited:!0,pendingHeredocs:[]}}function Ha(O){return O.used++,O.used<=O.max}function vb(O,D,B){let Q=O.slice(D,B),ee=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(Q)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(Q),he=ee?.[1];if(!ee||!he)return;return{name:he,braceIndex:D+ee[0].lastIndexOf("{")}}function wo(O){return O.some((D)=>{if(D.kind==="command")return D.redirections.some((B)=>B.heredoc)||D.nested.some((B)=>wo(B.nodes));return(D.kind==="group"||D.kind==="function")&&wo(D.body.nodes)})}function Eb(O){return O.map((D)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${D.delimiter} was not found`}))}function cd(O){return O?.kind==="command"||O?.kind==="group"||O?.kind==="function"}function Qu(O,D){let B=O.at(-1);if(B?.kind!=="connector"||!ed.has(B.operator))return;D.push({code:"missing-command-after-connector",message:`connector ${B.operator} requires a following command`})}function ja(O,D){if(!cd(O.at(-1)))return;D.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function Rb(O,D,B){return D===B||/[\s;&|()]/u.test(O[D-1]??"")}var dd=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),xb=new Set(["gc","cat","type","cp","mv","rm"]),fd=["-rec","-for","-path","-literalpath","-whatif"],_b=/^\$env:\w/i,wb=/^(?:\$\{?\w+\}?|~)\\./;function md(O,D){let B=O.toLowerCase().replaceAll("`","");if(![...dd].some((ee)=>B.includes(ee))&&!(B.includes("rm")&&fd.some((ee)=>B.includes(ee)))&&!B.includes("<#")&&!Pb(B))return!1;let Q=Xa(O,D);if(pd(Q))return!1;return Q.issues.some((ee)=>ee.code==="unclosed-block-comment"||ee.code==="comment-depth-limit")||Za(Q).some(Ab)}function pd(O){return O.nodes.some((D)=>{if(D.kind==="group")return pd(D.body);if(D.kind!=="command")return!1;return D.redirections.some((B)=>B.operator==="<<")})}function Pb(O){if(O.includes("$env:"))return!0;return O.includes("\\")&&(O.includes("$")||O.includes("~"))}function Ab(O){let D=O[0]==="&"||O[0]==="."?1:0,B=O[D]?.toLowerCase();if(B&&dd.has(B))return!0;let Q=O.slice(D+1);if(B&&xb.has(B)&&Q.some(Tb))return!0;if(B!=="rm")return!1;return Q.some((ee)=>{let he=ee.toLowerCase().split(":",1)[0]??"";return fd.some((je)=>he.startsWith(je))})}function Tb(O){return _b.test(O)||wb.test(O)}function Xa(O,D){let B={start:0,end:O.length};if(O.length>D.maxInputLength)return an({kind:"program",dialect:"powershell",source:O,span:B,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${D.maxInputLength} UTF-16 code units`}],nodes:[]});let Q=Ja(O,0,O.length,D,0);return an({kind:"program",dialect:"powershell",source:O,span:B,status:Db(Q.issues,Q.limited),issues:Q.issues,nodes:Q.nodes})}function Ja(O,D,B,Q,ee,he=!1){let je=[],at=[],lt=Ti(),ct=0,ut=!1,ft=()=>{if(lt.words.length===0&&lt.redirections.length===0)return;let mt={start:lt.start,end:lt.end};Ii(je,lt,{kind:"command",dialect:"powershell",source:O.slice(mt.start,mt.end),span:mt,words:lt.words,redirections:lt.redirections,nested:lt.nested,displayText:lt.words.map((pt)=>pt.text).join(" ")})},dt=D;while(dt<B){let mt=O[dt];if(!mt)break;if(he&&mt==="}")return ft(),{nodes:je,issues:at,next:dt+1,closed:!0,words:ct,limited:ut};let pt=Mb(O,dt,B,Q.maxDepth);if(pt){if(pt.issue)at.push(pt.issue);if(pt.limited)return ft(),{nodes:je,issues:at,next:pt.next,closed:!1,words:ct,limited:!0};dt=pt.next;continue}if(/\s/.test(mt)){if(mt==="\r"||mt===`
-`){ft();let yt=mt==="\r"&&O[dt+1]===`
-`?dt+2:dt+1;je.push(qa(O,dt,yt)),dt=yt;continue}dt++;continue}let ht=yd(O,dt);if(ht){ft(),je.push(qa(O,dt,dt+ht.length)),dt+=ht.length;continue}if(mt==="{"){if(ft(),ee>=Q.maxDepth)return at.push(hd(Q.maxDepth)),{nodes:je,issues:at,next:B,closed:!1,words:ct,limited:!0};let yt=Ja(O,dt+1,B,Q,ee+1,!0),vt=yt.closed?yt.next-1:yt.next,Et=an({kind:"program",dialect:"powershell",source:O.slice(dt+1,vt),span:{start:dt+1,end:vt},status:yt.limited?"limited":yt.issues.length>0?"partial":"complete",issues:yt.issues,nodes:yt.nodes});if(je.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:dt,end:yt.next}),body:Et})),at.push(...yt.issues),!yt.closed)at.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ct+=yt.words,ut||=yt.limited,dt=yt.next;continue}if(mt==="}"){ft(),je.push(qa(O,dt,dt+1)),dt++;continue}if(mt===">"||mt==="<"){lt.start=lt.start===-1?dt:lt.start;let yt=O[dt+1]===mt?dt+2:dt+1,vt=yt;while(/[ \t]/.test(O[vt]??""))vt++;let Et=vt<B?ud(O,vt,B,Q,ee):void 0,Ct=Et?.next??yt;if(lt.redirections.push(Object.freeze({kind:"redirection",operator:O.slice(dt,yt),span:Object.freeze({start:dt,end:Ct}),...Et?{target:Et.word}:{}})),Et)at.push(...Et.issues),lt.nested.push(...Et.nested),ct+=Et.words,ut||=Et.limited;lt.end=Ct,dt=Ct;continue}if(mt===","){lt.start=lt.start===-1?dt:lt.start,lt.words.push(Ba({text:",",raw:",",span:{start:dt,end:dt+1},provenance:"literal",quoted:!1})),lt.end=++dt;continue}let gt=ud(O,dt,B,Q,ee);if(lt.start=lt.start===-1?dt:lt.start,lt.end=gt.next,lt.words.push(gt.word),at.push(...gt.issues),lt.nested.push(...gt.nested),ct+=1+gt.words,ut||=gt.limited,ct>Q.maxWords)return at.push({code:"word-limit",message:`command exceeds ${Q.maxWords} words`}),ft(),{nodes:je,issues:at,next:gt.next,closed:!1,words:ct,limited:!0};dt=gt.next>dt?gt.next:dt+1}return ft(),{nodes:je,issues:at,next:dt,closed:!he,words:ct,limited:ut}}function ud(O,D,B,Q,ee){let he="",je="literal",at=!1,lt=[],ct=[],ut=0,ft=!1,dt=(pt)=>{let ht=Ib(O,pt,B,Q,ee);return he+=O.slice(pt,ht.next),ct.push(ht.program),lt.push(...ht.program.issues),ut+=Ya(ht.program),ft||=ht.program.status==="limited",je="command-substitution",ht.next},mt=D;while(mt<B){let pt=O[mt];if(!pt||/\s/.test(pt)||yd(O,mt)||pt===">"||pt==="<"||pt==="#")break;if(pt===",")break;if(pt==="`"){let ht=O[mt+1];if(!ht){lt.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),mt++;break}he+=ht,mt+=2;continue}if(O.startsWith("$(",mt)){mt=dt(mt);continue}if(pt==="'"){at=!0,mt++;let ht=!1;while(mt<O.length){if(O[mt]==="'"&&O[mt+1]==="'"){he+="'",mt+=2;continue}if(O[mt]==="'"){ht=!0,mt++;break}he+=O[mt]??"",mt++}if(!ht)lt.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(pt==='"'){at=!0,mt++;let ht=!1;while(mt<B){let gt=O[mt];if(gt==="`"&&O[mt+1]){he+=O[mt+1],mt+=2;continue}if(gt==='"'){ht=!0,mt++;break}if(O.startsWith("$(",mt)){mt=dt(mt);continue}if(gt==="$")je=O[mt+1]==="("?"command-substitution":"variable";he+=gt??"",mt++}if(!ht)lt.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(pt==="$")je=O[mt+1]==="("?"command-substitution":"variable";if(pt==="@"&&mt===D)je="variable";he+=pt,mt++}return{word:Ur(O,D,mt,he,je,at,je==="literal"?void 0:kb(O,D,mt)),next:mt,issues:lt,nested:ct,words:ut,limited:ft}}function Ib(O,D,B,Q,ee){let he=gd(O,D+2,B),je=he===-1?B:he,at=he===-1?B:he+1;if(ee>=Q.maxDepth)return{program:an({kind:"program",dialect:"powershell",source:O.slice(D+2,je),span:{start:D+2,end:je},status:"limited",issues:[hd(Q.maxDepth)],nodes:[]}),next:at};let lt=Ja(O,D+2,je,Q,ee+1),ct=he===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:an({kind:"program",dialect:"powershell",source:O.slice(D+2,je),span:{start:D+2,end:je},status:lt.limited?"limited":lt.issues.length+ct.length>0?"partial":"complete",issues:[...lt.issues,...ct],nodes:lt.nodes}),next:at}}function gd(O,D,B){let Q=1,ee=!1,he=!1;for(let je=D;je<B;je++){let at=O[je];if(at==="`"){je++;continue}if(!he&&at==="'"){if(ee&&O[je+1]==="'"){je++;continue}ee=!ee;continue}if(!ee&&at==='"'){he=!he;continue}if(ee)continue;if(O.startsWith("$(",je)){Q++,je++;continue}if(!he&&at==="(")Q++;if(at!==")")continue;if(Q--,Q===0)return je}return-1}function Ya(O){let D=0;for(let B of O.nodes){if(B.kind==="group")D+=Ya(B.body);if(B.kind==="command"){D+=B.words.length;for(let Q of B.nested)D+=Ya(Q)}}return D}function kb(O,D,B){let Q=ki(O),ee=D,he=!1,je=D;while(je<B){let at=O[je];if(at==="`"){je+=2;continue}if(at==="'"){if(he&&O[je+1]==="'"){je+=2;continue}he=!he,je++;continue}if(he){je++;continue}if(O.startsWith("$(",je)){let lt=gd(O,je+2,B),ct=lt===-1?B:lt+1;Q.push(ee,je,"literal"),Q.push(je,ct,"command-substitution"),je=ct,ee=ct;continue}if(at==="$"||at==="@"&&je===D){let lt=Ob(O,je+1,B);Q.push(ee,je,"literal"),Q.push(je,lt,"variable"),je=lt,ee=lt;continue}je++}return Q.push(ee,B,"literal"),Q.parts}function Ob(O,D,B){if(O[D]==="{"){let ee=O.indexOf("}",D+1);return ee===-1||ee>=B?B:ee+1}let Q=D;while(Q<B&&/[A-Za-z0-9_:?]/.test(O[Q]??""))Q++;return Q}function hd(O){return{code:"depth-limit",message:`command structure exceeds parser limit ${O}`}}function Za(O){return O.nodes.flatMap((D)=>{if(D.kind==="group")return Za(D.body);if(D.kind!=="command")return[];return[[...D.words,...D.redirections.flatMap((B)=>B.target?[B.target]:[])].sort((B,Q)=>B.span.start-Q.span.start).filter((B)=>B.text!==""&&B.raw!==",").map((B)=>B.text),...D.nested.flatMap(Za)]})}function yd(O,D){for(let B of["&&","||",";","|"])if(O.startsWith(B,D))return B;return null}function Mb(O,D,B,Q){if(O[D]==="#"&&O[D+1]!==">"){let je=D+1;while(je<B&&O[je]!=="\r"&&O[je]!==`
-`)je++;return{next:je,limited:!1}}if(!O.startsWith("<#",D))return null;let ee=1,he=D+2;while(he<B){if(O.startsWith("<#",he)){if(ee++,ee>Q)return{next:B,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${Q}`},limited:!0};he+=2;continue}if(O.startsWith("#>",he)){if(ee--,he+=2,ee===0)return{next:he,limited:!1};continue}he++}return{next:B,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Db(O,D){if(D)return"limited";if(O.some((B)=>B.code==="unclosed-block-comment"))return"invalid";return O.length>0?"partial":"complete"}function qa(O,D,B){return Object.freeze({kind:"connector",operator:O.slice(D,B),span:Object.freeze({start:D,end:B})})}function h(O,D="auto",B=er){if(D==="powershell"||D==="auto"&&md(O.slice(0,B.maxInputLength),B))return Xa(O,B);return td(O,B)}function t(O){return O.provenance==="command-substitution"?O.raw:O.text}function X(O,D){return O==="posix"?D:$t(D.map((B)=>B.text))}function Fi(O,D){return O&&O.provenance!=="unknown"?O.provenance==="literal":!/[$`*?[\]]/.test(D)}function $t(O){return O.map((D)=>({kind:"word",text:D,raw:D,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Qa(O,D){return{value:O,work:D}}function bt(O,D){if(O.work)O.work.units=Math.min(Number.MAX_SAFE_INTEGER,O.work.units+1);return O.value[D]}function Ht(O){return O.value.length}function Po(O,D,B=1){if(O)O.units=Math.min(Number.MAX_SAFE_INTEGER,O.units+D.length*B)}function yn(O,D){Po(O,D)}function br(O){if(!O)return!1;let D=O.charCodeAt(0);return D>=48&&D<=57||D>=65&&D<=90||D===95||D>=97&&D<=122}function zt(O){if(!O)return!1;let D=O.charCodeAt(0);return D===9||D===10||D===11||D===12||D===13||D===32||D===160||D===65279||D===5760||D>=8192&&D<=8202||D===8232||D===8233||D===8239||D===8287||D===12288}function el(O){return O===`
-`||O==="\r"||O==="\u2028"||O==="\u2029"}function Bt(O,D,B){if(D+B.length>Ht(O))return!1;for(let Q=0;Q<B.length;Q++)if(bt(O,D+Q)!==B[Q])return!1;return!0}function zn(O,D,B){return!br(bt(O,D-1))&&Bt(O,D,B)&&!br(bt(O,D+B.length))}function Bn(O,D){return br(bt(O,D-1))!==br(bt(O,D))}function Qt(O){return O===`
-`||O===";"||O==="&"||O==="|"}function jr(O){return O==="|"||O===";"}function zi(O,D,B){let Q=Qa(O,B);if(D==="rm")return Nb(Q);if(D==="dd")return Wb(Q);return Rd(Q,!0)}function Bi(O,D,B){let Q=Qa(O,B);if(D==="rm")return Gb(Q);if(D==="reset-hard")return vd(Q,"--ha","rd");if(D==="reset-merge")return vd(Q,"--me","rge");if(D==="clean")return $b(Q);if(D==="checkout")return Hb(Q);if(D==="push-force")return jb(Q);if(D==="push-refspec")return Vb(Q);if(D==="push-delete")return Kb(Q);if(D==="branch")return qb(Q);if(D==="tag")return Xb(Q);if(D==="restore")return Jb(Q);return Rd(Q,!1)}function Nb(O){let D=!1,B=!1,Q=!1,ee=-1;for(let he=0;he<=Ht(O);he++){let je=bt(O,he);if(!D){let lt=bt(O,he+2);if(zn(O,he,"rm")&&zt(lt)&&lt!==`
-`)D=!0,he++;continue}let at=Lb(O,he);if(je===`
-`||at!==-1){if(D=!1,B=!1,Q=!1,ee=-1,at!==-1)he=at-1;continue}if(je===";"||je==="&"||je==="|"||he===Ht(O)){if(ee>=0){let lt=bd(O,ee,he);B||=lt.recursive,Q||=lt.force}if(B&&Q)return!0;D=!1,B=!1,Q=!1,ee=-1;continue}if(zt(je)){if(ee<0)continue;if(Bt(O,ee,"--")&&he-ee===2){D=!1,B=!1,Q=!1,ee=-1;continue}let lt=bd(O,ee,he);if(B||=lt.recursive,Q||=lt.force,B&&Q)return!0;ee=-1;continue}if(ee<0)ee=he}return!1}function Lb(O,D){if(bt(O,D)!=="\\"||bt(O,D-1)==="\\")return-1;if(Bt(O,D,String.raw`\n`))return D+2;if(Bt(O,D,String.raw`\x0a`)||Bt(O,D,String.raw`\x0A`))return D+5;if(Bt(O,D,String.raw`\u000a`)||Bt(O,D,String.raw`\u000A`))return D+7;return Bt(O,D,String.raw`\012`)?D+4:-1}function bd(O,D,B){if(Sd(O,D,B,"recursive"))return{recursive:!0,force:!1};if(Sd(O,D,B,"force"))return{recursive:!1,force:!0};if(bt(O,D)!=="-"||bt(O,D+1)==="-")return{recursive:!1,force:!1};let Q=!1,ee=!1;for(let he=D+1;he<B;he++){let je=bt(O,he);Q||=je==="r"||je==="R",ee||=je==="f"||je==="F"}return{recursive:Q,force:ee}}function Sd(O,D,B,Q){let ee=B-D-2;if(ee<1||ee>Q.length||!Bt(O,D,"--"))return!1;for(let he=0;he<ee;he++)if(bt(O,D+he+2)!==Q[he])return!1;return!0}function Wb(O){let D=!1;for(let B=0;B<Ht(O);B++){if(Qt(bt(O,B))){D=!1;continue}if(zn(O,B,"dd")){D=!0,B++;continue}if(!D||!zn(O,B,"of")||!Bt(O,B,"of=/dev/"))continue;let Q=B+8;if(Q<Ht(O)&&!zt(bt(O,Q))&&bt(O,Q)!=="'"&&bt(O,Q)!=='"')return!0}return!1}function Gb(O){let D=!1,B=!1,Q=!1;for(let ee=0;ee<=Ht(O);){let he=bt(O,ee);if(ee===Ht(O)||Qt(he)){D=!1,B=!1,Q=!1,ee++;continue}let je=zb(O,ee);if(je>=0){if(Fb(O,je))return!0;let at=je,lt=!1;while(zt(bt(O,at)))lt||=bt(O,at)===`
-`,at++;if(lt)B=!1,Q=!1;D=!0,ee=at;continue}if(!D){ee++;continue}if(Bt(O,ee,"--")&&(ee===0||zt(bt(O,ee-1)))&&(!bt(O,ee+2)||zt(bt(O,ee+2))||Qt(bt(O,ee+2)))){D=!1,B=!1,Q=!1,ee+=2;continue}if(B||=Bt(O,ee,"--recursive")&&Bn(O,ee+11)||tl(O,ee,"recursive"),Q||=Bt(O,ee,"--force")&&Bn(O,ee+7)||tl(O,ee,"force"),B&&Q)return!0;ee++}return!1}function tl(O,D,B){if(!Bt(O,D,"--"))return!1;let Q=0;while(Q<=B.length){let ee=bt(O,D+Q+2);if(!ee||zt(ee)||Qt(ee))break;if(ee!==B[Q])return!1;Q++}return Q>0&&Bn(O,D+Q+2)}function Fb(O,D){let B=D,Q=!1,ee=!1;while(B<Ht(O)){while(zt(bt(O,B)))B++;let he=B;while(B<Ht(O)&&!zt(bt(O,B)))B++;if(bt(O,he)!=="-"||B-he===2&&Bt(O,he,"--"))return!1;let je=Cd(O,he,"recursive"),at=Cd(O,he,"force");if(Q&&at||ee&&je)return!0;if(Q||=je,ee||=at,bt(O,he+1)==="-")continue;let lt=Bb(O,he,B);if(lt.combined||Q&&lt.forceAtBoundary||ee&&lt.recursiveAtBoundary)return!0;Q||=lt.recursive,ee||=lt.force}return!1}function Cd(O,D,B){return Bt(O,D,`--${B}`)&&Bn(O,D+B.length+2)||tl(O,D,B)}function zb(O,D){if(D>0&&br(bt(O,D-1)))return-1;let B=D;if(bt(O,B)==="\\")B++;if(bt(O,B)!=="r")return-1;if(B++,bt(O,B)==="\\")B++;if(bt(O,B)!=="m"||!zt(bt(O,B+1)))return-1;return B+1}function Bb(O,D,B){let Q=!1,ee=!1,he=!1,je=!1,at=!1;if(bt(O,D)!=="-")return{recursive:Q,force:ee,recursiveAtBoundary:he,forceAtBoundary:je,combined:at};let lt="";for(let ct=D+1;ct<B;ct++){let ut=bt(O,ct)??"",ft=(ut==="r"||ut==="f")&&Bn(O,ct+1);Q||=ut==="r",ee||=ut==="f",he||=ut==="r"&&ft,je||=ut==="f"&&ft,at||=(lt==="r"&&ut==="f"||lt==="f"&&ut==="r")&&ft,lt=ut}return{recursive:Q,force:ee,recursiveAtBoundary:he,forceAtBoundary:je,combined:at}}function vd(O,D,B){return To(O,"reset",jr,!0,(Q)=>bt(O,Q)==="-"&&Vr(O,Q,D,B)?!0:Q)}function $b(O){return To(O,"clean",jr,!0,(D)=>{if(bt(O,D)!=="-")return D;if(Vr(O,D,"--fo","rce"))return!0;let B=Ao(O,D,jr);for(let Q=D+1;Q<B;Q++)if(bt(O,Q)==="f")return!0;return B-1})}function $i(O,D,B){if(!zn(O,D,"git"))return null;let Q=D+3;if(!zt(bt(O,Q)))return{commandEnd:-1,next:Q};while(zt(bt(O,Q)))Q++;while(Q<Ht(O)){if(Qt(bt(O,Q)))return{commandEnd:-1,next:Q};let ee=Ao(O,Q,Qt);if(zn(O,Q,B))return{commandEnd:Q+B.length,next:ee};if(bt(O,Q)!=="-")return{commandEnd:-1,next:ee};let he=ee-Q===2&&Bt(O,Q,"--"),je=Ub(O,Q,ee);Q=ee;while(zt(bt(O,Q)))Q++;if(he)return{commandEnd:zn(O,Q,B)?Q+B.length:-1,next:Ao(O,Q,Qt)};if(!je)continue;if(Q>=Ht(O)||Qt(bt(O,Q)))return{commandEnd:-1,next:Q};Q=Ao(O,Q,Qt);while(zt(bt(O,Q)))Q++}return{commandEnd:-1,next:Q}}function Ub(O,D,B){for(let Q of pn)if(B-D===Q.length&&Bt(O,D,Q))return!0;return!1}function Hb(O){return Ed(O,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function jb(O){return To(O,"push",jr,!0,(D)=>{if(bt(O,D)!=="-")return D;if(bt(O,D+1)==="f"&&!br(bt(O,D+2))&&!Bt(O,D+2,"-with-lease"))return!0;let B=xd(O,D,"--fo","rce");if(B>=0&&!Bt(O,B,"-with-lease"))return!0;return D})}function Vb(O){return To(O,"push",Qt,!1,(D)=>{if(zt(bt(O,D))&&bt(O,D+1)==="+"&&D+2<Ht(O)&&!Qt(bt(O,D+2))&&!zt(bt(O,D+2)))return!0;if(bt(O,D)===":"&&bt(O,D+1)==="+")return!0;return D})}function Kb(O){return To(O,"push",Qt,!1,(D)=>{if(bt(O,D)==="-"&&Vr(O,D,"--de","lete"))return!0;if(zt(bt(O,D))&&bt(O,D+1)===":"&&D+2<Ht(O)&&!zt(bt(O,D+2))&&!Qt(bt(O,D+2)))return!0;return D})}function qb(O){let D=!1,B=!1,Q=!1;for(let ee=0;ee<=Ht(O);ee++){if(ee===Ht(O)||Qt(bt(O,ee))){if(B&&Q)return!0;D=!1,B=!1,Q=!1;continue}if(!D){let at=$i(O,ee,"branch");if(at){D=at.commandEnd>=0,ee=Math.max(ee,(D?at.commandEnd:at.next)-1);continue}}if(!D||bt(O,ee)!=="-")continue;let he=Ao(O,ee,Qt),je=Yb(O,ee,he);if(B||=je.deletion,Q||=je.force,B&&Q)return!0;ee=he-1}return!1}function Yb(O,D,B){let Q=!1,ee=!1;for(let he=D;he<B;he++){if(bt(O,he)!=="-")continue;if(Vr(O,he,"--de","lete"))Q=!0;if(Vr(O,he,"--fo","rce"))ee=!0;if(bt(O,he+1)==="-")continue;let je=he+1,at=!1,lt=!1,ct=!1;while(je<B&&Zb(bt(O,je))){let ut=bt(O,je);at||=ut==="d"||ut==="D",lt||=ut==="f",ct||=ut==="D",je++}if(!Bn(O,je))continue;Q||=at,ee||=lt||ct}return{deletion:Q,force:ee}}function Zb(O){if(!O)return!1;let D=O.charCodeAt(0);return D>=65&&D<=90||D>=97&&D<=122}function Xb(O){return Ed(O,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Ed(O,D){let B=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let Q=0;Q<Ht(O);Q++){let ee=bt(O,Q),he=B[B.length-1];if(!he)return!1;let je=he.escaped;if(he.escaped=!je&&he.quote!=="'"&&ee==="\\",!je&&ee==="'"&&he.quote!=='"')he.quote=he.quote==="'"?"":"'";if(!je&&ee==='"'&&he.quote!=="'")he.quote=he.quote==='"'?"":'"';if(ee==="$"&&bt(O,Q+1)==="("&&(B.length===1||!je&&he.quote!=="'")){B.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),Q++;continue}if(!je&&!he.quote&&B.length>1&&ee==="("){he.depth++;continue}if(!je&&!he.quote&&B.length>1&&ee===")"){if(he.depth--,he.depth===0)B.pop();continue}if(zt(ee))he.shortActive=!1,he.hasShortFlag=!1;if(!he.outerActive){let at=$i(O,Q,D.command);if(at){he.outerActive=at.commandEnd>=0&&zt(bt(O,at.commandEnd)),he.shortActive=!1,he.hasShortFlag=!1,Q=Math.max(Q,(he.outerActive?at.commandEnd:at.next)-1);continue}}if(he.outerActive&&ee==="-"){if(Vr(O,Q,D.longPrefix,D.longOptional))return!0;he.shortActive||=!D.excludedShortStarts.includes(bt(O,Q+1)??"")}if(he.hasShortFlag||=he.shortActive&&ee===D.shortFlag,he.hasShortFlag&&Bn(O,Q+1))return!0;if(jr(ee))he.outerActive=!1}return!1}function To(O,D,B,Q,ee){let he=!1;for(let je=0;je<Ht(O);je++){let at=bt(O,je),lt=B(at);if(!he&&!lt){let ct=$i(O,je,D);if(ct){he=ct.commandEnd>=0&&(!Q||zt(bt(O,ct.commandEnd))),je=Math.max(je,(he?ct.commandEnd:ct.next)-1);continue}}if(he){let ct=ee(je);if(ct===!0)return!0;for(let ut=je;ut<=ct;ut++)if(B(bt(O,ut)))he=!1;je=ct}if(lt)he=!1}return!1}function Jb(O){let D=!1;for(let B=0;B<Ht(O);B++){if(el(bt(O,B))){if(D)return!0;D=!1;continue}if(!D){let Q=$i(O,B,"restore");if(Q){D=Q.commandEnd>=0,B=Math.max(B,(D?Q.commandEnd:Q.next)-1);continue}}if(D&&bt(O,B)==="-"&&bt(O,B+1)==="-"&&(Bt(O,B+2,"staged")||Bt(O,B+2,"help")))D=!1}return D}function Rd(O,D){let B=!1;for(let Q=0;Q<Ht(O);Q++){let ee=bt(O,Q),he=D?el(ee):Qt(ee);if(B&&zt(ee)&&bt(O,Q+1)==="-"&&zn(O,Q+2,"delete"))return!0;if(he){B=!1;continue}if(zn(O,Q,"find"))B=!0,Q+=3}return!1}function Ao(O,D,B){let Q=D;while(Q<Ht(O)&&!zt(bt(O,Q))&&!B(bt(O,Q)))Q++;return Q}function xd(O,D,B,Q){if(!Bt(O,D,B))return-1;let ee=D+B.length;for(let he=0;he<Q.length&&bt(O,ee)===Q[he];he++)ee++;return Bn(O,ee)?ee:-1}function Vr(O,D,B,Q){return xd(O,D,B,Q)>=0}function $n(O,D){Po(D,O,2);let B=O.toLowerCase(),Q=B.trimStart(),ee=Q.startsWith("echo ")||Q.startsWith("rg "),he=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let je of he){if(je.skipForEchoRg&&ee)continue;let at=je.caseSensitive?O:B;if(je.regex)yn(D,at);if((je.regex?.test(at)??!1)||je.scan&&Bi(at,je.scan,D))return St("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${je.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var Qb=/^[A-Za-z_][A-Za-z0-9_]*=/;function wd(O,D,B){let Q=O.words[0];if(!D||!Q||O.words.length!==1||O.dialect!=="posix")return!1;if(!Q.quoted||Q.provenance!=="literal")return!1;let ee=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(Q.text)?.[1];if(!ee)return!1;Po(B,D.source,2);let he={anchored:new RegExp(`^\\$\\{?${ee}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${ee}(?![A-Za-z0-9_])`)};return Pd(D.nodes,Q,he)}function Pd(O,D,B){return O.every((Q)=>{if(Q.kind==="connector")return!0;if(Q.kind==="group"||Q.kind==="function")return Pd(Q.body.nodes,D,B);if(Q.kind==="unknown")return!B.loose.test(Q.source);return eS(Q,D,B)})}function eS(O,D,B){if(O.nested.some((ee)=>B.loose.test(ee.source)))return!1;let Q=O.words.findIndex((ee)=>!Qb.test(ee.text));return O.words.every((ee,he)=>ee===D||_d(ee.raw,B.anchored,he!==Q))&&O.redirections.every((ee)=>(!ee.heredoc||ee.heredoc.quotedDelimiter||!B.loose.test(ee.heredoc.body))&&(!ee.target||_d(ee.target.raw,B.anchored,!0)))}function _d(O,D,B){let Q=!1,ee=!1;for(let he=0;he<O.length;he++){let je=O[he];if(je==="\\"&&!Q){he++;continue}if(!ee&&je==="'"){Q=!Q;continue}if(!Q&&je==='"'){ee=!ee;continue}if(Q||je!=="$")continue;if(!D.test(O.slice(he)))continue;if(!ee||!B)return!1}return!0}import{isAbsolute as tS,resolve as Ad}from"node:path";function Io(O,D,B,Q){let ee=tS(O)?Ad(O):D?Ad(D,O):void 0;if(!ee)return;try{return Lt(ee,B,Q)}catch{return ee}}function Td(O){return!["/dev","/proc","/sys"].some((D)=>O===D||O.startsWith(`${D}/`))}var Kr="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",ko="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",nl=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),nS=new Set(["-p","--print"]),rS=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),oS=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),iS=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),sS=new Map([["python",new Set(["m"])]]),aS=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),lS=new Set(["always","default","never"]),cS=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),uS=/\\\r?\n/g,dS=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function kd(O){return Hi(O).code}function Ui(O){return Hi(O).sources}function Od(O){return dS.get(ol(O))??[]}function Hi(O){let D=ol(O[0]??"");if(!nl.has(D))return{code:null,sources:[],optionsOpen:!1};let B=[],Q=[],ee=!0;for(let he=1;he<O.length;he++){let je=O[he];if(je===void 0)break;if(je==="--")return An(D,B,Q,ee,O[he+1]===void 0?void 0:he+1,O[he+1]);if(je===""||je==="-"||!je.startsWith("-"))return An(D,B,Q,ee,he,je);if(D==="node"&&nS.has(je)){let ft=O[he+1];if(ft===void 0)return An(D,B,Q,ee);if(ft.startsWith("-"))continue;B.push({tokenIndex:he+1,value:ft}),Q.push({tokenIndex:he+1,kind:"inline-code",value:ft}),he++;continue}if(mS(D,je)){let ft=O[he+1];if(ft===void 0)return An(D,B,Q,ee);if(B.push({tokenIndex:he+1,value:ft}),Q.push({tokenIndex:he+1,kind:"inline-code",value:ft}),D==="python")return An(D,B,Q,ee);he++;continue}let at=/^--eval=(.*)$/s.exec(je);if(pS(D)&&at){let ft=at[1]??"";B.push({tokenIndex:he,value:ft}),Q.push({tokenIndex:he,kind:"inline-code",value:ft});continue}if(D==="node"){let ft=fS(je);if(ft){if(ft.attached){if(ee&&=ft.value!=="",ft.value!=="")Q.push({tokenIndex:he,kind:"module-file",value:ft.value});continue}let dt=O[he+1];if(dt===void 0||dt.startsWith("-"))return ee=!1,An(D,B,Q,ee);Q.push({tokenIndex:he+1,kind:"module-file",value:dt}),he++;continue}}if(D==="python"&&je.startsWith("--check-hash-based-pycs=")||D==="node"&&(je==="--conditions="||je==="--diagnostic-dir="||je==="--title=")||D==="ruby"&&(je==="--disable="||je==="--enable="))return An(D,B,Q,ee);if(aS.get(D)?.has(je)){let ft=O[he+1];if(ft===void 0||ft.startsWith("-")&&!(D==="ruby"&&cS.has(je))||D==="python"&&!lS.has(ft))return An(D,B,Q,ee);he++;continue}if(je.startsWith("--"))continue;let lt,ct=!1;for(let ft=1;ft<je.length;ft++){let dt=je[ft];if(dt===void 0)break;if(sS.get(D)?.has(dt)){let mt=je.slice(ft+1),pt=mt||O[he+1];if(pt!==void 0)Q.push({tokenIndex:mt?he:he+1,kind:"module-file",value:pt});return An(D,B,Q,ee)}if(rS.get(D)?.has(dt)){lt=je.slice(ft+1)||O[he+1],ct=ft+1===je.length;break}if(D==="node"&&dt==="r"){if(ee&&=je==="-r",je==="-r"){let mt=O[he+1];if(ee&&=mt!==void 0&&!mt.startsWith("-"),ee&&mt!==void 0)Q.push({tokenIndex:he+1,kind:"module-file",value:mt});he++}break}if(D==="ruby"&&dt==="r"){let mt=je.slice(ft+1),pt=mt||O[he+1];if(ee&&=pt!==void 0,pt!==void 0)Q.push({tokenIndex:mt?he:he+1,kind:"module-file",value:pt});if(!mt)he++;break}if(D==="perl"&&(dt==="M"||dt==="m")){let mt=je.slice(ft+1);if(!mt){if(ee=!1,ft+1===je.length)he++;break}Q.push({tokenIndex:he,kind:"module-file",value:mt});break}if(oS.get(D)?.has(dt)){if(ft+1===je.length)he++;break}if(iS.get(D)?.has(dt)&&ft+1<je.length)break}if(lt===void 0)continue;let ut=ct?he+1:he;if(B.push({tokenIndex:ut,value:lt}),Q.push({tokenIndex:ut,kind:"inline-code",value:lt}),D==="python")return An(D,B,Q,ee);if(ct)he++}return An(D,B,Q,ee,void 0,void 0,!0)}function An(O,D,B,Q,ee,he,je=!1){let at=O==="node"?D.slice(-1):D,lt=new Set(at.map((ut)=>ut.tokenIndex)),ct=B.filter((ut)=>ut.kind!=="inline-code"||lt.has(ut.tokenIndex));if(Q&&D.length===0&&ee!==void 0&&he!==void 0)ct.push({tokenIndex:ee,kind:"main-script",value:he});return{code:(O==="node"?at[0]?.value:at.map((ut)=>ut.value).join(`
-`))||null,sources:Q?ct:[],optionsOpen:Q&&je}}function fS(O){for(let D of["--import","--loader","--experimental-loader","--require"]){if(O===D)return{attached:!1,value:""};if(O.startsWith(`${D}=`))return{attached:!0,value:O.slice(D.length+1)}}return}function rl(O,D){return ol(O)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(D)}function ol(O){let D=Tt(O).toLowerCase();return hi.test(D)?"python":D}function mS(O,D){return nl.get(O)?.has(D)??!1}function pS(O){return nl.get(O)?.has("--eval")??!1}function Oo(O,D){let B=yS(O,D);if(!Id(B,D))return!1;yn(D,B);let Q=hS(B);if(Id(Q,D))return!0;return yn(D,Q),gS.test(Q)}var gS=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function hS(O){let D=[],B=0,Q=0;while(Q<O.length){let ee=O[Q];if(ee!=="'"&&ee!=='"'){Q++;continue}let he=O.startsWith(ee.repeat(3),Q)?ee.repeat(3):ee,je=Q+he.length;while(je<O.length&&!O.startsWith(he,je))je+=O[je]==="\\"?2:1;if(je>=O.length)break;D.push(O.slice(B,Q)," "),Q=je+he.length,B=Q}return D.push(O.slice(B)),D.join("")}function Id(O,D){if(zi(O,"rm",D))return!0;for(let Q of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(yn(D,O),Q.test(O))return!0;if(zi(O,"dd",D))return!0;for(let Q of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(yn(D,O),Q.test(O))return!0;if(zi(O,"find",D))return!0;let B=O.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((Q)=>(yn(D,O),B.some((ee)=>Bi(ee,Q))))}function yS(O,D){return yn(D,O),O.replace(uS,"")}import{isAbsolute as of,relative as sf}from"node:path";import{isAbsolute as Fd,parse as PS}from"node:path";import{dirname as bS,isAbsolute as SS,parse as CS,sep as vS}from"node:path";function tr(O,D,B){if(Jn(D))throw Error("Unsupported Windows namespace path");let Q=SS(D)?CS(D).root:"",ee=Q||O;for(let he of RS(Q?D.slice(Q.length):D)){if(he===""||he===".")continue;if(he===".."){ee=bS(ee);continue}let je=ES(ee,he),at=B.entryKind(je),lt=at==="symlink"?B.realpath(je):je;if(at==="missing"||lt===null)throw Error(`Cannot resolve path component: ${je}`);ee=lt}return ee}function ES(O,D){return O.endsWith("/")||O.endsWith("\\")?`${O}${D}`:`${O}${vS}${D}`}function RS(O){let D=process.platform==="win32"?/[\\/]+/:/\/+/;return O.split(D)}var il=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],xS=new Set(il),_S=1024,Md=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Dd=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),wS=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function ji(O){return xS.has(O)}function sl(O){return ji(O)||Md.has(O)||Dd.has(O)||mo(O)}function Un(O,D,B){return B?.has(O)?B.get(O):D.get(O)}function Nd(O,D){let B=Un("GIT_CONFIG_COUNT",O,D);if(B===void 0)return{state:"absent"};if(B==="")return{state:"valid",count:0};if(!/^\d+$/.test(B))return{state:"invalid"};let Q=Number(B);return Number.isSafeInteger(Q)&&Q<=_S?{state:"valid",count:Q}:{state:"invalid"}}function Vi(O,D,B){let ee=O.match(wS)?.[1];if(!ee||!sl(ee))return null;let he=O.indexOf("=");return{name:ee,value:`${Un(ee,D,B)??""}${O.slice(he+1)}`}}function Ld(O){return Gd(O,Dd)}function Wd(O){return Gd(O,Md)}function Gd(O,D){if(!O)return!1;for(let B of O.keys())if(D.has(B))return!0;return!1}var Bd=/^[A-Za-z_][A-Za-z0-9_]*=/;function Rn(O){if(!Bd.test(O))return null;let D=O.indexOf("=");return{name:O.slice(0,D),value:O.slice(D+1)}}function ge(O){let D=new Map,B=0;while(B<O.length){let Q=O[B];if(!Q)break;let ee=Rn(t(Q));if(!ee)break;D.set(ee.name,ee.value),B++}return{words:O.slice(B),envAssignments:D}}function $d(O){let D=O.toLowerCase();return O.includes("=")||D==="sudo"||D==="env"||D==="command"||D==="builtin"}function Sr(O,D,B,Q){if(!$d(qr(O)))return{words:O,envAssignments:new Map,cwd:B,rewritten:!1};let ee=new Set(O),he=O,je=new Map,at=new Map(Q??[]),lt=[],ct=B;for(let ft=0;ft<a.wrapperPeelIterations.cap;ft++){let dt=zd(he),mt=ge(he);for(let[ht,gt]of mt.envAssignments)je.set(ht,gt),at.set(ht,gt);if(he=mt.words,he.length===0)break;while(he.length>0&&qr(he).includes("=")&&!TS(he)){let ht=IS(qr(he),at,D.env)??Vi(qr(he),D.env,at);if(ht)je.set(ht.name,ht.value),at.set(ht.name,ht.value);he=he.slice(1)}if(he.length===0)break;let pt=qr(he).toLowerCase();if(pt!=="sudo"&&pt!=="env"&&pt!=="command"&&pt!=="builtin")break;if(pt==="sudo"){let ht=OS(he,D.paths,ct);if(he=ht.words,ht.cwd!==void 0)ct=ht.cwd}if(pt==="env"){let ht=NS(he,ct,at,D);if(lt.push(...ht.envSplitValues??[]),he=ht.words,ht.cwd!==void 0)ct=ht.cwd;for(let[gt,yt]of ht.envAssignments)je.set(gt,yt),at.set(gt,yt)}if(pt==="command")he=LS(he);if(pt==="builtin")he=he.slice(Tn(he,1)==="--"?2:1);if(zd(he)===dt)break}let ut=ge(he);for(let[ft,dt]of ut.envAssignments)je.set(ft,dt),at.set(ft,dt);return{words:ut.words,envAssignments:je,cwd:ct,envSplitValues:lt.length>0?lt:void 0,rewritten:AS(ut.words,ee)}}function AS(O,D){return O.some((B)=>!D.has(B))}function zd(O){return O.map(t).join(" ")}function qr(O){let D=O[0];return D?t(D):""}function Tn(O,D){let B=O[D];return B?t(B):void 0}function TS(O){return Bd.test(qr(O))}function IS(O,D,B){if(!O.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${D.get("TMPDIR")??B.get("TMPDIR")??""}${O.slice(8)}`}}var kS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function OS(O,D,B){let Q=1,ee=B;while(Q<O.length){let he=Tn(O,Q);if(!he)break;if(he==="--")return{words:O.slice(Q+1),cwd:ee};if(!he.startsWith("-"))break;if(he==="-D"||he==="--chdir"){let je=Tn(O,Q+1);ee=je?Mo(ee,je,D):null,Q+=2;continue}if(he.startsWith("--chdir=")){ee=Mo(ee,he.slice(8),D),Q++;continue}if(he.startsWith("-D")&&he.length>2){ee=Mo(ee,he.slice(2),D),Q++;continue}if(he==="-i"||he==="--login"){ee=null,Q++;continue}if(kS.has(he)){Q+=2;continue}Q++}return{words:O.slice(Q),cwd:ee}}var MS=new Set(["-i","-0","--null"]),DS=new Set(["-u","--unset","-C","--chdir","-P"]);function NS(O,D,B,Q){let ee=new Map,he=[],je=D,at=1,lt=(ct)=>({words:O.slice(ct),envAssignments:ee,cwd:je,envSplitValues:he.length>0?he:void 0});while(at<O.length){let ct=Tn(O,at);if(!ct)break;if(ct==="--")return lt(at+1);if(ct==="-i"||ct==="--ignore-environment"||ct==="-"){ee.clear();for(let ft of B.keys())ee.set(ft,"");ee.set("TMPDIR",""),at++;continue}if(MS.has(ct)){at++;continue}if(ct==="-u"||ct==="--unset"){let ft=Tn(O,at+1);if(ft!==void 0)ee.set(ft,"");at+=2;continue}if(ct.startsWith("-u")&&ct.length>2&&!ct.startsWith("-u=")){ee.set(ct.slice(2),""),at++;continue}if(ct.startsWith("--unset=")){ee.set(ct.slice(8),""),at++;continue}let ut=ct==="-S"||ct==="--split-string"?{value:Tn(O,at+1),consumed:2}:ct.startsWith("-S")&&ct.length>2?{value:ct.slice(2),consumed:1}:ct.startsWith("--split-string=")?{value:ct.slice(15),consumed:1}:null;if(ut){if(ut.value!==void 0)he.push(ut.value);return je=null,lt(at+ut.consumed)}if(DS.has(ct)){if(ct==="-C"||ct==="--chdir"){let ft=Tn(O,at+1);je=ft?Mo(je,ft,Q.paths):null}at+=2;continue}if(ct.startsWith("-u=")){at++;continue}if(ct.startsWith("-C")&&ct.length>2||ct.startsWith("--chdir=")){let ft=ct.startsWith("--chdir=")?ct.slice(8):ct.startsWith("-C=")?ct.slice(3):ct.slice(2);je=Mo(je,ft,Q.paths),at++;continue}if(ct.startsWith("-P")){at++;continue}if(ct.startsWith("-")){at++;continue}if(!Rn(ct))break;while(at<O.length){let ft=Rn(Tn(O,at)??"");if(!ft)break;ee.set(ft.name,ft.value),at++}if(Tn(O,at)==="--")at++;return lt(at)}return lt(at)}function Mo(O,D,B){if(D==="")return null;if(!O&&!Fd(D))return null;let Q=Fd(D)?PS(D).root:B.realpath(O??"/");if(Q===null)return null;try{return tr(Q,D,B)}catch{return null}}function LS(O){if(Tn(O,1)==="-v")return[...$t(["type"]),...O.slice(2)];let D=1;while(D<O.length){let B=Tn(O,D);if(!B)break;if(B==="-p"||B==="-v"||B==="-V"){D++;continue}if(B==="--")return O.slice(D+1);if(B.startsWith("-")&&!B.startsWith("--")&&B.length>1){if(!/^[pvV]+$/.test(B.slice(1)))break;D++;continue}break}return O.slice(D)}var WS=/['"\\$`{}#]/;function Ki(O,D){if(O.some((Q)=>WS.test(Q)))return null;let B=[...O.flatMap((Q)=>Q.split(/\s+/).filter((ee)=>ee.length>0)),...D];return B.length<=64?B:null}function nr(O,D,B){return qi(O,D,B).tokens}function GS(O){let D=[],B="",Q=0;while(Q<O.length){let ee=O.charAt(Q);if(ee==='"'||ee==="'"){let he=O.indexOf(ee,Q+1);if(he===-1)return O.split(/\s+/).map((je)=>je.replace(/["']/g,"")).filter((je)=>je.length>0);B+=O.slice(Q+1,he),Q=he+1;continue}if(/\s/.test(ee)){if(B.length>0)D.push(B);B="",Q++;continue}B+=ee,Q++}if(B.length>0)D.push(B);return D}function Cr(O,D,B,Q=0){let ee=qi(O,D,B),he=(ee.envSplitValues??[]).flatMap(GS);if(he.length===0)return ee.tokens;let je=[...he,...ee.tokens];if(Q>=8)return je;return Cr(je,D,B,Q+1)}function qi(O,D,B,Q){if(!$d(O[0]??""))return{tokens:[...O],envAssignments:new Map,cwd:B};let ee=Sr($t(O),D,B,Q);return{tokens:ee.words.map(t),envAssignments:ee.envAssignments,cwd:ee.cwd,envSplitValues:ee.envSplitValues}}var ul=Symbol("adopt-as-operand"),FS=new Set(["env","sudo","command","builtin"]),zS=new Set(["&&","||","|&","|","&",";"]),BS=new Set(["<<","<<<",">|"]),$S=new Set(["|","|&"]),US=/[*@#?$!_-]/,HS=/^\w+(?::\w+)*/,jS=Object.freeze([]),Do=Object.freeze({kind:"scope",edge:"enter"}),No=Object.freeze({kind:"scope",edge:"exit"}),VS=Object.freeze([]),KS=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Lo=new Set(["bash","sh","zsh","dash","ksh"]),qS=256,Kd=new WeakMap;function qd(O,D){let B=D.status==="complete"?new Set(cl(D)):new Set,Q=XS(O,B);if(bi(Q))return Yi("unclosed-quote",Q,D);let ee={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},he=vr(D,{source:Q,suppressed:B,flags:ee,depth:0,functions:new Map,powershell:D.dialect==="powershell"});if(ee.limited)return Yi("structural-limit",Q,D);if(ee.invalid)return Yi("invalid",Q,D);let je=Yi("complete",Q,D,ee.assignmentFallbacks);return Kd.set(je,Object.freeze(he)),je}function Xi(O,D,B,Q,ee){let he=ee.word??((ft)=>ft),je={cwd:D,variables:new Map,previous:null},at=[],lt=new Set,ct=null,ut=[];for(let ft of Yd(O)){if(ft.kind==="scope"){if(ft.edge==="enter"){ut.push({state:je,segment:[...at],shellWords:new Set(lt),pipeProducer:ct});continue}let dt=ee.segment(at,je,ct,null,lt);if(dt)return dt;let mt=ut.pop();if(mt===void 0)throw Error("scope exit without a matching enter");je=mt.state,at=mt.segment,lt=mt.shellWords,ct=mt.pipeProducer;continue}if(ft.kind==="operator"){if(!ft.boundary)continue;let dt=ee.segment(at,je,ct,ft.operator,lt);if(dt)return dt;je=YS(at,je,B,Q),ct=at.length>0&&$S.has(ft.operator)?at:null,at=[],lt=new Set;continue}if(ft.kind==="redirection"){if(ft.fd!==void 0)lt.add(at.length-1);if(ft.target===void 0)continue;let dt=ee.redirection({operator:ft.operator,role:ft.role,targetOrder:ft.targetOrder,target:ft.target,...ft.body===void 0?{}:{body:ft.body,consumer:ft.consumer}},je);if(dt===ul){lt.add(at.length),at.push(he(ft.target));continue}if(dt)return dt;continue}at.push(he(ft.text))}return ee.segment(at,je,ct,null,lt)}function Ji(O){return Yd(O).flatMap((D)=>{if(D.kind==="word")return[{kind:"word",text:D.text}];if(D.kind==="operator")return[{kind:"operator",boundary:D.boundary}];if(D.kind==="redirection")return[{kind:"redirection",target:D.target}];return[]})}function ln(O,D){return O.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(B,Q,ee,he)=>{let je=D.get(Q);if(je===void 0)return B;let at=ee.startsWith(":")?je!=="":!0;if(ee.endsWith("-"))return at?je:ln(he,D);return at?ln(he,D):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(B,Q)=>D.get(Q)??B).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(B,Q)=>D.get(Q)??B)}function Wo(O){return O.length>0&&O.every((D)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(D))}function YS(O,D,B,Q){let ee=Wo(O)?new Map([...D.variables,...ZS(O,D.variables)]):D.variables,he=nr([...O],B),je=Tt(he[0]??"").toLowerCase()==="cd"?he[1]:void 0;if(!je)return{...D,variables:ee};if(je==="-"){if(D.previous===null)return{...D,variables:ee};return{cwd:D.previous,variables:ee,previous:D.cwd}}return{cwd:tn(ln(je,ee),D.cwd,B,Q),variables:ee,previous:D.cwd}}function ZS(O,D){return O.flatMap((B)=>{let Q=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(B),ee=Q?.[2]?.startsWith("=")?Q[2].slice(1):void 0;return Q?.[1]!==void 0&&ee!==void 0?[[Q[1],ln(ee,D)]]:[]})}function Yd(O){return Kd.get(O)??jS}function XS(O,D){return[...D].reduce((B,Q)=>B.slice(0,Q.start)+" ".repeat(Q.end-Q.start)+B.slice(Q.end),O)}function Yi(O,D,B,Q=VS){return Object.freeze({status:O,source:D,program:B,assignmentFallbacks:Object.freeze(Q)})}function vr(O,D){return O.nodes.flatMap((B,Q)=>JS(B,O,Q,D)).sort((B,Q)=>B.start-Q.start).flatMap((B)=>[...B.events])}function JS(O,D,B,Q){if(O.kind==="connector")return[{start:O.span.start,events:[In(rC(O.operator))]}];if(O.kind==="unknown")return[{start:O.span.start,events:[In(O.source)]}];if(O.kind==="function")return Q.functions.set(O.name,O.body),[];if(O.kind==="group"){let he=O.style!=="subshell",je=Q.source[O.span.end-1]===(he?"}":")"),at=he?Q:{...Q,functions:new Map(Q.functions)};return[{start:O.span.start,events:he?[Zi("{"),...vr(O.body,at),...je?[Zi("}")]:[]]:[Do,In("("),...vr(O.body,at),...je?[In(")")]:[],No]}]}let ee=aC(O,Q.functions);if(ee){if(Q.depth>=er.maxDepth||++Q.flags.expansions>qS)return Q.flags.limited=!0,[];return[{start:O.span.start,events:[...Ud(O,Q),Zi(";"),...vr(ee,{...Q,depth:Q.depth+1}),Zi(";")]},...Hd(O,D,B,Q)]}return[{start:O.span.start,events:Ud(O,Q)},...Hd(O,D,B,Q)]}function Ud(O,D){return[...O.words.map((B)=>({start:B.span.start,events:Xd(B,O,D,!1)})),...O.redirections.map((B)=>({start:B.span.start,events:QS(B,O,D)}))].sort((B,Q)=>B.start-Q.start).flatMap((B)=>B.events)}function QS(O,D,B){let Q=O.operator==="<<-"?"<<":O.operator,ee=O.target?Xd(O.target,D,B,!0):[],he=ee[0],je=he?.kind==="word"?he.text:void 0;return[...O.fd===void 0?[]:[dl(String(O.fd))],Object.freeze({kind:"redirection",operator:Q,...O.fd===void 0?{}:{fd:O.fd},role:oC(Q),targetOrder:BS.has(Q)?"legacy-segment":"immediate",...je===void 0?{}:{target:je},...O.heredoc&&B.suppressed.has(O.heredoc.bodySpan)?{body:O.heredoc.body,consumer:Qd(D)}:{}}),...je===void 0?ee:ee.slice(1)]}function Hd(O,D,B,Q){let ee=O.redirections.filter((he)=>he.operator==="<<"||he.operator==="<<-");return[...ee.flatMap((he)=>{let je=he.heredoc;if(!je)return[];let at=[dl(je.delimiter),.../[\r\n]/.test(Q.source[je.terminatorSpan.end]??"")?[In(";")]:[]];if(Q.suppressed.has(je.bodySpan))return[{start:je.bodySpan.start,events:at}];return[{start:je.bodySpan.start,events:[...Zd(Q.source.slice(je.bodySpan.start,je.bodySpan.end),Q),...at]}]}),...ee.some((he)=>!he.heredoc&&he.target)?eC(D,B,Q):[]]}function eC(O,D,B){let Q=O.nodes.slice(D+1).find((ee)=>ee.kind==="connector");if(!Q||Q.span.end>=O.span.end)return[];return[{start:Q.span.end,events:Zd(B.source.slice(Q.span.end,O.span.end),B)}]}function Zd(O,D){if(D.depth>=er.maxDepth)return D.flags.limited=!0,[];let B=h(O,"posix");if(B.status==="limited")return D.flags.limited=!0,[];let Q={invalid:!1,limited:!1,expansions:D.flags.expansions,assignmentFallbacks:D.flags.assignmentFallbacks},ee=vr(B,{source:O,suppressed:new Set,flags:Q,depth:D.depth+1,functions:new Map,powershell:!1});return D.flags.limited||=Q.limited,D.flags.expansions=Q.expansions,ee}function Xd(O,D,B,Q){let ee=[],he={single:!1,double:!1},je="",at=!1,lt=()=>{let ct=at&&!Q?In("glob"):je!==""||O.quoted&&ee.length===0?dl(je):void 0;if(ct)ee.push(ct);je="",at=!1};for(let ct of O.parts){if(ct.provenance!=="command-substitution"&&ct.provenance!=="arithmetic"){for(let mt of al(ct.raw,he,B.flags,B.powershell)){if(typeof mt==="string"){lt(),ee.push(In(mt));continue}je+=mt.text,at||=mt.glob}continue}let ut=D.nested.find((mt)=>mt.span.start>=ct.span.start&&mt.span.end<=ct.span.end);if(he.double){let mt=B.source.slice(ct.span.start,ct.span.end);je+=al(mt,{single:!1,double:!0},B.flags,B.powershell).map((ht)=>typeof ht==="string"?ht:ht.text).join("");let pt=ut?vr(ut,B).filter((ht)=>ht.kind==="redirection"&&ht.body!==void 0):[];if(pt.length>0)ee.push(Do,...pt,No);continue}let ft=ut?vr(ut,B):[];if(ct.raw.startsWith("`")){je+="${}",lt(),ee.push(Do,...ft,No);continue}if(ct.raw.startsWith("<(")||ct.raw.startsWith(">(")){lt(),ee.push(ct.raw.startsWith("<(")?In("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Do,...ft,...ct.raw.endsWith(")")?[In(")")]:[],No);continue}let dt=ct.raw.startsWith("$((")?2:1;je+="${}",lt(),ee.push(...Array.from({length:dt},()=>In("(")),...dt===1?[Do]:[],...ft,...ct.raw.endsWith(")".repeat(dt))?Array.from({length:dt},()=>In(")")):[],...dt===1?[No]:[])}return lt(),ee}function al(O,D,B,Q){let ee=[],he="",je=!1,at=0;while(at<O.length){let lt=O[at]??"";if(!D.single&&!D.double&&(lt==="("||lt===")")){ee.push({text:he,glob:je},lt),he="",je=!1,at++;continue}if(Q&&lt==="`"&&!D.single){he+=O[at+1]??"",at+=2;continue}if(D.single&&lt==="'"){D.single=!1,at++;continue}if(D.single){he+=lt,at++;continue}if(D.double){if(lt==='"'){D.double=!1,at++;continue}if(!Q&&lt==="\\"){let ct=O[at+1]??"";he+=['"',"\\","$"].includes(ct)?ct:`\\${ct}`,at+=2;continue}if(lt==="$"){let ct=jd(O,at,D,B,Q);he+=ct.text,at=ct.next;continue}he+=lt,at++;continue}if(lt==="'"||lt==='"'){D.single=lt==="'",D.double=lt==='"',at++;continue}if(!Q&&lt==="\\"){let ct=O[at+1]??"";je||=ct==="*"||ct==="?",he+=ct,at+=2;continue}if(lt==="$"){let ct=jd(O,at,D,B,Q);he+=ct.text,at=ct.next;continue}je||=lt==="*"||lt==="?",he+=lt,at++}return[...ee,{text:he,glob:je}]}function jd(O,D,B,Q,ee){let he=O[D+1];if(he==="{"){let at=nC(O,D+2);if(at===-1)return Q.invalid=!0,{text:"",next:O.length};let lt=O.slice(D,at+1);return tC(lt,B,Q,ee),{text:lt,next:at+1}}if(he!==void 0&&US.test(he))return{text:`\${${he}}`,next:D+2};let je=(ee?HS:/^\w*/).exec(O.slice(D+1))?.[0]??"";return{text:`\${${je}}`,next:D+1+je.length}}function tC(O,D,B,Q){let ee=O.slice(2,-1),he=/^[A-Za-z_][A-Za-z0-9_]*/.exec(ee)?.[0];if(!he)return;let je=ee.slice(he.length),at=[":=","="].find((ct)=>je.startsWith(ct));if(!at)return;let lt=al(je.slice(at.length),{...D},B,Q);B.assignmentFallbacks.push(...lt.flatMap((ct)=>typeof ct==="string"||!ct.text?[]:[ct.text]))}function nC(O,D){let B=1,Q=D;while(B>0&&Q<O.length){if(O[Q]==="{"&&O[Q-1]==="$")B++;if(O[Q]==="}")B--;Q++}return B===0?Q-1:-1}function rC(O){return/^[\r\n]+$/.test(O)?";":O}function In(O){return Object.freeze({kind:"operator",operator:O,boundary:zS.has(O)})}function Zi(O){return Object.freeze({kind:"operator",operator:O,boundary:!0})}function dl(O){return Object.freeze({kind:"word",text:O})}function oC(O){if(O==="<<"||O==="<<<")return"here-data";if(O==="<"||O==="<&")return"file-read";return"file-write"}function Go(O){return KS.has(O)||/^python\d/.test(O)}var iC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Jd(O,D){let B=D[0];if(B===void 0||!B.startsWith("-"))return D;let Q=iC.get(O)?.has(B)??!1;return Jd(O,D.slice(Q?2:1))}function ll(O){let D=O[0];if(D===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(D))return ll(O.slice(1));if(!FS.has(D))return[...O];return ll(Jd(D,O.slice(1)))}function Qd(O){let D=xo(O),B=O.words.findIndex((Q)=>Q.provenance==="literal"&&Q.text===D);return ll(B<0?[]:O.words.slice(B).map((Q)=>Q.text))}function sC(O){let D=Qd(O)[0];if(D===void 0)return!1;let B=Tt(D).toLowerCase();return Go(B)&&!Lo.has(B)}function cl(O){return O.nodes.flatMap((D,B)=>{if(D.kind==="group"||D.kind==="function")return cl(D.body);if(D.kind!=="command")return[];let Q=D.nested.flatMap((at)=>cl(at)),ee=D.redirections.flatMap((at)=>at.heredoc?.quotedDelimiter?[at.heredoc.bodySpan]:[]);if(sC(D))return[...Q,...ee];let he=O.nodes[B+1];if(he?.kind==="connector"&&(he.operator==="|"||he.operator==="|&")||!cC(D))return Q;return[...Q,...ee]})}function aC(O,D){let B=xo(O);return B===void 0?void 0:D.get(B)}function rr(O,D){return O!==void 0&&O.provenance==="literal"&&!O.quoted&&O.raw===O.text&&O.text===D}function lC(O){if(rr(O.words[0],"git"))return rr(O.words[1],"commit");if(!rr(O.words[0],"gh")||!rr(O.words[2],"create"))return!1;return rr(O.words[1],"pr")||rr(O.words[1],"issue")}function cC(O){return(rr(O.words[0],"cat")||rr(O.words[0],"tee")||lC(O))&&!O.words.some(Vd)&&!O.redirections.some((B)=>Vd(B.target))}function Vd(O){return O?.parts.some((D)=>D.provenance==="command-substitution"&&D.raw.startsWith(">("))??!1}var ef=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),tf=new Set([...ef,"glob"]),uC=new Set([...tf,"pattern"]);class y extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Fo(O){let D=dC(),B=ne(O.input),Q=[];if((O.route.kind==="command"||O.route.kind==="unknown")&&B)Q.push({usage:"input-candidate",source:B});if(O.route.kind==="command"&&"command"in O&&O.command)Q.push({usage:"declared-command",source:O.command});let ee=Q.reduce((he,je)=>{let at=he.findIndex((ut)=>ut.source===je.source);if(at!==-1){let ut=he[at];if(!ut)return he;return he[at]={...ut,usages:[...ut.usages,je.usage]},he}let lt=O.route.kind==="command"?O.route.shell:process.platform==="win32"?"powershell":"posix",ct=D.getCommandProgram(je.source,lt);return he.push({usages:[je.usage],source:je.source,program:ct,shell:D.getShellSyntax(je.source,ct)}),he},[]);return{invocation:{toolName:O.toolName,route:O.route,context:O.context},commands:ee,paths:fC(O),store:D}}function cn(O,D){return O.commands.find((B)=>B.usages.includes(D))}function Hn(O,D){if(!O.includes("$"))return O;return Zs(O,D)}function dC(){let O=new Map,D=new Map,B=new WeakMap,Q=(he,je)=>{let at=`${je}\x00${he}`,lt=D.get(at);if(lt)return lt;let ct=h(he,je);return D.set(at,ct),ct};return{getShellSyntax:(he,je)=>{if(je&&je.source!==he)throw TypeError("Shell syntax source does not match command program source.");let at=je??Q(he,"posix");if(at.status==="limited"){let ut=B.get(at);if(ut)return ut;let ft={status:"structural-limit",source:he,program:at,assignmentFallbacks:[]};return B.set(at,ft),ft}let lt=O.get(he);if(lt)return lt;let ct=qd(he,at);return O.set(he,ct),ct},getCommandProgram:Q}}function fC(O){let D=O.route.kind==="grep"?tf:O.route.kind==="glob"?uC:ef;return[...zc(O.input,D),...O.route.kind==="patch"?Uc(O.input):[]]}var mC=new Set(["-S","--suffix"]);function Yr(O,D,B,Q,ee){if(O.status==="structural-limit")throw new y;if(O.status!=="complete")return ee.findMalformedTarget(O.source);return Xi(O,D,B,Q,{segment:(he,je)=>ee.findSegmentTarget(he,je),redirection:(he,je)=>he.role==="file-write"&&ee.isRedirectionTarget(ln(he.target,je.variables),je)?he.target:null})}function Qi(O){let D=[],B=null,Q=!1;for(let ee=0;ee<O.length;ee++){let he=O[ee];if(he===void 0)break;if(!Q&&he==="--"){Q=!0;continue}if(!Q&&(he==="-t"||he==="--target-directory")){B=O[++ee]??null;continue}if(!Q&&he.startsWith("--target-directory=")){B=he.slice(19);continue}if(!Q&&he.startsWith("-t")&&he.length>2){B=he.slice(2);continue}if(!Q&&mC.has(he)){ee++;continue}if(!Q&&(he.startsWith("--suffix=")||he.startsWith("--backup=")))continue;if(!Q&&he.startsWith("-"))continue;D.push(he)}return B?{sources:D,destination:B}:{sources:D.slice(0,-1),destination:D.at(-1)??null}}var x="Git metadata and hooks are protected. Ask the user before modifying them.";function af(O,D,B,Q){let ee=O.invocation.context.executionCwd;if(!D)return null;if(O.invocation.route.kind==="patch"||O.invocation.route.kind==="path"||O.invocation.route.kind==="unknown"){if(ci(O.invocation.toolName))return null;let at=O.paths.find((lt)=>nf(lt,ee,D,B,Q,D.entries));return at?{target:at}:null}if(O.invocation.route.kind!=="command")return null;let he=cn(O,"input-candidate");if(!he)return null;let je=Yr(he.shell,ee,B,Q,{findSegmentTarget:(at,lt)=>yC(at,lt,D,B,Q),isRedirectionTarget:(at,lt)=>nf(at,lt.cwd,D,B,Q,D.markerFiles),findMalformedTarget:()=>null});return je?{target:je}:null}function Er(O,D,B,Q,ee,he,je=!1){if(!B)return!1;let at=ts(tn(O,D,ee,he)),lt=at.replace(/(\/\.?\*+)+$/,"");if(lt!==at&&lt!==""){if(fl(lt,B))return!0;let ct=je||at.slice(lt.length).includes("/."),ut=(ft)=>ct?es(ft,lt):pC(ft,lt);if(B.markerFiles.some(ut))return!0;return Q&&rf(B).some(ut)}if(fl(at,B))return!0;return Q&&rf(B).some((ct)=>es(ct,at))}function pC(O,D){let B=sf(D,O);if(B===""||B.startsWith("..")||of(B))return!1;return!B.split(/[\\/]/)[0]?.startsWith(".")}function gC(O,D,B,Q,ee){return Er(O,D,B,!0,Q,ee)}function hC(O,D,B,Q,ee){if(!B)return!1;return fl(ts(tn(O,D,Q,ee)),B)}function nf(O,D,B,Q,ee,he){let je=ts(tn(O,D,Q,ee));return he.includes(je)||cf(je,B)}function lf(O,D,B,Q,ee){if(!B)return!1;return B.hooksDirectories.some((he)=>O.some((je)=>es(he,ts(tn(je,D,Q,ee)))))}function fl(O,D){return D.entries.includes(O)||D.directories.includes(O)||cf(O,D)}function cf(O,D){return D.hooksDirectories.some((B)=>es(O,B))}function rf(O){return[...O.entries,...O.directories,...O.hooksDirectories]}function es(O,D){let B=sf(D,O);return B===""||!/^\.\.(?:[\\/]|$)/.test(B)&&!of(B)}function ts(O){return process.platform==="win32"?O.toLowerCase():O}function yC(O,D,B,Q,ee){if(Wo(O))return null;let he=Cr([...O],Q);if(Tt(he[0]??"").toLowerCase()!=="mv")return null;let je=Qi(he.slice(1)),at=je.sources.find((lt)=>gC(ln(lt,D.variables),D.cwd,B,Q,ee));if(at)return at;return je.destination&&hC(ln(je.destination,D.variables),D.cwd,B,Q,ee)?je.destination:null}import{isAbsolute as ss,normalize as _C,parse as wC,posix as yf,resolve as xr,sep as hl}from"node:path";import{isAbsolute as bC,join as uf,normalize as mf,parse as SC,sep as df}from"node:path";var CC=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],vC=` 	
-`;function zo(O,D){if(or(O,D))return!0;if(!O.has("TMPDIR"))return!1;return!ml(O.get("TMPDIR")??"",D)}function Rr(O,D){if(O.has("TMPDIR"))return ml(O.get("TMPDIR")??"",D);let B=pl(O,D);if(B===void 0)return!0;return ml(B,D)}function pl(O,D){return gf(O,D,"TMPDIR")}function ml(O,D){if(!O)return!1;if(RC(O))return!1;return Zr(O,D)}function or(O,D){let B=gf(O,D,"IFS");return B!==void 0&&B!==""&&B!==vC}function Zr(O,D){let B=ns(O,D.paths);if(B===null)return!1;return pf(D).some((Q)=>is(B,Q))}function os(O,D){let B=ns(O,D.paths);if(B===null)return!1;return pf(D).some((Q)=>rs(Q)===rs(B))}var ff=new WeakMap;function pf(O){let D=ff.get(O);if(D)return D;let B=EC(O);return ff.set(O,B),B}function EC(O){let D=CC.map((Q)=>ns(Q,O.paths)??mf(Q)),B=ns(O.tmpdir,O.paths);if(!B)return D;if(process.platform==="win32")return[...D,B];if(process.platform==="darwin"&&xC(B))return[...D,B];return D}function RC(O){return/[\s$`*?[]/.test(O)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(O)||/[+@!]\([^)]*\)/.test(O)}function gf(O,D,B){return O.has(B)?O.get(B):D.env.get(B)}function xC(O){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(O)}function ns(O,D){try{let B=mf(O);if(!bC(B))return B;let Q=SC(B).root,ee=B.slice(Q.length).split(/[\\/]+/).filter(Boolean),he=Q;for(let je=0;je<ee.length;je++){let at=uf(he,ee[je]??"");if(D.entryKind(at)==="missing")return uf(at,...ee.slice(je+1));let lt=D.realpath(at);if(lt===null)return null;he=lt}return he}catch{return null}}function is(O,D){let B=rs(O),Q=rs(D);if(B===Q)return!0;let ee=Q.endsWith(df)?Q:`${Q}${df}`;return B.startsWith(ee)}function rs(O){return process.platform==="win32"?O.toLowerCase():O}var PC=process.platform==="win32",hf=64,AC=16384;function Bo(O,D,B,Q){if(O.kind==="temp_target")return null;let ee=Q[O.kind];if(O.kind==="dynamic_target"&&!Jt(B,ee.id,D.strict))return null;if(O.kind==="within_anchored_cwd"&&!Jt(B,ee.id,D.paranoid))return null;return St(ee.id,ee.reason)}function $o(O){let D=sd(O,hf,hf,AC);return{expandedTargets:D&&"words"in D?D.words:void 0,unsafeBraceExpansion:D!==void 0&&"limited"in D,targetIsLiteral:D===void 0&&O.provenance==="literal"&&(O.quoted||O.raw!==O.text),tmpdirWordSplittingProtected:TC(O)}}function TC(O){let D=O.parts.filter((B)=>B.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(B.raw));return D.length>0&&D.every((B)=>IC(O.raw,B.span.start-O.span.start))}function IC(O,D){let B=null,Q=!1;for(let ee=0;ee<D;ee++){let he=O[ee];if(Q){Q=!1;continue}if(he==="\\"&&B!=="'"){Q=!0;continue}if(B===he){B=null;continue}if(B===null&&(he==="'"||he==='"'))B=he}return B==='"'}function _r(O){let D=O.environment.home,B=O.environment.paths,Q=O.budget??fn();return{anchoredCwd:O.originalCwd??O.cwd??null,resolvedCwd:O.cwd??null,strict:O.strict??!1,paranoid:O.paranoid??!1,trustTmpdirVar:O.allowTmpdirVar??!0,posixShell:O.posixShell??!1,tmpdirWordSplittingUnsafe:O.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:O.trustedTmpdirValue??O.allowTmpdirVar??!0,environment:O.environment,allowRoots:LC(O.allowPaths,D,B,Q),protectedGitMetadata:O.protectedGitMetadata,budget:Q}}function kn(O,D,B={}){let Q=B.targetIsLiteral??!1;if(!Q&&D.tmpdirWordSplittingUnsafe&&!B.tmpdirWordSplittingProtected&&GC(O))return{kind:"outside_anchored_cwd"};let ee=!Q&&Sf(O,D.posixShell);if(Jn(O))return{kind:"outside_anchored_cwd"};if(yl(O,Q))return{kind:"root_or_home_target"};if(OC(O,D,Q))return{kind:"root_or_home_target"};if(D.resolvedCwd&&Er(O,D.resolvedCwd,D.protectedGitMetadata,!0,D.environment,D.budget,!D.posixShell))return{kind:"git_metadata_target"};if(MC(O,D.trustTmpdirVar,D.posixShell,ee,Q,B.tmpdirWordSplittingProtected??!1,D.trustedTmpdirValue,D.environment))return{kind:"temp_target"};if(ee)return{kind:"dynamic_target"};if(WC(O,D,Q))return{kind:"temp_target"};let he=D.anchoredCwd;if(he){if(!B.skipHomeCwd&&$C(he,D.environment.home,D.environment.paths,D.budget))return{kind:"home_cwd_target"};if(!B.skipCwdSelf&&[D.resolvedCwd??he,he].some((je)=>UC(O,D.resolvedCwd??he,D.environment.paths,D.budget,je)))return{kind:"cwd_self_target"};if(HC(O,he,D.resolvedCwd??he,ee,Q,D.environment.paths,D.budget))return{kind:"within_anchored_cwd"}}if(kC(O,D,ee))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function kC(O,D,B){let Q=O.trim();if(B||!D.resolvedCwd||!D.anchoredCwd||!Q)return!1;if(ss(Q)||Q.startsWith("~"))return!1;if(bl(Q))return!1;if(Cf(D.resolvedCwd,D.anchoredCwd,D.environment.paths,D.budget))return!1;return Zr(xr(D.resolvedCwd,Q),D.environment)}function bf(O,D,B={}){let{containmentTarget:Q,...ee}=B;if(kn(O,D,ee).kind!=="temp_target")return!1;let he=O.trim();if(NC(he))return!1;if(os(he,D.environment))return!1;return![D.anchoredCwd,D.resolvedCwd].some((je)=>Cf(Q??he,je,D.environment.paths,D.budget))}function yl(O,D=!1){let B=O.trim(),Q=yf.normalize(B),ee=B.replace(/\\/g,"/"),he=Q==="/"?Q:Q.replace(/\/+$/,"");if(he==="/"||he.startsWith("/")&&he.slice(1).split("/").every((je)=>/^\*+$/.test(je)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(ee)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(ee))return!0;if(!D&&(Q==="~"||Q==="~/"||Q==="~/*"))return!0;if(!D&&(Q==="$HOME"||Q==="$HOME/"||Q==="$HOME/*"))return!0;if(!D&&(Q==="${HOME}"||Q==="${HOME}/"||Q==="${HOME}/*"))return!0;return!1}function OC(O,D,B){let Q=O.trim(),ee=B?Q:Q==="*"?".":Q.endsWith("/*")?Q.slice(0,-2):Q;if(!ee)return!1;try{let he=ss(ee)?ee:D.resolvedCwd?xr(D.resolvedCwd,ee):null;if(!he)return!1;let je=un(Lt(he,D.environment.paths,D.budget));if(je===wC(je).root)return!0;return je===un(Lt(D.environment.home,D.environment.paths,D.budget))}catch{return!1}}function un(O){let D=_C(O);if(PC){if(D=D.replace(/\//g,"\\").toLowerCase(),D.length>3&&D.endsWith("\\"))D=D.slice(0,-1);return D}if(D.length>1&&D.endsWith("/"))D=D.slice(0,-1);return D}function MC(O,D,B,Q,ee,he,je,at){let lt=O.trim();if(bl(lt))return!1;if(!Q&&Zr(lt,at))return!0;return(D||he&&je)&&B&&!ee&&DC(lt,B)}function DC(O,D){return["$TMPDIR","${TMPDIR}"].some((B)=>{if(O===B)return!0;if(!O.startsWith(`${B}/`))return!1;return!Sf(O.slice(B.length+1),D)})}function NC(O){let D=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(O);if(!D)return!1;return yf.normalize(`/${D[1]??""}`)==="/"}function bl(O){return O.split(/[\\/]+/).includes("..")}function LC(O,D,B,Q){if(!O?.length)return[];return O.flatMap((ee)=>{let he=vo(ee.trim(),D);if(!ss(he))return[];try{let je=Lt(he,B,Q);if(Eo(je,Lt(D,B,Q)))return[];return[un(je)]}catch{return[]}})}function WC(O,D,B){if(D.allowRoots.length===0)return!1;let Q=O.trim();if(bl(Q))return!1;let ee=B?Q:vo(Q,D.environment.home),he=D.resolvedCwd??D.anchoredCwd,je=ss(ee)?ee:he?xr(he,ee):null;if(!je)return!1;try{let at=un(Lt(je,D.environment.paths,D.budget));return D.allowRoots.some((lt)=>at===lt||at.startsWith(lt.endsWith(hl)?lt:`${lt}${hl}`))}catch{return!1}}function GC(O){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(O)}function Sf(O,D=!1){return O.includes("$")||O.includes("`")||FC(O)||D&&zC(O)}function FC(O){let D=!1;for(let B of O){if(D){D=!1;continue}if(B==="\\"){D=!0;continue}if(B==="*"||B==="?"||B==="[")return!0}return!1}function zC(O){let D=!1;for(let B=0;B<O.length;B++){let Q=O[B];if(D){D=!1;continue}if(Q==="\\"){D=!0;continue}if(Q==="{"&&BC(O,B)||(Q==="+"||Q==="@"||Q==="!")&&O[B+1]==="(")return!0}return!1}function BC(O,D){let B=O.indexOf("}",D+1);if(B===-1)return!1;let Q=O.slice(D+1,B);return Q.includes(",")||Q.includes("..")}function $C(O,D,B,Q){try{return un(Lt(O,B,Q))===un(Lt(D,B,Q))}catch{try{return un(O)===un(D)}catch{return!1}}}function UC(O,D,B,Q,ee=D){if(ee===D&&(O==="."||O==="./"||O===".\\"))return!0;try{return un(Lt(xr(D,O),B,Q))===un(Lt(ee,B,Q))}catch{try{return un(xr(D,O))===un(ee)}catch{return!1}}}function HC(O,D,B,Q,ee,he,je){let at=B??D;if(!ee&&(O.startsWith("~")||O.startsWith("$HOME")||O.startsWith("${HOME}")))return!1;if(Q)return!1;if(O.startsWith("/")||/^[A-Za-z]:[\\/]/.test(O))try{return gl(O,D,he,je)}catch{return!1}if(O.startsWith("./")||O.startsWith(".\\")||!O.includes("/")&&!O.includes("\\"))try{return gl(xr(at,O),D,he,je)}catch{return!1}if(O.startsWith("../"))return!1;try{return gl(xr(at,O),D,he,je)}catch{return!1}}function gl(O,D,B,Q){try{return vf(Lt(O,B,Q),Lt(D,B,Q))}catch{return!1}}function Cf(O,D,B,Q){if(!D)return!1;try{return vf(Lt(D,B,Q),Lt(O,B,Q))}catch{return!0}}function vf(O,D){let B=un(O),Q=un(D);return B.startsWith(`${Q}${hl}`)||B===Q}var jC=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Ef="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",VC="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Rf="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",xf="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",KC="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",qC="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",YC={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:xf},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:x},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Rf},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:KC},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Ef},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:VC},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Ef}};function _f(O,D,B,Q=_r({...B,allowPaths:B.policy?.destructiveCommandAllowPaths})){return ZC(O.words.map((ee)=>({kind:"word",text:ee.text,dynamic:ee.provenance!=="literal"})),D,Q,B.policy)}function ZC(O,D,B,Q){let ee=O.filter((lt)=>lt.kind==="word"),he=JC(ee),je=ee[he];if(!je||!jC.has(av(je.text)))return null;let at=XC(ee.slice(he+1));if(at.whatIfProtected)return null;if(Jt(Q,"powershell.remove-item-pipeline-dynamic-target",B.strict)&&D&&(at.targets.length===0||at.recursive))return St("powershell.remove-item-pipeline-dynamic-target",qC);for(let lt of at.targets)if(!Jn(lt.text)&&yl(Cl(lt.text)))return St(at.recursive&&at.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",xf);for(let lt of at.targets)if(B.resolvedCwd&&Er(Cl(lt.text),B.resolvedCwd,B.protectedGitMetadata,at.recursive,B.environment,B.budget,!0))return St("powershell.remove-item-git-metadata",x);if(!at.recursive||!at.force)return null;if(Jt(Q,"powershell.remove-item-recursive-force-dynamic-target",B.strict)&&(at.hasDynamicTarget||at.targets.length===0))return St("powershell.remove-item-recursive-force-dynamic-target",Rf);for(let lt of at.targets){let ct=Bo(kn(Cl(lt.text),B),B,Q,YC);if(ct)return ct}return null}function XC(O){let D=[],B=!1,Q=!1,ee=!1,he=!1,je=!1;for(let at=0;at<O.length;at++){let lt=O[at];if(!lt||lt.kind!=="word")continue;if(QC(lt))continue;if(je){D.push(Sl(lt)),he=he||lt.dynamic;continue}if(lt.text==="--"){je=!0;continue}let ct=tv(lt.text);if(!ct){D.push(Sl(lt)),he=he||lt.dynamic;continue}if(nv(ct.name)){let ut=ct.value?ev(ct.value,lt):O[++at];if(ut?.kind==="word"){D.push(Sl(ut)),he=he||ut.dynamic;continue}he=!0;continue}if(rv(ct.name)){B=!0;continue}if(ov(ct.name)){Q=!0;continue}if(iv(ct.name))ee=sv(ct.value)}return{targets:D,recursive:B,force:Q,whatIfProtected:ee,hasDynamicTarget:he}}function JC(O){let D=O[0];if(D?.kind==="word"&&D.text==="&"||D?.text===".")return O.length>1?1:0;return 0}function Sl(O){return{text:O.kind==="word"?O.text:"",dynamic:O.kind==="word"&&O.dynamic}}function QC(O){return O.kind==="word"&&O.text===","}function Cl(O){let D=O.replace(/\\/g,"/"),B=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(D);return B?`$HOME${D.slice(B[0].length)}`:D}function ev(O,D){return{kind:"word",text:O,dynamic:D.kind==="word"&&(D.dynamic||O.includes("$"))}}function tv(O){if(!O.startsWith("-")||O==="-")return null;let D=O.slice(1),B=D.indexOf(":");if(B===-1)return{name:D.toLowerCase()};return{name:D.slice(0,B).toLowerCase(),value:D.slice(B+1)}}function nv(O){return"path".startsWith(O)||"literalpath".startsWith(O)}function rv(O){return"recurse".startsWith(O)}function ov(O){return O.length>=2&&"force".startsWith(O)}function iv(O){return O==="wi"||"whatif".startsWith(O)}function sv(O){if(O===void 0||O==="")return!0;let D=O.toLowerCase();return D==="$true"||D==="true"}function av(O){return O.toLowerCase()}var Xr="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",as="Unsupported heredoc syntax",wf="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var lv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),cv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),uv=new Set(["-o","--output","--query","--subscription"]),dv=new Set;function Pf(O){if(O==="aws")return lv;if(O==="gcloud")return cv;if(O==="az")return uv;return dv}var fv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),mv=new Set;function Af(O){if(O==="git")return pn;if(O==="docker")return fv;return mv}function _(O,D){if(O.length===0||D.length===0)return null;let B=kt(O[0]??""),Q=sn(O);for(let ee of D){if(!hv(B,ee.command))continue;if(ee.match){if(pv(B,O,ee.match))return Tf(ee);continue}if(!yv(B,O,ee.subcommand))continue;if(Sv(O,new Set(ee.block_args),Q))return Tf(ee)}return null}function Tf(O){return{id:`custom.${O.name}`,reason:`[${O.name}] ${O.reason}`,intent:O.intent??"manual_only"}}function pv(O,D,B){let Q=D.slice(1);if(B.exclude_args?.some((ee)=>Q.includes(ee)))return!1;if(B.any_args&&!B.any_args.some((ee)=>Q.includes(ee)))return!1;return gv(Q,B.command_path,Pf(O))}function gv(O,D,B){let Q=0,ee=!1;for(let he of O){if(Q>=D.length)return!0;if(ee){ee=!1;continue}if(he.startsWith("-")){ee=!he.includes("=")&&B.has(he);continue}if(he!==D[Q])return!1;Q++}return Q>=D.length}function hv(O,D){return O===kt(D)}function yv(O,D,B){if(!B)return!0;return If(D,1,B,Af(O))}function If(O,D,B,Q){let ee=!1;for(let he=D;he<O.length;he++){let je=O[he];if(!je)continue;if(ee){ee=!1;continue}if(je==="--"){let at=O[he+1];if(at&&!at.startsWith("-"))return at===B;return!1}if(Q.has(je)){ee=!0;continue}if(je.startsWith("-")){if(!je.includes("=")&&bv(O,he,B,Q))return!0;continue}return je===B}return!1}function bv(O,D,B,Q){let ee=O[D+1];if(!ee||ee.startsWith("-"))return!1;return If(O,D+2,B,Q)}function Sv(O,D,B){return O.some((Q)=>D.has(Q))||[...B].some((Q)=>D.has(Q))}var Cv=new Set(["-e","--source"]),vv=new Set(["-F","-v","--assign","--field-separator"]),kf=new Set(["-f","--file"]),Ev=new Set(["print","printf","return"]),Of=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Rv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Mf(O,D,B){let Q=!1;for(let ee of xv(O)){let he=_v(ee,B);if(!he)continue;for(let je of he.commands){let at=D(je);if(at)return at;if(je.includes("{}")||/[$`]/.test(je))Q=!0}Q||=he.dynamic}return Q?St("awk.system-dynamic",Rv):null}function El(O){let D=[],B=!1,Q=!1,ee=!0,he=!0;for(let je=1;je<O.length;je++){let at=O[je];if(at===void 0)break;if(ee&&at==="--"){ee=!1;continue}if(ee&&Cv.has(at)){B=!0;let lt=O[je+1];if(he&&=lt!==void 0,lt!==void 0)D.push({tokenIndex:je+1,kind:"inline-code",value:lt});je++;continue}if(ee&&at.startsWith("--source=")){B=!0,D.push({tokenIndex:je,kind:"inline-code",value:at.slice(9)});continue}if(ee&&at.startsWith("-e")&&at.length>2){B=!0,D.push({tokenIndex:je,kind:"inline-code",value:at.slice(2)});continue}if(ee&&(vv.has(at)||kf.has(at))){let lt=O[je+1];if(he&&=lt!==void 0,kf.has(at)){if(Q=!0,lt!==void 0)D.push({tokenIndex:je+1,kind:"program-file",value:lt})}je++;continue}if(ee&&(at.startsWith("-F")||at.startsWith("-v")&&at.slice(2).includes("=")))continue;if(ee&&at.startsWith("-f")&&at.length>2){Q=!0,D.push({tokenIndex:je,kind:"program-file",value:at.slice(2)});continue}if(ee&&(at.startsWith("--assign=")||at.startsWith("--field-separator=")))continue;if(ee&&at.startsWith("--file=")){Q=!0,D.push({tokenIndex:je,kind:"program-file",value:at.slice(7)});continue}if(ee&&at.startsWith("-")&&at!=="-")continue;if(ee=!1,!B&&!Q)D.push({tokenIndex:je,kind:"main-program",value:at});return{sources:D,optionsOpen:!1}}return{sources:he?D:[],optionsOpen:ee&&he}}function Ho(O){return El(O).sources}function xv(O){return Ho(O).filter((D)=>D.kind!=="program-file").map((D)=>D.value)}function _v(O,D){yn(D,O);let B=O.includes("system")?Rl(O,D):null,Q=wv(O,D);if(!B&&!Q)return null;return{dynamic:!!B?.dynamic||!!Q?.dynamic,commands:[...B?.commands??[],...Q?.commands??[]]}}function Rl(O,D){yn(D,O);let B=[],Q=!1,ee=!1,he=0;while(he<O.length){let je=O[he];if(je==='"'||je==="'"){he=cs(O,he,je)?.endIndex??he+1;continue}if(je==="#"){he=Df(O,he+1);continue}if(je==="/"&&Nf(O,he)){he=Lf(O,he+1)??he+1;continue}if(!O.startsWith("system",he)){he++;continue}let at=he;if(he+=6,Uo(O[at-1])||Uo(O[he]))continue;let lt=ls(O,he);if(O[lt]!=="(")continue;lt=ls(O,lt+1);let ct=O[lt];if(ct!=='"'&&ct!=="'"){Q=!0,ee=!0;continue}let ut=cs(O,lt,ct);if(!ut){Q=!0,ee=!0;continue}if(lt=ls(O,ut.endIndex),Q=!0,O[lt]!==")"){ee=!0,he=ut.endIndex;continue}B.push(ut.value),he=lt+1}if(!Q)return null;return{dynamic:ee,commands:B}}function wv(O,D){yn(D,O);let B=[],Q=!1,ee=!1,he=0,je=0,at=null,lt=null,ct=0;while(he<O.length){let ut=O[he];if(!ut)break;if(ut==='"'||ut==="'"){let mt=cs(O,he,ut);if(mt&&ct===je)lt={...mt,startIndex:he};ct=mt?.endIndex??he+1,he=mt?.endIndex??he+1;continue}if(ut==="#"){he=Df(O,he+1),je=he,at=null,lt=null,ct=he;continue}if(ut==="/"&&Nf(O,he)){let mt=Lf(O,he+1);ct=mt??he+1,he=mt??he+1;continue}if(`;
-{}`.includes(ut)){he++,je=he,at=null,lt=null,ct=he;continue}if(at===null&&(vl(O,he,"print")||vl(O,he,"printf")))at=he;if(ut!=="|"||O[he-1]==="|"||O[he+1]==="|"){if(!/\s/.test(ut))ct=he+1;he++;continue}let ft=O[he+1]==="&"?he+2:he+1,dt=ls(O,ft);if(vl(O,dt,"getline")){ee=!0;let mt=Tv(je,lt,ct);if(Q||=mt===null,mt!==null)B.push(mt);ct=ft,he=ft;continue}if(kv(je,at)){ee=!0;let mt=Av(O,dt);if(!mt){Q=!0,ct=ft,he=ft;continue}if(!Pv(O,mt.endIndex)){Q=!0,ct=mt.endIndex,he=mt.endIndex;continue}B.push(mt.value),ct=mt.endIndex,he=mt.endIndex;continue}ct=ft,he++}if(!ee)return null;return{dynamic:Q,commands:B}}function Uo(O){return!!O&&/[A-Za-z0-9_]/.test(O)}function ls(O,D){let B=D;while(/\s/.test(O[B]??""))B++;return B}function Pv(O,D){let B=D;while(/[\t\f\v\r ]/.test(O[B]??""))B++;let Q=O[B];return!Q||`;
-}#`.includes(Q)}function cs(O,D,B){let Q="",ee=!1;for(let he=D+1;he<O.length;he++){let je=O[he];if(!je)break;if(ee){let at=Iv(O,he);if(!at)return null;Q+=at.value,he=at.endIndex,ee=!1;continue}if(je==="\\"){ee=!0;continue}if(je===B)return{value:Q,endIndex:he+1};Q+=je}return null}function Av(O,D){let B=O[D];if(B!=='"'&&B!=="'")return null;return cs(O,D,B)}function Tv(O,D,B){if(!D)return null;return D.startIndex>=O&&D.endIndex===B?D.value:null}function Iv(O,D){let B=O[D];if(!B)return null;if(B==="x"){let ee=O.slice(D+1,D+3);if(!/^[0-9A-Fa-f]{2}$/.test(ee))return null;return{value:String.fromCharCode(Number.parseInt(ee,16)),endIndex:D+2}}if(/[0-7]/.test(B)){let ee=/^[0-7]{1,3}/.exec(O.slice(D));if(!ee)return null;return{value:String.fromCharCode(Number.parseInt(ee[0],8)),endIndex:D+ee[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[B]??B,endIndex:D}}function vl(O,D,B){return O.startsWith(B,D)&&!Uo(O[D-1])&&!Uo(O[D+B.length])}function kv(O,D){return D!==null&&D>=O}function Df(O,D){let B=O.indexOf(`
-`,D);return B===-1?O.length:B+1}function Nf(O,D){let B=Ov(O,D);if(B===-1)return!0;if("{([,;!~=".includes(O[B]??""))return!0;let Q=B;while(Uo(O[Q-1]))Q--;return Ev.has(O.slice(Q,B+1))}function Ov(O,D){for(let B=D-1;B>=0;B--)if(!/\s/.test(O[B]??""))return B;return-1}function Lf(O,D){let B=!1;for(let Q=D;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(B){B=!1;continue}if(ee==="\\"){B=!0;continue}if(ee==="/")return Q+1}return null}var Mv=new Set(["sudo","env","command","builtin"]);function us(O,D){let B=O[0];if(!B||!D.transparentWrappers.includes(Tt(B)))return null;let Q=Tt(B),ee=O[1]==="--"?2:1,he=Dv(O,ee,Q,D),je=he[0];if(je===void 0)return null;return{wrapper:Q,tokens:[...O.slice(je)],childIndex:je,alternativeChildIndices:he.slice(1)}}function Dv(O,D,B,Q){let ee=O[1]==="--",he=[];for(let je=D;je<O.length;je++){let at=O[je];if(!at)continue;let lt=Tt(at)!==B&&Nv(at,Q);if(lt)he.push(je);if(!lt&&yi.has(kt(at)))break;if(ee)break}return he}function Nv(O,D){let B=Tt(O),Q=kt(O);return Q==="git"||B==="busybox"||wr(O)||ha.has(B)||D.transparentWrappers.includes(B)||Kt.has(Q)||O==="$SHELL"||Pn(Q)||En.has(Q)||D.rules.some((ee)=>ee.command===B)}function wr(O){return Mv.has(O.toLowerCase())}function Pr(O,D){return{embedded:!1,cwd:O.cwd,originalCwd:D.originalCwd,effectiveCwd:O.cwd,envAssignments:O.envAssignments,allowTmpdirVar:D.allowTmpdirVar,worktreeMode:D.worktreeMode,wrappedByTransparent:!1}}function On(O,D){let B=D.policy??{rules:[],transparentWrappers:[]};return ds([...O],D.environment,D.cwd,D.cwd,new Map,new Map(D.envAssignments??[]),B,{iterations:0},!1)}function*ds(O,D,B,Q,ee,he,je,at,lt){let ct=qi(O,D,B,he);for(let[mt,pt]of ct.envAssignments)he.set(mt,pt),ee.set(mt,pt);let{tokens:ut,cwd:ft}=ct;if(ct.envSplitValues){let mt=Ki(ct.envSplitValues,ut);if(!mt)throw new s("derivedCommandShape");xl(at),yield*ds(mt,D,ft,Q,ee,he,je,at,lt);return}if(wr(ut[0]??""))throw new s("wrapperPeelIterations");let dt=us(ut,je);if(dt){for(let mt of[dt.childIndex,...dt.alternativeChildIndices])xl(at),yield*ds(mt===dt.childIndex?dt.tokens:[...ut.slice(mt)],D,ft,Q,new Map(ee),new Map(he),je,at,!0);return}if(Wv(ut)){xl(at),yield*ds([...ut.slice(1)],D,ft,Q,ee,he,je,at,lt);return}yield Lv(ut,ft,Q,ee,he,lt)}function Lv(O,D,B,Q,ee,he){return{tokens:O,cwd:D===null?void 0:D??B,wrapperCwd:D,wrapperEnvAssignments:Q,envAssignments:ee,head:Tt(O[0]??"").toLowerCase(),wrappedByTransparent:he}}function xl(O){if(O.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");O.iterations++}function Wv(O){return Tt(O[0]??"").toLowerCase()==="busybox"&&O.length>1}function _l(O,D){let B=[],Q=D;while(Q<O.length){let ee=O[Q];if(ee===void 0||ee===":::")break;B.push(ee),Q++}return{markerIndex:Q<O.length&&O[Q]===":::"?Q:-1,templateTokens:B}}function Mn(O){let D=!1,B=!1;for(let Q of O){if(Q==="--")break;if(Q==="-r"||Q==="-R"||wl(Q,"recursive")){D=!0;continue}if(Q==="-f"||wl(Q,"force")){B=!0;continue}if(Q.startsWith("-")&&!Q.startsWith("--")){if(Q.includes("r")||Q.includes("R"))D=!0;if(Q.includes("f"))B=!0}}return D&&B}function Wf(O){let D=O.indexOf("--");return O.slice(1,D===-1?void 0:D).some((B)=>wl(B,"recursive")||/^-[A-Za-z]+$/.test(B)&&/[rR]/.test(B.slice(1)))}function wl(O,D){return O.length>2&&O.startsWith("--")&&D.startsWith(O.slice(2))}var Gv="find -delete permanently removes files. Use -print first to preview.",Fv="find -exec rm -rf is dangerous. Use explicit file list instead.",zv=new Set(["-exec","-execdir","-ok","-okdir"]),Bv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((O)=>[O,1]),["-fprintf",2]]);function Gf(O,D){let B=O.map(t),Q=$v(O,B,D);if(Q)return Q;if(ms(B,1)&&!Hv(O,B,D)){let je=wt(St("find.delete",Gv),D.policy);if(je)return je}let ee=D.budget??fn(),he=0;while(he<B.length){let je=B[he],at=ir(je??"");if(at>0){he+=at+1;continue}if(!jn(je)){he++;continue}ee.charge("derivedTokens",B.length-he-1);let lt=jo(B,he);he=lt.nextIndex;let ct=Vv(lt.tokens,D.environment);if(ct){let mt=wt(ct,D.policy);if(mt)return mt}let ut=je==="-execdir"||je==="-okdir",ft=D.analyzeTokens?D.analyzeTokens(lt.tokens,ut?null:D.cwd):D.analyzeNested?D.analyzeNested(lt.tokens.join(" "),{effectiveCwd:ut?void 0:D.cwd,envAssignments:D.envAssignments}):null,dt=ft?.id.startsWith("custom.")?ft:wt(ft,D.policy);if(dt)return dt}return null}function $v(O,D,B){if(!ms(D,1)&&!Pl(D,B.environment))return null;let ee=fs(O)??$t(["."]),he=_r({...B,allowPaths:B.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let je of ee){let at=$o(je);for(let lt of at.expandedTargets??[t(je)]){let ct=kn(lt,he,{targetIsLiteral:at.expandedTargets!==void 0||at.targetIsLiteral,tmpdirWordSplittingProtected:at.tmpdirWordSplittingProtected});if(ct.kind==="root_or_home_target")return St("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ct.kind==="git_metadata_target")return St("find.delete-git-metadata",x)}}if(Uv(D)&&he.resolvedCwd&&lf(ee.map(t),he.resolvedCwd,he.protectedGitMetadata,he.environment,he.budget))return St("find.delete-git-metadata",x);return null}function Pl(O,D){let B=0;while(B<O.length){if(!jn(O[B])){B++;continue}let Q=jo(O,B),ee=Cr([...Q.tokens],D),he=Tt(ee[0]??"").toLowerCase();if((he==="rm"||he==="rmdir")&&ee.some((je)=>je.includes("{}")))return!0;B=Q.nextIndex}return!1}function Uv(O){return O.some((D,B)=>{if(!["-name","-iname"].includes(D))return!1;return O[B+1]?.toLowerCase()==="hooks"})}function Hv(O,D,B){if(D.includes("-L")||D.includes("-f")||D.includes("-follow"))return!1;let Q=fs(O);if(!Q)return!1;let ee=B.envAssignments??new Map,he=pl(ee,B.environment),je=B.trustedTmpdirValue??Rr(ee,B.environment),at=B.allowTmpdirVar??!zo(ee,B.environment),lt=_r({environment:B.environment,protectedGitMetadata:B.protectedGitMetadata,cwd:B.cwd,originalCwd:B.originalCwd,strict:B.strict,allowTmpdirVar:at&&je&&Boolean(he),allowPaths:B.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:B.tmpdirWordSplittingUnsafe??or(ee,B.environment),trustedTmpdirValue:je,budget:B.budget});return Q.every((ct)=>{let ut=$o(ct);if(ut.unsafeBraceExpansion)return!1;return(ut.expandedTargets??[t(ct)]).every((ft)=>bf(ft,lt,{containmentTarget:jv(ft,he),targetIsLiteral:ut.expandedTargets!==void 0||ut.targetIsLiteral,tmpdirWordSplittingProtected:ut.tmpdirWordSplittingProtected}))})}function jv(O,D){if(!D)return O;return O.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>D)}function fs(O){let D=(ee)=>{let he=O[ee];return he?t(he):void 0},B=1;while(D(B)==="-H"||D(B)==="-P")B++;if(D(B)==="--")B++;let Q=[];while(B<O.length){let ee=D(B),he=O[B];if(!ee||!he||ee.startsWith("-")||["!","(",")"].includes(ee))break;Q.push(he),B++}return Q.length>0?Q:null}function Vv(O,D){let B=nr([...O],D);if(B.length===0)return null;let Q=Tt(B[0]??"");if(Q==="busybox"&&B.length>1)B=B.slice(1),Q=Tt(B[0]??"");if(Q==="rm"&&Mn(B))return St("find.exec-rm-recursive-force",Fv);return null}function jo(O,D){let B=D+1;while(B<O.length&&O[B]!==";"&&!(O[B]==="+"&&O[B-1]==="{}"))B++;return{tokens:O.slice(D+1,B),nextIndex:Math.min(B+1,O.length)}}function ms(O,D){let B=D;while(B<O.length){let Q=O[B];if(!Q){B++;continue}if(jn(Q)){B=jo(O,B).nextIndex;continue}let ee=ir(Q);if(ee>0){B+=ee+1;continue}if(Q==="-delete")return!0;B++}return!1}function ir(O){return Bv.get(O)??(/^-newer[A-Za-z]{2}$/.test(O)?1:0)}function jn(O){return O!==void 0&&zv.has(O)}import{resolve as CR}from"node:path";function*Al(O){for(let D of O.nodes)yield*qv(D)}function Kv(O){return Object.freeze([...Al(O)])}function st(O){return Object.freeze(Kv(O).map((D)=>Object.freeze(D.words.map((B)=>B.text))))}function Vo(O){let D=h(O,"posix");if(D.status!=="complete"||D.nodes.length!==1)return null;let B=D.nodes[0];if(B?.kind!=="command")return null;if(B.redirections.length>0||B.nested.length>0)return null;if(B.words.some((Q)=>Q.provenance==="command-substitution"))return null;return B.words.map((Q)=>Q.text)}function*qv(O){if(O.kind==="command"){yield O;for(let D of O.nested)yield*Al(D);return}if(O.kind==="group")yield*Al(O.body)}var Yv=5,Tl="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function en(O){let D=O.indexOf("--");if(D===-1)return{index:-1,before:O,after:[]};return{index:D,before:O.slice(0,D),after:O.slice(D+1)}}function zf(O,D,B){let Q=ps(O,D,B),ee=Zv(Q.entries);if(ee.size===0)return{blockedReason:Q.blockedReason,expanded:!1,tokens:O};let he=O,je=!1;for(let at=0;at<Yv;at++){let{subcommand:lt,rest:ct}=bn(he),ut=lt?.toLowerCase();if(!ut||!ee.has(ut))return{blockedReason:Q.blockedReason,expanded:je,tokens:he};let ft=ee.get(ut),dt=tE(ft);if(dt===null||dt.length===0)return{blockedReason:Tl,expanded:!0,tokens:he};he=["git",...dt,...ct],je=!0}return{blockedReason:Tl,expanded:!0,tokens:he}}function Bf(O,D,B){return ps(O,D,B).entries.some((Q)=>Q.key.toLowerCase()==="core.sshcommand")}function bn(O){if(O.length===0)return{subcommand:null,rest:[]};let D=O[0];if((D?Tt(D).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let Q=1;while(Q<O.length){let ee=O[Q];if(!ee)break;if(ee==="--"){let he=O[Q+1];if(he&&!he.startsWith("-"))return{subcommand:he,rest:O.slice(Q+2)};return{subcommand:null,rest:O.slice(Q+1)}}if(!ee.startsWith("-"))return{subcommand:ee,rest:O.slice(Q+1)};Q+=pn.has(ee)?2:1}return{subcommand:null,rest:[]}}function Zv(O){let D=new Map;for(let B of O){let Q=B.key.toLowerCase();if(!Q.startsWith("alias."))continue;let ee=Q.slice(6);if(ee!=="")D.set(ee,B.value)}return D}function ps(O,D,B){if(O.length===0)return{blockedReason:null,entries:[]};let Q=O[0];if((Q?Tt(Q).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let he=Jv(D,B);return{blockedReason:he.blockedReason,entries:[...he.entries,...Xv(O,D,B)]}}function Xv(O,D,B){let Q=[],ee=1;while(ee<O.length){let he=O[ee];if(!he||he==="--"||!he.startsWith("-"))return Q;if(he==="-c"){let je=Il(O[ee+1]);if(je)Q.push(je);ee+=2;continue}if(he.startsWith("-c")&&he.length>2){let je=Il(he.slice(2));if(je)Q.push(je);ee++;continue}if(he==="--config-env"){let je=Ff(O[ee+1],D,B);if(je)Q.push(je);ee+=2;continue}if(he.startsWith("--config-env=")){let je=Ff(he.slice(13),D,B);if(je)Q.push(je);ee++;continue}if(pn.has(he)){ee+=2;continue}ee++}return Q}function Jv(O,D){let B=Qv(O,D),Q=eE(O,D);return{blockedReason:B===null||Q===null?Tl:null,entries:[...B??[],...Q??[]]}}function Qv(O,D){let B=Un("GIT_CONFIG_PARAMETERS",O,D);if(B===void 0)return[];let Q=[],ee=Vo(B);if(!ee)return null;for(let he of ee){let je=Il(he);if(!je)return null;Q.push(je)}return Q}function eE(O,D){let B=Nd(O,D);if(B.state==="absent")return[];if(B.state==="invalid")return null;let Q=[];for(let ee=0;ee<B.count;ee++){let he=Un(`GIT_CONFIG_KEY_${ee}`,O,D)?.trim(),je=Un(`GIT_CONFIG_VALUE_${ee}`,O,D);if(!he||je===void 0)return null;Q.push({key:he,value:je})}return Q}function Il(O){if(!O)return null;let D=O.indexOf("=");return{key:(D===-1?O:O.slice(0,D)).trim(),value:D===-1?void 0:O.slice(D+1)}}function Ff(O,D,B){let Q=O?.indexOf("=")??-1;if(!O||Q===-1)return null;return{key:O.slice(0,Q).trim(),value:Un(O.slice(Q+1),D,B)}}function tE(O){let D=O?.trimStart();if(!D||D.startsWith("!"))return null;return Vo(D)}var nE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",rE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",oE="git checkout --force discards uncommitted changes. Use 'git stash' first.",iE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",sE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",aE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",lE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",cE="git switch --force discards uncommitted changes. Use 'git stash' first.",uE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",dE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",fE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",mE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",pE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",gE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",hE="git push --force destroys remote history. Use --force-with-lease for safer force push.",yE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",bE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",SE="git branch -D force-deletes without merge check. Use -d for safe delete.",CE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",vE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",EE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",RE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",xE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",_E="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",wE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",PE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),AE=new Set(["--recurse-submodules","--track","-t"]),kl=new Set(["-b","-B","-U"]),Ol=new Set(["-c","-C"]),TE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function It(O,D){let B=O.split("=",1)[0]??O;return B.length>=4&&D.startsWith(B)&&B.startsWith("--")&&B.slice(2).length>=2}var Jr=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Uf(O,D){let{subcommand:B,rest:Q}=bn(O);if(!B)return null;switch(B.toLowerCase()){case"checkout":return sr(IE(Q,D));case"switch":return sr(OE(Q));case"restore":return sr(DE(Q));case"reset":return LE(Q);case"clean":return sr(GE(Q));case"rm":return sr(FE(Q));case"push":return Ar(zE(Q));case"branch":return Ar(UE(Q));case"stash":return Ar(qE(Q));case"worktree":return Ar(YE(Q));case"rebase":return sr(HE(Q));case"merge":return sr(jE(Q));case"tag":return Ar(VE(Q));case"reflog":return Ar(KE(Q));default:return null}}function sr(O){return O?{...O,localDiscard:!0}:null}function Ar(O){return O?{...O,localDiscard:!1}:null}function IE(O,D){let{index:B,before:Q}=en(O),ee=sn(Q,{shortOptsWithValue:kl});if(Q.some((at)=>It(at,"--force"))||ee.has("-f"))return St("git.checkout-force",oE);for(let at of O){if(at==="-b"||at==="-B"||at==="--orphan")return null;if(It(at,"--pathspec-from-file"))return St("git.checkout-pathspec-from-file",sE)}if(B!==-1){if(Q.some((lt)=>!lt.startsWith("-")))return St("git.checkout-ref-path",iE);return St("git.checkout-double-dash",nE)}let he=ME(O);if(he.length>=2)return St("git.checkout-ambiguous",aE);let je=he[0];if(je===void 0||ee.has("-d")||ee.has("-t")||O.some((at)=>It(at,"--detach")||It(at,"--track")))return null;if(kE(je)||D(je))return St("git.checkout-double-dash",rE);return null}function kE(O){return O==="."||O===".."||/^\.\.?[/\\]/.test(O)||/^([/\\]|[A-Za-z]:[/\\])/.test(O)||O.endsWith("/")||O.startsWith(":")||/[*?[]/.test(O)}function OE(O){let{before:D}=en(O);if(D.some((Q)=>It(Q,"--discard-changes")))return St("git.switch-discard-changes",lE);let B=sn(D,{shortOptsWithValue:Ol});if(D.some((Q)=>It(Q,"--force"))||B.has("-f"))return St("git.switch-force",cE);return null}function ME(O){let D=[],B=0;while(B<O.length){let Q=O[B];if(!Q)break;if(Q==="--")break;if(!Q.startsWith("-")){D.push(Q),B++;continue}if(PE.has(Q)){B+=2;continue}if(AE.has(Q)){let ee=O[B+1],he=Q==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];B+=ee&&!ee.startsWith("-")&&he.includes(ee)?2:1;continue}B++}return D}function DE(O){let D=NE(O);if(D.isTerminal||!D.hasPathspec&&!D.hasPatch||!D.hasWorktree)return null;return D.hasExplicitLocation?St("git.restore-worktree",dE):St("git.restore-unstaged",uE)}function NE(O){let D=!1,B=!1,Q=!0,ee=!1,he=(je)=>{if(!ee)Q=!1,ee=!0;if(je!==void 0)Q=je};for(let je=0;je<O.length;je++){let at=O[je];if(at===void 0)break;if(at==="--"){D||=je+1<O.length;break}if(at==="--pathspec-from-file"){D=!0,je++;continue}if(at.startsWith("--pathspec-from-file=")){D=!0;continue}if(at==="-h"||at==="--help"||at==="--version")return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!0};if(at==="--staged"){he();continue}if(at==="--no-staged"){he();continue}if(at==="--worktree"){he(!0);continue}if(at==="--no-worktree"){he(!1);continue}if(at==="--patch"){B=!0;continue}if(at==="--no-patch"){B=!1;continue}if(TE.has(at)){je++;continue}if(at.startsWith("--"))continue;if(at==="-"){D=!0;continue}if(!at.startsWith("-")){D=!0;continue}for(let lt=1;lt<at.length;lt++){let ct=at.charAt(lt);if(ct==="h")return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!0};if(ct==="S"){he();continue}if(ct==="W"){he(!0);continue}if(ct==="p"){B=!0;continue}if(ct==="s"||ct==="U"){if(lt===at.length-1)je++;break}}}return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!1}}function LE(O){let D=null;for(let B of O){if(It(B,"--hard")){D=St("git.reset-hard",fE);break}if(It(B,"--merge")){D=St("git.reset-merge",mE);break}}if(!D)return null;return WE(O)?Ar(D):sr(D)}function WE(O){for(let D of O){if(D==="--")return!1;if(!D.startsWith("-"))return!0}return!1}function GE(O){for(let B of O)if(B==="-n"||It(B,"--dry-run"))return null;let D=sn(O.filter((B)=>B!=="--"));if(O.some((B)=>It(B,"--force"))||D.has("-f"))return St("git.clean-force",pE);return null}function FE(O){let D=!1,B=!1,Q=!1;for(let ee of en(O).before){if(It(ee,"--no-force")){D=!1;continue}if(It(ee,"--force")){D=!0;continue}if(It(ee,"--no-cached")){B=!1;continue}if(It(ee,"--cached")){B=!0;continue}if(It(ee,"--no-dry-run")){Q=!1;continue}if(It(ee,"--dry-run")){Q=!0;continue}let he=sn([ee]);D||=he.has("-f"),Q||=he.has("-n")}return D&&!B&&!Q?St("git.rm-force",gE):null}function zE(O){let{before:D,after:B}=en(O),Q=sn(D);if(D.some((je)=>It(je,"--mirror")))return St("git.push-mirror",bE);if(D.some((je)=>It(je,"--force"))||Q.has("-f")||$f(D,B).some(BE))return St("git.push-force",hE);if(D.some((je)=>It(je,"--delete"))||Q.has("-d")||$f(D,B).some($E))return St("git.push-delete",yE);return null}function $f(O,D){return[...O.filter((B)=>B!==""&&!B.startsWith("-")),...D]}function BE(O){return O.startsWith("+")||O.includes(":+")}function $E(O){return O.length>1&&O.startsWith(":")}function UE(O){let{before:D}=en(O),B=sn(D),Q=B.has("-D")||B.has("-d")||D.some((he)=>It(he,"--delete")),ee=B.has("-D")||B.has("-f")||D.some((he)=>It(he,"--force"));if(Q&&ee)return St("git.branch-force-delete",SE);return null}function HE(O){let{before:D}=en(O);return D.some((B)=>It(B,"--abort"))?St("git.rebase-abort",CE):null}function jE(O){let{before:D}=en(O);return D.some((B)=>It(B,"--abort"))?St("git.merge-abort",vE):null}function VE(O){let{before:D}=en(O);return sn(D).has("-d")||D.some((Q)=>It(Q,"--delete"))?St("git.tag-delete",EE):null}function KE(O){return O[0]==="delete"?St("git.reflog-delete",RE):null}function qE(O){for(let D of O){if(D==="drop")return St("git.stash-drop",xE);if(D==="clear")return St("git.stash-clear",_E)}return null}function YE(O){let{before:D}=en(O);if(!D.includes("remove"))return null;let Q=sn(D);if(D.some((ee)=>It(ee,"--force"))||Q.has("-f"))return St("git.worktree-remove-force",wE);return null}import{dirname as gR,isAbsolute as hR,join as om,resolve as yR}from"node:path";var Dl="TMPDIR",Nl="IFS",jf=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Vf=/^[A-Za-z_][A-Za-z0-9_]*$/,Kf=new Set(["export","typeset","declare","readonly"]),ZE=new Set(["builtin","command","time"]),qf=new Set(["do","then","else"]),XE=new Set(["do","then","case"]),Hf=new Set(["done","fi","esac"]),JE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Yf(O,D){return O.map((B)=>B.provenance==="variable"&&tm(B.text)?Ko(B.text,D.shellAssignments):t(B))}function Ko(O,D){return O.replace(JE,(B,Q,ee)=>D.get(Q??ee??"")??B)}function Zf(O,D){return{env:O,effectiveEnvAssignments:nR(O,D),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Xf(O){return{env:O.env,effectiveEnvAssignments:O.effectiveEnvAssignments?new Map(O.effectiveEnvAssignments):void 0,shellAssignments:new Map(O.shellAssignments),bodyDepth:O.bodyDepth,bodyAssignments:new Set(O.bodyAssignments)}}function Ll(O,D){let B=Qf(O,D),Q=O[0]??"";if(XE.has(Q))D.bodyDepth+=1;if(Q==="elif"||Hf.has(Q))D.bodyDepth=Math.max(0,D.bodyDepth-1);if(Hf.has(Q)&&D.bodyDepth===0)D.bodyAssignments.forEach((at)=>{D.shellAssignments.delete(at)}),D.bodyAssignments.clear();B.assignments.filter((at)=>at.persists).forEach((at)=>{if(D.shellAssignments.set(at.name,at.value),D.bodyDepth>0)D.bodyAssignments.add(at.name);Wl(D,at)});let ee=B.commandIndex;if(ee!==-1&&Kf.has(O[ee]??""))O.filter((at)=>Vf.test(at)&&Ml(at)).forEach((at)=>{rR(D,at)});let he=ee===-1?-1:em(O,ee);if(he===-1||O[he]!=="unset")return;let je=iR(O,he);if(je===null)return;O.slice(je).forEach((at)=>{if(qf.has(Q)){D.shellAssignments.set(at,"");return}oR(D,at)})}function Jf(O,D){let B=Qf(O,D).assignments;if(B.length===0)return D.effectiveEnvAssignments;let Q=new Map(D.effectiveEnvAssignments??[]);return B.forEach((ee)=>{Q.set(ee.name,ee.value)}),Q}function Qf(O,D){let B=qf.has(O[0]??"")?1:0,Q=O.findIndex((at,lt)=>lt>=B&&!tm(at)),ee=Q!==-1&&Kf.has(O[em(O,Q)]??""),he=tR(D);return{assignments:O.flatMap((at,lt)=>{let ct=QE(at,he,D.env);if(!ct)return[];if(Q!==-1&&lt>Q&&!ee&&!ji(ct.name))return[];return he.set(ct.name,ct.value),[{...ct,persists:Q===-1||ee}]}),commandIndex:Q}}function em(O,D){let B=D;while(ZE.has(O[B]??"")){B+=1;while(O[B]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(O[B]??""))return D;B+=1}}return B}function tm(O){return Rn(O)!==null||jf.test(O)}function QE(O,D,B){return Rn(O)??eR(O,D,B)}function eR(O,D,B){let Q=Vi(O,B,D);if(Q)return Q;let ee=O.match(jf)?.[1];if(!ee)return null;let he=O.indexOf("=");return{name:ee,value:`${D.has(ee)?D.get(ee):B.get(ee)??""}${O.slice(he+1)}`}}function Ml(O){return O===Dl||O===Nl||sl(O)}function tR(O){return new Map([...O.effectiveEnvAssignments??[],...O.shellAssignments])}function nR(O,D){let B=[Dl,Nl].map((Q)=>{let ee=O.get(Q);return ee===void 0?null:[Q,ee]}).filter((Q)=>Q!==null);if(B.length===0)return D;return new Map([...B,...D??[]])}function Wl(O,D){let B=new Map(O.effectiveEnvAssignments??[]);B.set(D.name,D.value),O.effectiveEnvAssignments=B}function rR(O,D){Wl(O,{name:D,value:O.shellAssignments.get(D)??O.effectiveEnvAssignments?.get(D)??O.env.get(D)??""})}function oR(O,D){if(!Ml(D)&&!Vf.test(D))return;if(O.shellAssignments.set(D,""),ji(D)&&O.env.has(D)){let Q=new Map(O.env);Q.delete(D),O.env=Q}if(!Ml(D)||D===Dl||D===Nl||mo(D)){Wl(O,{name:D,value:""});return}if(!O.effectiveEnvAssignments?.has(D))return;let B=new Map(O.effectiveEnvAssignments);B.delete(D),O.effectiveEnvAssignments=B.size===0?void 0:B}function iR(O,D){let B=D+1;while(B<O.length){let Q=O[B];if(!Q)return null;if(Q==="--")return B+1;if(Q==="-v"){B++;continue}if(Q.startsWith("-"))return null;return B}return B}import{resolve as sR}from"node:path";function gs(O,D){return il.some((B)=>D?.has(B)||O.has(B))}function Qr(O,D,B){if(!D)return{gitCwd:null,hasExplicitGitContext:!1};let Q=B.realpath(sR(D));if(Q===null||!B.isDirectory(Q))return{gitCwd:null,hasExplicitGitContext:!1};let ee=Q,he=!1,je=1;while(je<O.length){let at=O[je];if(!at)break;if(at==="--")break;if(!at.startsWith("-"))break;if(at==="-C"){let lt=O[je+1];if(!lt)return{gitCwd:null,hasExplicitGitContext:he};let ct=nm(ee,lt,B);if(!ct)return{gitCwd:null,hasExplicitGitContext:he};ee=ct,je+=2;continue}if(at.startsWith("-C")&&at.length>2){let lt=nm(ee,at.slice(2),B);if(!lt)return{gitCwd:null,hasExplicitGitContext:he};ee=lt,je++;continue}if(at==="--git-dir"||at==="--work-tree"){he=!0,je+=2;continue}if(at.startsWith("--git-dir=")||at.startsWith("--work-tree=")){he=!0,je++;continue}je+=pn.has(at)?2:1}return{gitCwd:ee,hasExplicitGitContext:he}}function nm(O,D,B){try{let Q=tr(O,D,B);return B.isDirectory(Q)?Q:null}catch{return null}}function rm(O,D,B){if(!D.localDiscard||!B.worktreeMode||gs(B.environment.env,B.envAssignments))return null;let Q=Qr(O,B.cwd,B.environment.paths);if(!Q.gitCwd||Q.hasExplicitGitContext)return null;let ee=B.environment.worktreeFacts(Q.gitCwd);if(!ee)return null;if(Gl(O,B,ee))return null;return{kind:"worktree",originalReason:D.reason,gitCwd:Q.gitCwd}}function Gl(O,D,B){let{subcommand:Q,rest:ee}=bn(O),he=Q?.toLowerCase();if(D.dynamicArguments||aR(ee)||fR(O,D.environment.env,D.envAssignments,B)||uR(ee)||lR(he,ee))return!0;return he==="clean"&&dR(ee)>1}function aR(O){return O.some((D)=>/[$*?[]/.test(D))}function lR(O,D){if(O==="checkout"){let{before:B}=en(D),Q=sn(B,{shortOptsWithValue:kl}),ee=B.some((je)=>It(je,"--force"))||Q.has("-f"),he=Q.has("-B")||B.some((je)=>je==="-B"||je.startsWith("-B"));return ee&&he}if(O==="switch"){let{before:B}=en(D),Q=sn(B,{shortOptsWithValue:Ol}),ee=B.some((je)=>It(je,"--force"))||B.some((je)=>It(je,"--discard-changes"))||Q.has("-f"),he=B.some((je)=>je==="-C"||je.startsWith("-C")||cR(je))||Q.has("-C");return ee&&he}return!1}function cR(O){let D=O.split("=",1)[0]??O;return D==="--force-create"||D.length>=9&&"--force-create".startsWith(D)}function uR(O){return O.some((D)=>D.startsWith("--recurse-sub"))}function dR(O){let D=0;for(let B of O){if(B==="--force"){D++;continue}if(B.startsWith("-")&&!B.startsWith("--")){for(let Q of B.slice(1))if(Q==="f")D++}}return D}function fR(O,D,B,Q){if(Un("GIT_CONFIG_PARAMETERS",D,B)!==void 0)return!0;let ee=ps(O,D,B);if(ee.blockedReason!==null)return!0;let he=ee.entries.map((at)=>({key:at.key.toLowerCase(),value:at.value}));if(he.some((at)=>pR(at.key)))return!0;let je=he.filter((at)=>at.key==="submodule.recurse").at(-1);if(je)return je.value===void 0||mR(je.value);if(Wd(B))return!0;return Q.recursiveSubmodules}function mR(O){let D=O.toLowerCase();return D!=="false"&&D!=="no"&&D!=="off"&&D!=="0"}function pR(O){return O==="include.path"||O.startsWith("includeif.")&&O.endsWith(".path")}function im(O,D,B){let Q=O.map(t),ee=B.environment.paths,he=Qr(Q,B.cwd,ee),je=B.originalCwd?ee.realpath(yR(B.originalCwd)):null;if(D.id.startsWith("git.push-")||je===null||he.gitCwd===null||he.hasExplicitGitContext||gs(B.environment.env,B.envAssignments))return null;let at=D.id==="git.worktree-remove-force"?SR(O,B.shellAssignments,ee):sm(he.gitCwd,ee);if(at===null||D.id!=="git.worktree-remove-force"&&!bR(at,Q,D,B)||!Zr(at,B.environment)||os(at,B.environment)||is(je,at)||is(at,je))return null;return{kind:"temp-root",originalReason:D.reason,gitCwd:he.gitCwd}}function bR(O,D,B,Q){let ee=Q.environment.paths,he=om(O,".git");if(ee.entryKind(he)!=="present")return!1;if(ee.isDirectory(he))return!0;let je=B.localDiscard?Q.environment.worktreeFacts(O):null;return je!==null&&!Gl(D,Q,je)}function SR(O,D,B){let Q=bn(O.map(t)).rest,{before:ee,after:he}=en(Q.slice(Q.indexOf("remove")+1)),je=[...ee.filter((ut)=>!ut.startsWith("-")),...he],at=je.length===1?je[0]??"":"",lt=O.find((ut)=>ut.text===at),ct=lt?.provenance==="variable"&&lt.parts.every((ut)=>ut.provenance!=="literal"||!/[$`]/.test(ut.raw))?Ko(at,D??new Map):at;if(!hR(ct)||/[\s$`*?[]/.test(ct)||B.entryKind(ct)!=="present"||!B.isDirectory(ct))return null;return B.realpath(ct)}function sm(O,D){if(D.entryKind(om(O,".git"))!=="missing")return O;let B=gR(O);return B===O?null:sm(B,D)}var vR="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",ER=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function hs(O,D){return am(O,D)}function am(O,D,B){let Q=O.map(t),ee=zf(Q,D.environment.env,D.envAssignments),he=ee.blockedReason?wt(St("git.alias-config",ee.blockedReason),D.policy):null;if(he)return he;let je=ee.tokens;if((Ld(D.envAssignments)||Bf(Q,D.environment.env,D.envAssignments))&&RR(je))return St("git.ssh-env",vR);let at=Uf(je,(ct)=>{let ut=Qr(Q,D.cwd,D.environment.paths).gitCwd;return ut!==null&&D.environment.paths.entryKind(CR(ut,ct))!=="missing"});if(!at)return null;if(ee.expanded||ee.blockedReason)return at;let lt=rm(Q,at,D)??im(O,at,D);if(!lt)return at;return B?.(lt),null}function lm(O,D){let B=null;return{match:am(O,D,(ee)=>{B=ee}),relaxation:B}}function RR(O){let{subcommand:D,rest:B}=bn(O),Q=D?.toLowerCase();if(!Q)return!1;if(ER.has(Q))return!0;if(Q==="archive")return en(B).before.some((ee)=>It(ee,"--remote"));return Q==="remote"&&xR(B)}function xR(O){return O.find((D)=>!_R(D))?.toLowerCase()==="update"}function _R(O){return O==="-v"||It(O,"--verbose")||It(O,"--no-verbose")}import{isAbsolute as sx}from"node:path";function cm(O,D,B,Q){let ee=O.slice(0,D),he=O.slice(D+B);return Q.startsWith(ee)&&Q.endsWith(he)?Q.slice(ee.length,Q.length-he.length):null}function ys(O,D,B){let Q=(he)=>`${he.tokenIndex}\x00${he.kind}\x00${he.value}`,ee=new Set(O.map(Q));return Array.from(D).some((he)=>B(he).some((je)=>!ee.has(Q(je))))}var um="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",wR="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",PR="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",fm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",AR="rm -rf in home directory is dangerous. Change to a project directory first.",dm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:fm},git_metadata_target:{id:"rm.git-metadata",reason:x},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:PR},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:AR},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:um},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:wR},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:um}};function bs(O,D){let B=_r({...D,allowPaths:D.policy?.destructiveCommandAllowPaths,posixShell:!0}),Q=O.map(t),ee=Mn(Q),he=Wf(Q),je=IR(O);for(let at of je){let lt=$o(at.word);if(ee&&lt.unsafeBraceExpansion){let ct=wt(Bo({kind:"outside_anchored_cwd"},B,D.policy,dm),D.policy);if(ct)return ct;continue}for(let ct of lt.expandedTargets??[at.text]){let ut=mn(ct),ft={targetIsLiteral:lt.expandedTargets!==void 0||lt.targetIsLiteral,tmpdirWordSplittingProtected:lt.tmpdirWordSplittingProtected};if(!he&&B.resolvedCwd&&Er(ut,B.resolvedCwd,B.protectedGitMetadata,he,B.environment,B.budget))return St("rm.git-metadata",x);if(he&&!ee){let dt=kn(ut,B,ft);if(dt.kind==="root_or_home_target")return St("rm.recursive-force-root-or-home",fm);if(dt.kind==="git_metadata_target")return St("rm.git-metadata",x);continue}if(!ee)continue;for(let dt of TR(ut,B,ft)){let mt=Bo(dt,B,D.policy,dm),pt=wt(mt,D.policy);if(pt)return pt}}}return null}function TR(O,D,B){let Q=kn(O,D,B);if(Q.kind==="cwd_self_target")return[Q,kn(O,D,{...B,skipCwdSelf:!0})];if(Q.kind!=="home_cwd_target")return[Q];let ee=kn(O,D,{...B,skipHomeCwd:!0});if(ee.kind!=="cwd_self_target")return[Q,ee];return[Q,ee,kn(O,D,{...B,skipHomeCwd:!0,skipCwdSelf:!0})]}function IR(O){let D=[],B=!1;for(let Q of O.slice(1)){let ee=t(Q);if(!ee)continue;if(ee==="--"){B=!0;continue}if(B){D.push({text:ee,word:Q});continue}if(!ee.startsWith("-"))D.push({text:ee,word:Q})}return D}var ar={kind:"none"},Tr={kind:"dynamic"},kR=new Set(["<","<<","<<-","<<<","<&","<>"]),pm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,OR=/^(?:[0-9]+|[@*])$/,MR=er.maxWords,DR=er.maxInputLength;function gm(O){if(!O||Tt(kt(O.words[0]?.text??""))!=="printf")return;if(O.words.some((ee)=>ee.provenance!=="literal"))return;let D=O.words.slice(O.words[1]?.text==="--"?2:1),B=D[0]?.text;if(B===void 0)return"";let Q=D.slice(1).map((ee)=>ee.text);if(B==="%s")return Q.join("");if(B==="%s\\n"||B===`%s
-`)return`${Q.join(`
-`)}
-`;if(B.includes("%")||/\\(?![\\nrt])/.test(B))return;return B.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Ss(O){let D=qo(O[1])==="--"?2:1;if(O.length<=D)return ar;let B=O.slice(D);if(!B.every(vs))return Tr;return{kind:"literal",source:B.map(t).join(" ")}}function hm(O){let D=qo(O[1])==="--"?2:1,B=O[D],Q=qo(B);if(B===void 0||O.length<=D+1||Q==="-"||Q===""||Q==="-l"||Q==="-p")return ar;if(!vs(B))return Tr;return{kind:"literal",source:Q}}function Cs(O,D){let B=LR(O);if(B===-1)return ar;let Q=WR(D);if(!Q)return ar;let ee=[],he=Q.command?.length??0;for(let je of Q.references){let at=FR(je,O,B,Q.ifs);if(!at)return Tr;if(he+=at.reduce((lt,ct)=>lt+ct.length+3,0),ee.length+at.length>MR||he>DR)return Tr;ee.push(...at)}if(Q.command==="eval")return{kind:"literal",source:ee.join(" ")};if(ee.length===0||/\s/.test(ee[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[Q.command,Q.command&&Q.optionTerminator?"--":null,...ee.map(BR)].filter((je)=>je!==null).join(" ")}}function ym(O,D,B,Q){if(!gn(O.map(t)).readsStdinAsCommands)return ar;let ee=D.filter((he)=>(he.fd===void 0||he.fd===0)&&kR.has(he.operator)).at(-1);if(ee){if(ee.operator==="<<"||ee.operator==="<<-")return ar;if(ee.operator!=="<<<"||ee.target?.provenance!=="literal")return Tr;return{kind:"literal",source:ee.target.text}}if(!B)return ar;return Q===void 0?Tr:{kind:"literal",source:Q}}function Vn(O){let D=gn(O.map(t)).scriptIndex;if(D===null)return ar;let B=O[D],Q=qo(B);return Fi(B,Q)?{kind:"literal",source:Q}:Tr}var NR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function $l(O){if(O.words.length!==2||O.redirections.length!==0||O.nested.length!==1)return!1;let D=O.words[0],B=O.words[1];if(!D||D.provenance!=="literal"||D.quoted||D.raw!==D.text||!B)return!1;if(!(D.text==="eval"&&B.quoted&&B.parts.length===3&&B.parts[0]?.raw==='"'&&B.parts[1]?.provenance==="command-substitution"&&B.parts[1].raw.startsWith("$(")&&B.parts[2]?.raw==='"'||(D.text==="source"||D.text===".")&&!B.quoted&&B.parts.length===1&&B.parts[0]?.provenance==="command-substitution"&&B.parts[0].raw.startsWith("<(")))return!1;let ee=O.nested[0];if(ee?.status!=="complete"||ee.nodes.length!==1)return!1;let he=ee.nodes[0];if(he?.kind!=="command"||he.redirections.length!==0||he.nested.length!==0||he.words.some((lt)=>lt.provenance!=="literal"||lt.parts.some((ct)=>ct.provenance!=="literal")))return!1;let je=he.words[0]?.text;if(je===void 0||Rn(je)!==null)return!1;let at=Tt(kt(je));return!NR.has(at)&&!Kt.has(at)&&!wr(at)}function LR(O){return gn(O.map(t)).commandIndex??-1}function WR(O){let D=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(O.trim()),B=D?.[4]??O.trim(),Q=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(B),ee=(Q?.[3]??B).split(/\s+/).map(GR);if(ee.length===0||ee.some((he)=>he===null))return null;return{command:Q?.[1]??null,optionTerminator:Q?.[2]!==void 0,references:ee.filter((he)=>!!he),ifs:D?D[1]??D[2]??D[3]??"":` 	
-`}}function GR(O){let D=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(O),B=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(O),Q=D??B;if(!Q)return null;let ee=Q[1]??Q[2];return{parameter:ee==="@"||ee==="*"?ee:Number(ee),quoted:D!==null}}function FR(O,D,B,Q){let ee=D.slice(B+2);if(O.parameter==="@")return O.quoted?Fl(ee):zR(ee,Q);if(O.parameter==="*"){let at=Fl(ee);if(!at)return;let lt=at.join(Q[0]??"");return O.quoted?[lt]:zl(lt,Q)}let he=D[B+1+O.parameter];if(he&&!vs(he))return;let je=qo(he);return O.quoted?[je]:zl(je,Q)}function Fl(O){return O.every(vs)?O.map(t):void 0}function zR(O,D){let B=Fl(O);if(!B)return;let Q=B.map((ee)=>zl(ee,D));return Q.some((ee)=>ee===void 0)?void 0:Q.flatMap((ee)=>ee??[])}function zl(O,D){if(["*","?","[","]"].some((B)=>O.includes(B)))return;if(D==="")return O===""?[]:[O];if(D===` 	
-`)return O.trim().split(/\s+/).filter(Boolean);if(D.length!==1)return;return D===" "||D==="\t"||D===`
-`?O.trim().split(/\s+/).filter(Boolean):O.split(D).filter(Boolean)}function vs(O){if(!O)return!0;return O.provenance==="unknown"?!/[$`]/.test(t(O)):O.provenance==="literal"}function qo(O){return O?t(O):""}function BR(O){return`'${O.replaceAll("'",`'"'"'`)}'`}function Ul(O,D){return Bl(h(O,"posix"),D)}function Zo(O){return Ul(O,new Set(Array.from(O.matchAll(pm)).flatMap((D)=>{let B=D[1]??D[2];return B===void 0?[]:[B]})))}function Bl(O,D){if(O.status==="invalid"||O.status==="limited")return!1;let B=new Set(D);for(let Q of O.nodes){if(Q.kind==="group"){if(Bl(Q.body,B))return!0;continue}if(Q.kind!=="command")continue;if(Q.nested.some((ee)=>Bl(ee,B))||bm(Q.words,B))return!0;VR(Q,B)}return!1}function bm(O,D){let B=O.findIndex((je)=>Rn(je.text)===null);if(B===-1)return!1;let Q=O[B];if(!Q)return!1;if(Yo(Q,D))return!0;let ee=kt(Q.text);if(ee==="source"||ee==="."){let je=O[B+1]?.text==="--"?B+2:B+1;return mm(O[je],D)}if(Kt.has(ee)){let je=O.slice(B),at=gn(je.map((ct)=>ct.text)),lt=at.commandIndex??at.scriptIndex;return!at.syntaxCheck&&lt!==null&&mm(je[lt],D)}let he=$R(O,B,D);if(he===null)return!1;if(he===-1)return!0;return bm(O.slice(he),D)}function $R(O,D,B){let Q=kt(O[D]?.text??"");if(Q==="command")return UR(O,D+1);if(Q==="exec")return HR(O,D+1);if(Q==="env")return jR(O,D+1,B);return null}function UR(O,D){for(let B=D;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return O[B+1]?B+1:null;if(/^-[p]*[vV][pvV]*$/.test(Q))return null;if(/^-p+$/.test(Q))continue;return B}return null}function HR(O,D){for(let B=D;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return O[B+1]?B+1:null;if(Q==="-a"){B++;continue}if(/^-a.+/.test(Q)||/^-[cl]+$/.test(Q))continue;return B}return null}function jR(O,D,B){for(let Q=D;Q<O.length;Q++){let ee=O[Q],he=ee?.text??"";if(he==="--")return O[Q+1]?Q+1:null;if(he==="-S"||he==="--split-string")return Yo(O[Q+1],B)?-1:Q+2;if(he.startsWith("-S")||he.startsWith("--split-string="))return Yo(ee,B)?-1:Q+1;if(he==="-u"||he==="--unset"||he==="-C"||he==="--chdir"||he==="-P"){Q++;continue}if(he==="-i"||he==="-0"||he==="--null"||he.startsWith("-u=")||he.startsWith("--unset=")||he.startsWith("-C")||he.startsWith("--chdir=")||he.startsWith("-P"))continue;if(he.startsWith("-"))continue;if(Rn(he))continue;return Q}return null}function VR(O,D){if(!O.words.every((B)=>Rn(B.text)!==null))return;for(let B of O.words){let Q=Rn(B.text);if(!Q)continue;if(Yo(B,D))D.add(Q.name)}}function Yo(O,D){if(!O)return!1;return O.parts.filter((B)=>B.provenance==="variable").some((B)=>Array.from(B.raw.matchAll(pm)).some((Q)=>{let ee=Q[1]??Q[2];return ee!==void 0&&(OR.test(ee)||D.has(ee))}))}function mm(O,D){return!!O&&(O.parts.some((B)=>B.provenance!=="literal"&&B.provenance!=="variable")||Yo(O,D))}var KR=["--init-file","--rcfile"],qR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Kn(O){for(let D=1;D<O.length;D++){let B=O[D];if(!B)continue;if(B==="-c")return Sm(O,D,!0);if(B.startsWith("-")&&B.includes("c")&&!B.startsWith("--")){let Q=Sm(O,D,!1);if(Q!==null)return Q}}return null}function qn(O){let D=Tt(O[0]??"").toLowerCase();if(D==="zsh"||D==="ksh")return gn(O).syntaxCheck;let B=!1;for(let Q of O.slice(1)){if(Q==="--")return B;if(Q.startsWith("+")&&!Q.startsWith("++")){if(Q.slice(1).includes("n"))B=!1;continue}if(!Q.startsWith("-")||Q.startsWith("--"))return B;let ee=Q.slice(1);if(ee.includes("n"))B=!0;if(ee.includes("c"))return B}return B}function Sm(O,D,B){if(O[D+1]==="--")return O[D+2]||null;let Q=O[D+1];if(!Q||!B&&Q.startsWith("-"))return null;return Q}function Cm(O){let D=Tt(O[0]??"").toLowerCase(),B=YR(O,D),Q=qR.get(D)??null,ee=B.argvSource?.kind!=="absent";return{argvSource:D==="bash"?B.argvSource:null,argvSourceApplies:D==="bash"&&B.interactive&&B.argvSource?.kind==="literal",envName:Q,envSourceApplies:ee&&(Q==="BASH_ENV"?!B.interactive:Q==="ENV"&&B.interactive)}}function YR(O,D){let B=gn(O),Q=B.commandIndex??B.scriptIndex??O.length,ee=[],he=!1,je=!0;for(let at=1;at<Q;at++){let lt=O[at];if(lt===void 0||lt==="--"||lt==="-"||lt[0]!=="-"&&lt[0]!=="+")break;if(lt.startsWith("--")){if(D==="bash"&&je?KR.find((dt)=>lt===dt):void 0){let dt=O[at+1];ee.push(dt===void 0?{kind:"absent"}:{kind:"literal",value:dt}),at++;continue}let ft=lt.split("=",1)[0]??lt;if(D==="bash"&&pa.has(ft)&&!lt.includes("="))at++;continue}if(D==="bash")je=!1;let ct=ga(D,lt,O[at+1],"startup");if(ct.interactive)he=lt[0]==="-";at+=ct.followingValues}return{argvSource:ee.at(-1)??null,interactive:he}}var Hl="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",jl="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",ZR="__CC_SAFETY_NET_XARGS_INPUT__",Es="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Rs="rm",XR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,JR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,QR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,ex=/^(?:[0-9]+|[@*])$/;function Rm(O,D){let B=O.map(t),{childStart:Q,replacementToken:ee}=Ir(B),he=B.slice(Q),je=St("xargs.shell-dynamic",jl);if(nx(he,ee,D)&&wt(je,D.policy))return wt(je,D.policy);for(let at of On(he,D)){let lt=at.tokens,ct=ee!==null&&lt[0]!==he[0]&&(lt[0]?.includes(ee)??!1)?wt(je,D.policy):null;if(ct)return ct;let ut=Am(lt,ee,at.wrapperEnvAssignments),ft=at.head==="rm"&&ee!==null&&wm(lt,ee),dt=D.analyzeChild(lt,{...Pr(at,D),dynamicInput:ut,dynamicSourceInput:ft||_m(lt,at.head,ee,at.wrapperEnvAssignments,ut,D.environment),dynamicRmInput:ft,shellDynamicMatch:je,dynamicSourceMatch:je,rmDynamicMatch:St("xargs.rm-recursive-force-dynamic",Hl)});if(dt)return dt;let mt=tx(lt,ee,D.policy?.rules??[],wt(je,D.policy));if(mt)return mt;if(at.head==="git"){let ht=ee===null?[...lt,ZR]:lt,gt=ee!==null&&(lt.some((vt)=>vt.includes(ee))||Array.from(at.envAssignments.values()).some((vt)=>vt.includes(ee))),yt=D.analyzeChild(ht,{...Pr(at,D),worktreeMode:ee===null||gt?!1:D.worktreeMode});if(yt)return yt}let pt=_(lt,D.policy?.rules??[]);if(pt)return pt}return null}function tx(O,D,B,Q){if(B.length===0)return null;if(D===null){for(let he of B){let je=_([...O,...he.subcommand?[he.subcommand]:[],...he.block_args],B);if(je)return je}return null}let ee=kt(O[0]??"");if(!B.some((he)=>kt(he.command)===ee))return null;return O.slice(1).some((he)=>he.includes(D))?Q:null}function xm(O,D,B){let Q=O.indexOf(D);if(Q===-1||O.indexOf(D,Q+D.length)!==-1)return[];let ee=cm(O,Q,D.length,B);return ee===null?[]:[ee]}function _m(O,D,B,Q,ee,he){if(Kt.has(D)){if(qn(O))return!1;if(B!==null&&rx(O,B))return!0;let je=Kn(O);if(!je){let at=Vn($t(O));if(at.kind==="literal")return B!==null&&at.source.includes(B);return at.kind==="none"&&ee}if(B!==null&&je.includes(B))return!0;if($n(je))return!0;return ox(je,B,Q)}if(Pn(D))return vm(O,B,Hi,Od(D));if(En.has(D))return vm(O,B,El,Of);if(D==="eval"){let je=Ss($t(O));if(je.kind==="dynamic")return!0;if(B!==null)return je.kind==="literal"&&je.source.includes(B);return ee}if(D==="find")return ix(O,B,he);if(D==="git"){let je=bn(O);return B===null?je.subcommand===null:(je.subcommand?.includes(B)??!1)||je.subcommand!==null&&Jr.has(je.subcommand.toLowerCase())&&Pm(je.rest,B).some((at)=>at.includes(B))}return!1}function vm(O,D,B,Q){let ee=B(O);if(D===null)return ee.optionsOpen||B([...O,Es]).sources.some((at)=>at.value===Es);if(ee.sources.some((at)=>at.value.includes(D)))return!0;let he=Q.flatMap((at)=>[at.selector,...at.valueForm==="attached-only"||at.valueForm==="attached-or-separate"?[`${at.selector}${Es}`]:[],...at.valueForm==="equals-or-separate"?[`${at.selector}=${Es}`]:[]]),je=new Set(he.flatMap((at)=>O.flatMap((lt)=>xm(lt,D,at))));return ys(ee.sources,je,(at)=>B(O.map((lt)=>lt.replaceAll(D,at))).sources)}function nx(O,D,B){if(O.length===0||(O[0]??"").toLowerCase()==="command")return!1;let Q=new Set(Array.from(On(O,B),(he)=>he.head)),ee=D===null?[...O,Rs]:O.map((he,je)=>je===0?he:he.replaceAll(D,Rs));return Array.from(On(ee,B)).some((he)=>he.head===Rs&&!Q.has(Rs))}function wm(O,D){return Pm(O.slice(1),D).some((B)=>B.includes(D)&&(B.startsWith("-")||B.startsWith(D)))}function Pm(O,D){let B=O.findIndex((Q)=>Q==="--"&&!Q.includes(D));return B===-1?O:O.slice(0,B)}function Am(O,D,B){if(D===null)return!0;return O.some((Q)=>Q.includes(D))||Array.from(B.values()).some((Q)=>Q.includes(D))}function rx(O,D){let B=gn(O);if(B.commandIndex!==null&&(O[B.commandIndex]??"").includes(D)||B.scriptIndex!==null&&(O[B.scriptIndex]??"").includes(D))return!0;return["-c","-nc","-cn",`--${D}`,D].some((ee)=>O.some((he,je)=>{if(je===0||!he.includes(D))return!1;return xm(he,D,ee).some((lt)=>{let ct=O.map((ft,dt)=>dt===je?ft.replaceAll(D,lt):ft),ut=gn(ct);if(ut.commandIndex===null&&ut.scriptIndex===null)return!1;if(B.commandIndex===null&&ut.commandIndex!==null)return!0;if(B.scriptIndex===null&&ut.scriptIndex!==null)return!0;if(ut.commandIndex!==null&&(ct[ut.commandIndex]??"").includes(lt))return!0;return ut.scriptIndex!==null&&(ct[ut.scriptIndex]??"").includes(lt)})}))}function ox(O,D,B){let Q=new Set(D===null?[]:Array.from(B).filter(([,ee])=>ee.includes(D)).map(([ee])=>ee));for(let ee of O.matchAll(XR))if(Em(ee,Q))return!0;for(let ee of O.matchAll(JR))for(let he of(ee[1]??"").matchAll(QR))if(Em(he,Q))return!0;return Ul(O,Q)}function Em(O,D){let B=O[1]??O[2];return B!==void 0&&(ex.test(B)||D.has(B))}function ix(O,D,B){if(D===null)return!0;let Q=!1,ee=0;for(let he=1;he<O.length;he++){let je=O[he]??"";if(!Q&&!je.startsWith("-")&&je!=="!"&&je!=="("){if(je.indexOf(D)===0)return!0;continue}if(Q=!0,ee>0){ee--;continue}if(jn(je)){let lt=jo(O,he);he=lt.nextIndex-1;for(let ct of On(lt.tokens,{environment:B,cwd:void 0})){let ut=Am(ct.tokens,D,ct.wrapperEnvAssignments);if(ct.head==="rm"&&wm(ct.tokens,D)||_m(ct.tokens,ct.head,D,ct.wrapperEnvAssignments,ut,B))return!0}continue}let at=ir(je);if(at>0){if(ee=at,je.includes(D))return!0;continue}if(je.includes(D))return!0}return!1}function Ir(O){let D=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),B=null,Q=1;while(Q<O.length){let ee=O[Q];if(!ee)break;if(ee==="--")return{childStart:Q+1,replacementToken:B};if(!ee.startsWith("-"))return{childStart:Q,replacementToken:B};if(ee==="-I"){B=O[Q+1]??"{}",Q+=2;continue}if(ee.startsWith("-I")&&ee.length>2){B=ee.slice(2),Q++;continue}if(ee==="--replace"){B="{}",Q++;continue}if(ee.startsWith("--replace=")){let he=ee.slice(10);B=he===""?"{}":he,Q++;continue}if(ee==="-J"){B=O[Q+1]??"{}",Q+=2;continue}Q+=D.has(ee)?2:1}return{childStart:O.length,replacementToken:B}}var Xo="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Jo="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",ax="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",lx="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",_s=/\{[^{}\s]*\}/g,Tm=/\{\}|\{-?\d+\}/g,cx=["e","f","source","file","-e","-f","--source","--file"],ux=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],dx=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),fx=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Im=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),mx=new Set(["--workdir","--wd"]),km="__CC_SAFETY_NET_PARALLEL_SOURCE__";function xn(O,D){for(let B of O){let Q=D(B);if(Q)return Q}return null}function Lm(O){return xn([...O],(D)=>$n(D))}function Wm(O,D){let B=O.map(t);if((D.envAssignments?.has("PARALLEL")?D.envAssignments.get("PARALLEL"):D.environment.env.get("PARALLEL"))?.trim()){let pt=eo(D);if(pt)return pt}if(B.length===2&&(B[1]==="--version"||B[1]==="--help"))return null;let ee=Vm(B),{template:he,jobs:je,runsRemotely:at,readsCommandsFromInput:lt,unsupported:ct,workdir:ut,dryRun:ft}=ee;if(ct){let pt=eo(D);if(pt)return pt;let ht=Lm(D.envAssignments?.values()??[]);if(ht)return ht}if(lt){let pt=Sx(D);if(pt)return pt}if(ut!==void 0&&at){let pt=eo(D);if(pt)return pt}let dt=Cx(ut,D.cwd,D.environment.paths);if(dt===null){let pt=eo(D);if(pt)return pt}let mt=at?{...D,cwd:void 0,originalCwd:void 0}:dt===null||dt===void 0||dt===D.cwd?D:{...D,cwd:dt};if(ft){if([...On(he,mt)].flatMap((ht)=>[...ht.envAssignments.values()]).some(ql)){let ht=eo(D);if(ht)return ht}return null}if(he.length===0){let pt=je.map((gt)=>gt[0]??"");D.budget.charge("derivedTokens",pt.length);let ht=Bm(mt.envAssignments,mt.cwd,at);return xn(pt,(gt)=>D.analyzeNested(gt,ht))}return xn(On(he,mt),(pt)=>px(pt,ee,D,mt))}function px(O,D,B,Q){let{jobs:ee,templateHasPlaceholder:he,runsRemotely:je,usesStdin:at}=D,lt=O.tokens,ct=[...O.envAssignments.values()];if(ct.some(Hm)){let gt=eo(B);if(gt)return gt}let ut=Lm(ct);if(ut)return ut;let ft=ct.some(Nt),dt=he||ft,mt=at&&dt,pt=Bm(O.envAssignments,O.wrapperCwd,je||mt);if(Kt.has(O.head)){let gt=()=>{if(!he||ee.length===0)return null;return xn(ee,(Et)=>B.analyzeChild(xs(lt,Et,B.budget),Pr(O,Q)))};if(qn(lt))return gt();let yt=Kn(lt);if(yt){if(jm(yt)){let Rt=lr(B);if(Rt)return Rt;if(ee.length===0)return null;return xn(ee,(_t)=>B.analyzeNested(Dm(yt,_t,B.budget),pt))}if(Nt(yt)){if(ee.length>0)return xn(ee,(Ut)=>B.analyzeNested(Dm(yt,Ut,B.budget),pt));let Rt=Vo(yt);if(Rt?.[0]&&kt(Rt[0])==="rm"&&Mn(Rt)){let Ut=Mm(B);if(Ut)return Ut}let _t=Rt?B.analyzeChild(Rt,{...Pr(O,Q),dynamicInput:at,shellDynamicMatch:St("parallel.shell-dynamic",Jo),rmDynamicMatch:St("parallel.rm-recursive-force-dynamic",Xo)}):null;if(_t)return _t;return B.analyzeNested(yt,pt)}let Et=!ft&&(!he||ee.length>0)?(ee.length>0?ee:[void 0]).map((Rt)=>Cs($t(Rt===void 0?lt:he?lt.map((_t)=>$m(_t,Rt)):[...lt,...Rt]),yt)):[];if(Et.some((Rt)=>Rt.kind==="dynamic")){let Rt=lr(B);if(Rt)return Rt}let Ct=Et.flatMap((Rt)=>Rt.kind==="literal"?[Rt.source]:[]);if(Ct.length>0)return B.budget.charge("derivedTokens",Ct.length),xn(Ct,(Rt)=>B.analyzeNested(Rt,pt));if(Zo(yt)){let Rt=lr(B);if(Rt)return Rt}let Pt=B.analyzeNested(yt,pt);if(Pt)return Pt;if(dt)return lr(B);return null}let vt=Vn($t(lt));if(vt.kind==="dynamic"||vt.kind==="literal"&&Nt(vt.source))return lr(B)??gt();if(vt.kind==="literal")return gt();if(ee.length>0){let Et=lr(B);if(Et)return Et;let Ct=gt();if(Ct)return Ct;if(he)return null;let Pt=ee.flatMap((Rt)=>Rt[0]===void 0?[]:[Rt[0]]);return B.budget.charge("derivedTokens",Pt.length),xn(Pt,(Rt)=>B.analyzeNested(Rt,pt))}if(dt||at)return lr(B)??gt();return null}if(O.head==="rm"&&Mn(lt)){if(he&&ee.length>0)return xn(ee,(yt)=>Vl(xs(lt,yt,B.budget,Tm),O.cwd,Q));if(ee.length>0)return xn(ee,(yt)=>Vl(Nm(lt,yt,B.budget),O.cwd,Q));let gt=Vl(lt.flatMap((yt,vt)=>{if(vt===0||!Nt(yt))return[yt];return yt.startsWith("-")?[yt.replace(Tm,"")]:[]}),O.cwd,Q);if(gt)return gt;return Mm(B)}let ht=ee.length>0?ee:[void 0];return xn(ht,(gt)=>{let yt=gt===void 0?lt:he?xs(lt,gt,B.budget):Nm(lt,gt,B.budget),vt=St("parallel.shell-dynamic",Jo),Et=at&&O.head==="find"?bx(yt,Q):null,Ct=Fm(yt,at,B)??Et?.customResult??null,Pt=kt(O.head),Rt=at&&(Pt==="rm"&&Kl(yt)||Pt==="xargs"&&zm(yt)||Et?.rmOptions===!0),_t=at&&(Rt||Et?.executedSource===!0||Et===null&&Gm(yt,Pt)),Ut=B.analyzeChild(yt,{...Pr(O,Q),worktreeMode:je||at||dt?!1:B.worktreeMode,dynamicInput:at||dt,dynamicRmInput:Rt,dynamicSourceInput:Ct!==null||_t,shellDynamicMatch:vt,dynamicSourceMatch:vt,rmDynamicMatch:St("parallel.rm-recursive-force-dynamic",Xo)});if(_t){let jt=wt(vt,B.policy);if(jt)return jt}return Ut??Ct??_(yt,B.policy?.rules??[])})}function Gm(O,D){if(Nt(O[0]??""))return!0;if(D==="eval"||D==="source"||D===".")return!0;if(D==="parallel"||D==="xargs")return!0;if(Kt.has(D))return yx(O);if(D==="git")return gx(O);if(D==="find")return!0;if(En.has(D))return Om(O,cx,Ho);if(Pn(D))return Om(O,ux,Ui);return!1}function Kl(O){let D=O.indexOf("--"),B=O.slice(1,D===-1?void 0:D);if(!O.some(Nt))return D===-1;return B.some((ee)=>Nt(ee)&&(ee.startsWith("-")||jm(ee)))}function gx(O){if(hx(O))return!0;let D=bn(O);if(D.subcommand===null||Nt(D.subcommand))return!0;if(!Jr.has(D.subcommand.toLowerCase()))return!1;let B=D.rest.indexOf("--"),Q=D.rest.slice(0,B===-1?void 0:B);if(!O.some(Nt))return B===-1;return Q.some(Nt)}function hx(O){for(let D=1;D<O.length;D++){let B=O[D];if(!B||B==="--"||!B.startsWith("-"))return!1;if(B==="-c"||B==="--config-env"){if(Nt(O[D+1]??""))return!0;D++;continue}if(B.startsWith("-c")&&B.length>2||B.startsWith("--config-env=")){if(Nt(B))return!0;continue}if(Nt(B))return!0}return!1}function yx(O){if(qn(O))return!1;let D=Kn(O);if(D!==null)return Nt(D);let B=Vn($t(O));if(B.kind==="literal")return Nt(B.source);if(B.kind==="dynamic")return!0;return!O.some(Nt)}function Om(O,D,B){let Q=B(O);if(Q.some((ee)=>Nt(ee.value)))return!0;if(!O.some(Nt))return B([...O,km]).some((ee)=>ee.value===km);return ys(Q,D,(ee)=>B(O.map((he)=>$m(he,[ee]))))}function Fm(O,D,B){let Q=B.policy?.rules??[];if(!D||Q.length===0)return null;let ee=Q.filter((he)=>kt(he.command)===kt(O[0]??""));if(ee.length===0)return null;if(O.slice(1).some(Nt))return lr(B);return xn(ee,(he)=>_([...O,...he.subcommand?[he.subcommand]:[],...he.block_args],[he]))}function bx(O,D){let B={customResult:null,executedSource:!O.some(Nt),rmOptions:!1},Q=!1,ee=0,he=null,je=()=>{if(!he?.some(Nt))return;for(let at of On(he,D))B.executedSource||=Gm(at.tokens,at.head),B.rmOptions||=at.head==="rm"&&Kl(at.tokens)||at.head==="xargs"&&zm(at.tokens),B.customResult??=Fm(at.tokens,!0,D)};for(let at of O.slice(1)){if(!Q&&!at.startsWith("-")&&at!=="!"&&at!=="("){B.executedSource||=Nt(at);continue}if(Q=!0,he){if(at===";"||at==="+"){je(),he=null;continue}he.push(at);continue}if(ee>0){ee--;continue}if(jn(at)){he=[],B.executedSource||=Nt(at);continue}let lt=ir(at);if(lt>0){ee=lt,B.executedSource||=Nt(at);continue}B.executedSource||=Nt(at)}return je(),B}function zm(O){let D=O.slice(Ir(O).childStart);return kt(D[0]??"")==="rm"&&Kl(D)}function ws(O,D){return(B)=>wt(St(O,D),B.policy)}var lr=ws("parallel.shell-dynamic",Jo),Sx=ws("parallel.command-stream-dynamic",ax),eo=ws("parallel.command-stream-dynamic",lx),Mm=ws("parallel.rm-recursive-force-dynamic",Xo);function Vl(O,D,B){return wt(bs($t(O),{environment:B.environment,cwd:D,budget:B.budget,originalCwd:B.originalCwd,strict:B.strict,paranoid:B.paranoidRm,allowTmpdirVar:B.allowTmpdirVar,tmpdirWordSplittingUnsafe:or(B.envAssignments??new Map,B.environment),trustedTmpdirValue:Rr(B.envAssignments??new Map,B.environment),protectedGitMetadata:B.protectedGitMetadata,policy:B.policy}),B.policy)}function Bm(O,D,B){let Q={};if(O)Q.envAssignments=O;if(B)return Q.effectiveCwd=null,Q.worktreeMode=!1,Q;if(D!==void 0)Q.effectiveCwd=D;return Object.keys(Q).length>0?Q:void 0}function $m(O,D){return O.replace(_s,(B)=>Um(B,D))}function xs(O,D,B,Q=_s){return B.charge("derivedTokens",O.reduce((ee,he)=>ee+1+Math.floor(he.length/64),0)),O.map((ee)=>ee.replace(Q,(he)=>{let je=Um(he,D);return B.charge("derivedTokens",Math.max(1,Math.ceil(je.length/64))),je}))}function Dm(O,D,B){return xs([O],D,B)[0]??""}function Nm(O,D,B){return B.charge("derivedTokens",O.length+D.length),[...O,...D]}function Um(O,D){let B=/^\{(-?\d+)[^{}\s]*\}$/.exec(O)?.[1];if(B===void 0)return D[0]??"";let Q=Number(B);return D[Q>0?Q-1:D.length+Q]??""}function Nt(O){return O.search(_s)!==-1}function Hm(O){if(ql(O))return!0;for(let D of O.matchAll(_s))if(!/^(?:\{\}|\{\d+\})$/.test(D[0]))return!0;return!1}function ql(O){let D=O.indexOf("{=");return D!==-1&&O.indexOf("=}",D+2)!==-1}function jm(O){return/^\{[^{}\s]*\}$/.test(O)}function Cx(O,D,B){if(O===void 0)return;if(O==="..."||/^~|[{}$`*?[]/.test(O))return null;if(!D&&!sx(O))return null;try{return tr(D??O,O,B)}catch{return null}}function Vm(O){let D=1,B=[],Q=O.length,ee=-1,he=!1,je=!1,at,lt=!1,ct=O.some((pt)=>pt==="::::"||pt==="::::+"||pt===":::+");while(D<O.length){let pt=O[D];if(pt===void 0)break;if(pt===":::"){ee=D;break}if(pt==="--"){let Et=_l(O,D+1);B.push(...Et.templateTokens),Q=D+1,ee=Et.markerIndex;break}if(!pt.startsWith("-")){let Et=_l(O,D);B.push(...Et.templateTokens),Q=D,ee=Et.markerIndex;break}let ht=O[D+1],gt=pt.indexOf("="),yt=gt===-1?pt:pt.slice(0,gt),vt=gt===-1?void 0:pt.slice(gt+1);if(pt==="--dry-run"){lt=!0,D++;continue}if(pt==="-I"||pt.startsWith("-I")&&pt.length>2){ct||=(pt==="-I"?ht:pt.slice(2))!=="{}",D+=pt==="-I"?2:1;continue}if(pt==="--replace"||pt==="-i"){ct=!0,D+=2;continue}if(yt==="--replace"||pt.startsWith("-i")&&pt.length>2){let Et=yt==="--replace"?vt:pt.slice(2);ct||=Et!==""&&Et!=="{}",D++;continue}if(pt==="-a"||fx.has(yt)){ct=!0,D+=vt===void 0?2:1;continue}if(pt==="--pipe"||pt==="--pipepart"){je=!0,D++;continue}if(yt==="--env"){ct=!0,D+=vt===void 0?2:1;continue}if(Im.has(yt)||pt.startsWith("-S")&&pt.length>2){he=!0,D+=Im.has(pt)?2:1;continue}if(mx.has(yt)){ct=!0;let Et=vt??ht;if(Et===void 0||Et===":::"||Et==="--"){D++;continue}at=Et,D+=vt===void 0?2:1;continue}if(pt.startsWith("-j")&&pt.length>2&&/^\d+$/.test(pt.slice(2))){D++;continue}if(pt.startsWith("--")&&vt!==void 0){D++;continue}if(dx.has(pt)){if(ht===void 0||ht===":::"||ht==="--"){ct=!0,D++;continue}D+=2;continue}D+=pt==="-j"||pt==="--jobs"?2:1}ct||=B.some(lt?ql:Hm);let ut=[];if(ee!==-1){let pt=[];for(let ht=ee+1;ht<O.length;ht++){let gt=O[ht];if(gt===":::"){ut.push(pt),pt=[];continue}if(gt!==void 0)pt.push(gt)}ut.push(pt)}ct||=ut.length>1;let ft=vx(ut),dt=B.some(Nt),mt=B.length===0&&ee===-1;return{template:B,jobs:ft,childStart:Q,templateHasPlaceholder:dt,runsRemotely:he,usesStdin:je||ee===-1,readsCommandsFromInput:mt,unsupported:ct,workdir:at,dryRun:lt}}function vx(O){if(O.length===0||O.some((B)=>B.length===0))return[];let D=[[]];for(let[B,Q]of O.entries()){if(Q.length===1){let he=Q[0];if(he===void 0)return[];for(let je of D)je.push(he);if(D.length*(B+1)>a.derivedTokens.cap)throw new s("derivedTokens");continue}let ee=[];for(let he of D)for(let je of Q){if((ee.length+1)*(B+1)>a.derivedTokens.cap)throw new s("derivedTokens");ee.push([...he,je])}D=ee}return D}function Km(O){return Vm(O).childStart}var Ex="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Ps="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Zl(O){return O?.parts.some((D)=>D.provenance==="command-substitution")??!1}function Yl(O){return O?.parts.some((D)=>D.provenance==="literal"&&D.raw.replace(/^["']/,"").startsWith("-"))??!1}function Ym(O,D,B,Q,ee=!1,he){let at=(Ro(O,D)||Q&&O!=="powershell"&&D[0]?.provenance==="variable")&&Jt(he,"shell.dynamic-executable",ee)?St("shell.dynamic-executable",Ex):null;return wt(at,he)??Zm(O,D,B,ee,he)}function Zm(O,D,B,Q,ee){if(D.length<2)return null;let he=D.flatMap((at,lt)=>Zl(at)?[lt]:[]);if(he.length===0)return null;let je=kt(D[0]?.text??"");if(je==="git"){let at=X(O,D),lt=xx(at);if(Jt(ee,"shell.dynamic-structure",Q)&&he.some((ft)=>ft<=lt))return wt(St("shell.dynamic-structure",Ps),ee);if(wt(hs(at,{environment:B}),ee))return null;let ct=D[lt]?.text.toLowerCase(),ut=at.findIndex((ft,dt)=>dt>lt&&t(ft)==="--");if(Jt(ee,"shell.dynamic-structure",Q)&&ct&&Jr.has(ct)&&he.some((ft)=>ft>lt&&(ut===-1||ft<ut)))return wt(St("shell.dynamic-structure",Ps),ee);return null}if(je==="find")return Jt(ee,"shell.dynamic-structure",Q)&&_x(D)?wt(St("shell.dynamic-structure",Ps),ee):null;if(je==="rm"){let at=D.findIndex((ct,ut)=>ut>0&&t(ct)==="--"),lt=Mn(D.map(t));return Jt(ee,"shell.dynamic-structure",Q)&&he.some((ct)=>(at===-1||ct<at)&&(ct<D.length-1||!lt))?wt(St("shell.dynamic-structure",Ps),ee):null}if(je==="xargs")return qm(O,D.slice(Ir(D.map(t)).childStart),"xargs",B,Q,ee);if(je==="parallel")return qm(O,D.slice(Km(D.map(t))),"parallel",B,Q,ee);return null}function qm(O,D,B,Q,ee,he){if(D.length===0)return null;let je=Rx(D,Q);if(Ro(O,je)){let lt=wt(St(`${B}.shell-dynamic`,B==="xargs"?jl:Jo),he);if(lt)return lt}let at=Zm(O,je,Q,ee,he);if(at)return at;if(je[0]?.text==="rm"&&je.slice(1).some((lt)=>Zl(lt)&&Yl(lt)))return wt(St(`${B}.rm-recursive-force-dynamic`,B==="xargs"?Hl:Xo),he);return null}function Rx(O,D){let B=Sr(O,D),Q=B.rewritten?$t(B.words.map(t)):B.words,ee=Q[0];return ee&&t(ee)==="busybox"?Q.slice(1):Q}function xx(O){let D=1;while(D<O.length){let B=O[D],Q=B?t(B):"";if(pn.has(Q)){D+=2;continue}if(Q.startsWith("-")){D++;continue}return D}return D}function _x(O){let D=!1,B=0,Q=!1,ee=!1;for(let he=1;he<O.length;he++){let je=O[he];if(!je)continue;let at=Zl(je);if(B>0){B--;continue}if(ee){if(je.text===";"||je.text==="+"){ee=!1,D=!0,Q=!1;continue}if(at&&(Q||Yl(je)))return!0;Q=!1;continue}if(!D&&!je.text.startsWith("-")){if(at&&(he>1||Yl(je)))return!0;continue}if(D=!0,at)return!0;let lt=ir(je.text);if(lt>0){B=lt;continue}if(jn(je.text))ee=!0,Q=!0}return!1}function Xl(O,D){return O.some((B)=>{if(B.value==="-"&&(B.kind==="main-script"||B.kind==="program-file"))return!0;return!Fi(D[B.tokenIndex],B.value)})}var wx="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",Px="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",Ax="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Xm(O,D){let B=D.slice(1);if(O==="dd"&&B.some((Q)=>/^of=\/dev\/.+/.test(Q)))return St("dd.device-write",wx);if((O==="mkfs"||O.startsWith("mkfs."))&&B.some((Q)=>Q.startsWith("/dev/")))return St("mkfs.device",Px);if(O==="shred"&&B.length>0)return St("shred.target",Ax);return null}var Qm=[{heads:new Set(["rm","rmdir"]),analyze:(O)=>bs(O.words,{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,paranoid:O.options.paranoidRm,allowTmpdirVar:O.allowTmpdirVar,tmpdirWordSplittingUnsafe:or(O.envAssignments,O.options.environment),trustedTmpdirValue:Rr(O.envAssignments,O.options.environment),protectedGitMetadata:O.options.protectedGitMetadata,policy:O.options.policy,budget:O.options.budget})},{heads:new Set(["git"]),analyze:(O)=>hs(O.words,Jl(O))},{heads:new Set(["find"]),analyze:(O)=>Gf(O.words,{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,allowTmpdirVar:O.allowTmpdirVar,tmpdirWordSplittingUnsafe:or(O.envAssignments,O.options.environment),trustedTmpdirValue:Rr(O.envAssignments,O.options.environment),protectedGitMetadata:O.options.protectedGitMetadata,budget:O.options.budget,envAssignments:O.envAssignments,policy:O.options.policy,analyzeTokens:O.analyzeChildTokens,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})},{heads:new Set(["xargs"]),analyze:(O)=>Rm(O.words,{...Jm(O),analyzeChild:O.analyzeChild,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})},{heads:new Set(["parallel"]),analyze:(O)=>Wm(O.words,{...Jm(O),analyzeChild:O.analyzeChild,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})}];function Jm(O){return{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,paranoidRm:O.options.paranoidRm,paranoidInterpreters:O.options.paranoidInterpreters,allowTmpdirVar:O.allowTmpdirVar,protectedGitMetadata:O.options.protectedGitMetadata,budget:O.options.budget,envAssignments:O.envAssignments,worktreeMode:O.options.worktreeMode,policy:O.options.policy}}function kr(O){return O?{id:O.ruleId??"",reason:O.reason,intent:O.intent??"manual_only"}:null}function Jl(O){return{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,dynamicArguments:O.dynamicArguments,envAssignments:O.envAssignments,shellAssignments:O.options.shellAssignments,policy:O.options.policy,worktreeMode:O.options.worktreeMode}}var rp="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function op(O){return Qm.find((D)=>D.heads.has(O))?.analyze}function no(O,D,B){let Q=B.trace;if(O.length===0)return null;let ee=B.commandView?.dialect??"posix",he=(xt)=>xt.map((At)=>ee==="posix"?t(At):At.text),je=B.child,at=je!==void 0&&!je.embedded,lt=je?.embedded===!0,ct=B.effectiveCwd===null,ut=je?je.cwd:ct?void 0:B.effectiveCwd??B.cwd,ft=je?je.originalCwd:ct?void 0:B.cwd,dt=ge(O);if(dt.envAssignments.size>0)Q?.recordSegment({type:"env-strip",input:he(O),envVars:[...dt.envAssignments.keys()],output:he(dt.words)});let mt=Sr(dt.words,B.environment,ut,new Map([...B.envAssignments??[],...dt.envAssignments])),pt=mt.envSplitValues??[];if(pt.length>0){let xt=[...pt,...he(mt.words)].join(" "),At=$n(xt);if(At)return Q?.recordSegment({type:"dangerous-text",token:xt,matched:!0,reason:At.reason}),on(At);if(B.strict)return dn(Q);let Mt=Ki(pt,he(mt.words));if(Mt){B.budget.charge("derivedTokens",Mt.length);let Yt=B.analyzeNested(Mt.join(" "),{effectiveCwd:mt.cwd===void 0?B.effectiveCwd:mt.cwd,envAssignments:new Map([...B.envAssignments??[],...dt.envAssignments,...mt.envAssignments])});if(Yt)return Yt}}let ht=mt.rewritten?$t(he(mt.words)):X(ee,mt.words),gt=he(ht),yt={...B,wrapperNormalizationBudget:B.wrapperNormalizationBudget??{iterations:0}};if(Q&&dt.words.length>ht.length){let xt=he(dt.words);Q.recordSegment({type:"leading-tokens-stripped",input:xt,removed:xt.slice(0,xt.length-ht.length),output:gt})}let vt=new Map([...B.envAssignments??[],...dt.envAssignments,...mt.envAssignments]),Et=gt[0];if(!Et)return null;if(wr(Et))throw new s("wrapperPeelIterations");let Ct=kt(Et),Pt=mt.cwd===null?void 0:mt.cwd??ut,Rt=mt.cwd===null?void 0:ft,_t=mt.cwd===void 0?B.effectiveCwd:mt.cwd,Ut=je?je.allowTmpdirVar:!zo(vt,B.environment),jt=Ym(ee,mt.words,B.environment,D===0,B.strict,B.policy);if(jt)return Q?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:jt.reason}),on(jt);let qt=us(gt,B.policy);if(qt){for(let xt of[qt.childIndex,...qt.alternativeChildIndices]){ep(yt.wrapperNormalizationBudget);let At=ht.slice(xt);Q?.recordSegment({type:"transparent-wrapper",wrapper:qt.wrapper,output:he(At)});let Mt=no(At,D,{...yt,effectiveCwd:_t,envAssignments:vt});if(Mt)return Mt}return null}let Vt=lt?void 0:Ct==="eval"?Ss(ht):Ct==="trap"&&!at?hm(ht):void 0;if(at&&je&&Ct==="eval"){if(Vt?.kind==="dynamic")return to(je,B.policy);if(Vt?.kind==="literal"){let xt=B.analyzeNested(Vt.source,{effectiveCwd:_t,envAssignments:vt});if(xt)return xt}return ro(je,B.policy)}if(Vt?.kind==="dynamic"&&(B.strict||!B.commandView||!$l(B.commandView)))return dn(Q);if(Vt?.kind==="literal"){Q?.recordSegment({type:"recurse",reason:Ct==="eval"?"shell-eval":"shell-trap",innerCommand:Vt.source,depth:D+1});let xt=B.analyzeNested(Vt.source,{effectiveCwd:_t,envAssignments:vt,functionDefinitions:B.functionDefinitions});if(xt)return xt}if(at?Kt.has(Ct):sp(Et,Ct)){if(qn(gt))return null;if(at&&je){let xt=Kn(gt);if(xt){if(je.dynamicSourceInput??je.dynamicInput){let Mt=to(je,B.policy);if(Mt)return Mt}if(Zo(xt)){let Mt=to(je,B.policy);if(Mt)return Mt}return B.analyzeNested(xt,{effectiveCwd:_t,envAssignments:vt})}let At=Vn(ht);if(At.kind==="dynamic")return to(je,B.policy);if(At.kind==="literal")return je.dynamicSourceInput?to(je,B.policy):null;return je.dynamicSourceInput??je.dynamicInput?to(je,B.policy):null}if(lt){let xt=Kn(gt),At=xt?B.analyzeNested(xt,{effectiveCwd:_t,envAssignments:vt}):Vn(ht).kind==="dynamic"?dn(Q):null;if(At)return At}if(je===void 0){let xt=Ox(gt,vt,_t,B,Q,D);if(xt)return xt;let At=Kn(gt);if(At){let Dr=Cs(ht,At);if(Dr.kind==="dynamic")return dn(Q);let Hs=Dr.kind==="literal"?Dr.source:At,Sc=Mx(Hs);Q?.recordSegment({type:"shell-wrapper",wrapper:Ct,innerCommand:Sc}),Q?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Sc,depth:D+1});let Cc=B.analyzeNested(Hs,{effectiveCwd:_t,envAssignments:vt});if(Cc)return Cc;return Zo(Hs)?dn(Q):null}let Mt=Vn(ht);if(Mt.kind==="dynamic")return dn(Q);if(Mt.kind==="literal")return As(Mt.source,_t,vt,B,Q,D);let Yt=ym(ht,B.commandView?.redirections??[],B.hasPipelineInput??!1,B.literalShellInput);if(Yt.kind==="dynamic")return dn(Q);if(Yt.kind==="literal")return Q?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Yt.source,depth:D+1}),B.analyzeNested(Yt.source,{effectiveCwd:_t,envAssignments:vt})}}if(!je&&(Ct==="source"||Ct===".")){let xt=gt[1]==="-p"?2:null;if(xt!==null){let Dr=B.commandView?ht[xt]:void 0;if(!Dr)return null;if(Dr.provenance!=="literal")return dn(Q)}let At=xt===null?1:3,Mt=gt[At]==="--"?At+1:At,Yt=B.commandView?ht[Mt]:void 0;if(!Yt)return null;if(Yt.provenance==="literal")return As(Yt.text,_t,vt,B,Q,D);if(B.strict||!B.commandView||!$l(B.commandView))return dn(Q)}if(En.has(Ct)&&!lt){if(!je&&B.strict&&Xl(Ho(gt),ht))return dn(Q);let xt=Mf(gt,(Mt)=>kr(B.analyzeNested(Mt,{effectiveCwd:_t,envAssignments:vt}))),At=wt(xt,B.policy);if(At)return Q?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:At.reason}),on(At)}if(Pn(Ct)&&!lt){if(!je&&B.strict&&Xl(Ui(gt),ht))return dn(Q);let xt=kd(gt);if(at&&je)return Ix(Ct,xt,_t,vt,B,je);if(xt){let At=Jt(B.policy,"interpreter.one-liner-paranoid",!!B.paranoidInterpreters);if(Q?.recordSegment({type:"interpreter",interpreter:Ct,codeArg:xt,paranoidBlocked:At}),At){let Yt=wt(St("interpreter.one-liner-paranoid",ko),B.policy);if(Yt)return on(Yt)}if(rl(Ct,xt))return null;Q?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:xt,depth:D+1});let Mt=B.analyzeNested(xt,{effectiveCwd:_t,envAssignments:vt});if(Mt&&!ip(Mt,xt))return Mt;if(Oo(xt)){let Yt=wt(St("interpreter.dangerous-command",Kr),B.policy);if(Yt)return Q?.recordSegment({type:"dangerous-text",token:xt,matched:!0,reason:Kr}),on(Yt)}Q=void 0}}if(Ct==="busybox"&&gt.length>1)return ep(yt.wrapperNormalizationBudget),Q?.recordSegment({type:"busybox",subcommand:gt[1]??"unknown"}),Q?.recordSegment({type:"recurse",reason:"busybox",innerCommand:gt.slice(1).join(" "),depth:D+1}),no(ht.slice(1),D,{...yt,effectiveCwd:_t,envAssignments:vt});let Ot=je?null:wt(Xm(Ct,gt),B.policy);if(Ot)return Q?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:Ot.reason}),on(Ot);let rn=Q===yt.trace?yt:{...yt,trace:Q},Cn={words:ht,head:Ct,cwd:Pt,originalCwd:Rt,envAssignments:vt,allowTmpdirVar:Ut,dynamicArguments:mt.words.some((xt)=>xt.provenance==="command-substitution"),depth:D,effectiveCwd:_t,options:rn,analyzeChildTokens:(xt,At)=>at&&je?Ql(xt,D,rn,{...je,cwd:At??void 0,effectiveCwd:At??void 0}):kr(no($t(xt),D+1,{...rn,child:void 0,commandView:void 0,effectiveCwd:At,envAssignments:vt}))??_(xt,rn.policy.rules),analyzeChild:(xt,At)=>Ql(xt,D,rn,At)},Gn=je&&(Ct==="xargs"||Ct==="parallel")?void 0:op(Ct);if(Ct==="rm"||Ct==="xargs"||Ct==="parallel")Q?.recordSegment({type:"tmpdir-check",tmpdirValue:vt.has("TMPDIR")||B.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Ut});let _n=Q&&Ct==="git"?lm(Cn.words,Jl(Cn)):void 0,$s=tp(_n?_n.match:Gn?.(Cn)??null,B.policy);if(Q)Dx(Cn,$s,_n?.relaxation??null);if($s)return on($s);if(at&&je&&(Ct==="rm"||Ct==="rmdir")){if(!(Ct==="rm"&&(Mn(gt)||je.dynamicRmInput)))return null;return(je.dynamicRmInput?ro(je,B.policy):null)??kx(je,B.policy)}let yc=Gn!==void 0,bc=!je&&!yc&&!yi.has(Ct),Us=Q&&bc?[]:void 0;if(bc)for(let xt=1;xt<gt.length;xt++){let At=gt[xt];if(!At)continue;Us?.push(At);let Mt=tp(Tx(gt,xt,D,rn,Pt,Rt,_t,vt),B.policy);if(Mt)return Q?.recordSegment({type:"fallback-scan",tokensScanned:Us??[],embeddedCommandFound:kt(At)}),on(Mt)}if(Q?.recordSegment({type:"fallback-scan",tokensScanned:Us??[]}),lt&&je&&!je.wrappedByTransparent)return null;if(!je&&D!==0&&yc)return Q?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let ii=_(gt,B.policy.rules);if(Q?.recordSegment({type:"custom-rules-check",rulesChecked:B.policy.rules.length>0,matched:!!ii,reason:ii?.reason}),ii)return on(ii);return at&&je?ro(je,B.policy):null}function Ql(O,D,B,Q){return kr(no($t(O),D+1,{...B,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:Q.originalCwd,effectiveCwd:Q.effectiveCwd,envAssignments:Q.envAssignments,worktreeMode:Q.dynamicInput?!1:Q.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:Q}))}function Tx(O,D,B,Q,ee,he,je,at){for(let lt of On(O.slice(D),{environment:Q.environment,cwd:ee,envAssignments:at,policy:Q.policy})){let ct=lt.tokens[0];if(!ct)continue;let ut=kt(ct);if(sp(ct,ut)||op(ut)!==void 0&&ut!=="xargs"&&ut!=="parallel"||lt.wrappedByTransparent&&Q.policy.rules.length>0)Q.budget.charge("derivedTokens",O.length-D);let dt=Ql(lt.tokens,B,Q,{embedded:!0,cwd:lt.cwd,originalCwd:lt.wrapperCwd===null?void 0:he,effectiveCwd:lt.wrapperCwd===void 0?je:lt.wrapperCwd,envAssignments:lt.envAssignments,allowTmpdirVar:!zo(lt.envAssignments,Q.environment),worktreeMode:!1,wrappedByTransparent:lt.wrappedByTransparent});if(dt)return dt}return null}function Ix(O,D,B,Q,ee,he){if(!D)return ro(he,ee.policy);if(Jt(ee.policy,"interpreter.one-liner-paranoid",!!ee.paranoidInterpreters)){let at=wt(St("interpreter.one-liner-paranoid",ko),ee.policy);if(at)return on(at)}if(rl(O,D))return ro(he,ee.policy);let je=ee.analyzeNested(D,{effectiveCwd:B,envAssignments:Q});if(je&&!ip(je,D))return je;if(Oo(D)){let at=wt(St("interpreter.dangerous-command",Kr),ee.policy);if(at)return on(at)}return ro(he,ee.policy)}function ip(O,D){if(O.ruleId==="raw-text.dangerous-command")return!0;return(O.reason.startsWith(as)||O.reason===Xr)&&!bi(D)}function to(O,D){let B=O.shellDynamicMatch?wt(O.shellDynamicMatch,D):null;return B?on(B):null}function ro(O,D){let B=O.dynamicSourceInput&&O.dynamicSourceMatch?wt(O.dynamicSourceMatch,D):null;return B?on(B):null}function kx(O,D){let B=O.dynamicInput&&O.rmDynamicMatch?wt(O.rmDynamicMatch,D):null;return B?on(B):null}function Ox(O,D,B,Q,ee,he){let je=Cm(O);if(je.argvSource?.kind==="absent")return dn(ee);if(je.argvSourceApplies&&je.argvSource){let lt=As(je.argvSource.value,B,D,Q,ee,he,!0);if(lt)return lt}if(!je.envSourceApplies||!je.envName)return null;let at=D.get(je.envName);if(!at)return null;return As(at,B,D,Q,ee,he,!0)}function As(O,D,B,Q,ee,he,je=!1){if(je&&/[$`*?[\]]/.test(O))return dn(ee);let at=Io(O,D,Q.environment.paths,Q.budget),lt=at?Q.literalHeredocFiles?.get(at):void 0;if(lt===void 0)return je?dn(ee):null;return Q.budget.charge("derivedTokens",1),ee?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:lt,depth:he+1}),Q.analyzeNested(lt,{effectiveCwd:D,envAssignments:B})}function Mx(O){let D=O[0];return O.length>=2&&(D==='"'||D==="'")&&O.at(-1)===D?O.slice(1,-1):O}function Dx(O,D,B){let Q={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[O.head];if(!Q)return;if(O.options.trace?.recordSegment({type:"rule-check",rule:Q,matched:!!D||!!B,reason:D?.reason??B?.originalReason}),B)O.options.trace?.recordSegment({type:B.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:B.originalReason,gitCwd:B.gitCwd})}function ep(O){if(O.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");O.iterations++}function on(O){return{reason:O.reason,ruleId:O.id||void 0,intent:O.intent}}function dn(O){return O?.recordSegment({type:"error",message:rp}),on(Nx())}function Nx(){return{id:"",reason:rp,intent:"stop_and_explain"}}function sp(O,D){return Kt.has(D)||O==="$SHELL"||O==="${SHELL}"||Kt.has(Tt(D))}function tp(O,D){return O?.id.startsWith("custom.")||O?.id==="raw-text.dangerous-command"?O:wt(O,D)}var Lx=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,Wx=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function Gx(O,D){let B=cp(O,D);if(B.length===0)return!1;let Q=B[lp(B)];if(Q==="cd"||Q==="pushd"||Q==="popd")return!0;return Lx.test(O.join(" "))}function ap(O,D,B,Q,ee){if(O.dialect==="powershell"){let gt=zx(O.words,ee);if(gt.kind==="none")return;if(!D||gt.kind==="unknown")return null;return np(Hx(gt.target),D,B.paths)}let he=O.words.map(t),je=he.some((gt)=>/^CDPATH\+?=/.test(gt));if(!Gx(he,B))return je?null:void 0;if(!D)return null;let at=cp(he,B,D),lt=lp(at);if(lt===-1||at[lt]!=="cd")return null;let ct=at.slice(lt+1),ut=ct.findIndex((gt)=>gt.length<=1||!gt.startsWith("-")||gt==="--");if((ut===-1?ct:ct.slice(0,ut)).some((gt)=>!/^-[LP]+$/.test(gt)))return null;let dt=ut===-1?[]:ct.slice(ut),mt=dt[0]==="--"?dt.slice(1):dt;if(mt.length!==1)return null;let pt=mt[0]??"",ht=O.words.some((gt)=>gt.provenance==="variable"&&gt.text===pt)?Fx(pt,Q):pt;if(ht===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(ht)&&(je||B.env.has("CDPATH")))return null;return np(ht,D,B.paths)}function Fx(O,D){let B=Ko(O,D);return B.startsWith("~")||/[\s$`*?[]/.test(B)?null:B}function np(O,D,B){if(!O||O==="-"||O.includes("$")||O.includes("`"))return null;try{return tr(D,O,B)}catch{return null}}function zx(O,D){let B=Bx(O[0])?1:0,Q=O[B];if(!$x(Q,B===1))return{kind:"none"};let ee=Q.text.toLowerCase(),he=ee.split(/[\\/]/).pop()??ee;if(!Wx.has(he))return{kind:"none"};if(ee!==he||he==="pop-location"||he==="popd")return{kind:"unknown"};return Ux(O.slice(B+1),D)}function Bx(O){return O?.provenance==="literal"&&!O.quoted&&O.raw===O.text&&(O.text==="&"||O.text===".")}function $x(O,D){return O?.provenance==="literal"&&(D||!O.quoted&&O.raw===O.text)}function Ux(O,D){let B;for(let Q of O){if(Q.provenance!=="literal"||B!==void 0)return{kind:"unknown"};B=Q.text}if(B!==void 0)return{kind:"target",target:B};return D===void 0?{kind:"unknown"}:{kind:"target",target:D}}function Hx(O){return O.includes("::")?void 0:O.replaceAll("\\","/")}function lp(O){let D=0;if(O[0]==="builtin"&&O.length>1)D=1;if(O[D]!=="time")return D;let B=D+1;while(O[B]?.startsWith("-"))B++;return B}function cp(O,D,B){let Q=jx(O);return nr([...Q],D,B)}function jx(O){let D=0;while(D<O.length){let B=O[D];if(B!=="{"&&B!=="("&&B!=="$(")break;D++}return O.slice(D)}var Vx="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Or="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function oc(O,D,B,Q){if(D>=a.recursionDepth.cap)return B.trace?.recordSegment({type:"error",message:Nn}),{reason:Nn,segment:O,intent:"stop_and_explain"};let ee=Q??B.factStore?.getCommandProgram(O,B.shell??"auto")??h(O,B.shell);if(ee.status==="limited")return B.trace?.recordSegment({type:"error",message:Nn}),{reason:Nn,segment:O,intent:"stop_and_explain"};if(ee.status==="invalid"){let ct=ee.issues.find((ut)=>ut.code.includes("heredoc"));if(ct){if(!B.strict)return rc(O,B);let ut=`${as}: ${ct.message}`;return B.trace?.recordGlobal({type:"error",message:ut}),{reason:ut,segment:O,intent:"stop_and_explain"}}return gp(O,B),{reason:Xr,segment:O,intent:"stop_and_explain"}}if(B.strict&&ee.status==="partial")return gp(O,B),{reason:Xr,segment:O,intent:"stop_and_explain"};if(ee.issues.some((ct)=>ct.code.includes("quote")))return rc(O,B);let je=B.cwd,at=B.effectiveCwd!==void 0?B.effectiveCwd:B.cwd,lt=Zf(B.environment.env,B.envAssignments);return ks(ee,D,{...B,rootProgram:ee},je,[{effectiveCwd:at,shellGitContextState:lt,literalHeredocFiles:new Map(B.literalHeredocFiles),functionDefinitions:new Map(B.functionDefinitions)}]).result}function ks(O,D,B,Q,ee){let he=[...ee],je,at;for(let[lt,ct]of O.nodes.entries()){if(ct.kind==="connector"){at=ct.operator;continue}let ut=O.nodes[lt+1],ft=ut?.kind==="connector"?ut.operator:void 0,dt=Kx(O,lt,ct,at,ft),mt=at==="&&"||at==="||",pt=mt?je:void 0,ht=at==="&&"?pt?.success??he:at==="||"?pt?.failure??he:he,gt=at==="||"?pt?.success??[]:[],yt=at==="&&"?pt?.failure??[]:[],vt=mt||io(ft);if(ct.kind==="function"){let jt=ht.flatMap((Vt)=>{let Ft=so(Vt);return Ft.functionDefinitions.set(ct.name,ct.body),ec(Vt,[Ft],dt,ft==="&",io(ft))}),qt=tc(jt,[],gt,yt,at,ft);he=qt.states,je=qt.conditionalStates,at=void 0;continue}if(ct.kind==="group"){let jt=[],qt=[];for(let Ft of ht){let Ot=ks(ct.body,D,B,Q,[so(Ft)]);if(Ot.result)return Ot;if(jt.push(...ec(Ft,Ot.states,dt,ft==="&",io(ft))),vt)qt.push(Ft,...dt?Ot.states.map((rn)=>Ts(Ft,rn)):Ot.states)}let Vt=tc(jt,qt,gt,yt,at,ft);he=Vt.states,je=Vt.conditionalStates,at=void 0;continue}if(ct.kind!=="command")continue;let Et=B.trace?.flattenNested?B.trace.currentSegmentIndex:B.trace?.allocateSegment(),Ct=O.nodes[lt-2],Pt=Os(at)&&Ct?.kind==="command"?gm(Ct)??Yx(Ct):void 0,Rt=[],_t=[];for(let jt of ht){let qt=Zx(ct,D,B,Q,[so(jt)]);if(qt.result)return{result:qt.result,states:he};let Vt=O.dialect==="powershell"?qt.states:qt.states.map((Ft)=>Ts(jt,Ft));for(let Ft of Vt){let Ot=so(Ft),rn=Qx(ct,D,B.trace?{...B,trace:hp(B.trace,Et)}:B,Q,Ot,Os(at),Pt);if(rn)return{result:rn,states:he};let Cn=g_(ct,Ot.functionDefinitions);if(Cn)B.budget.charge("derivedTokens",Ms(Cn));let Gn=Cn?D+1>=a.recursionDepth.cap?nc(ct.displayText,B,[Ot]):ks(Cn,D+1,B,Q,[Ot]):{result:null,states:m_(ct,Ot)};if(Gn.result)return Gn;if(Rt.push(...ec(jt,Gn.states,dt,ft==="&",io(ft))),vt)_t.push(jt),_t.push(...Gn.states.map((_n)=>dt?Ts(jt,_n):_n))}}let Ut=tc(Rt,_t,gt,yt,at,ft);he=Ut.states,je=Ut.conditionalStates,at=void 0}return{result:null,states:he}}function Kx(O,D,B,Q,ee){if(B.kind==="group"&&B.style==="subshell")return!0;if(O.dialect==="posix"&&(Os(Q)||Os(ee)))return!0;if(ee==="&")return!0;return O.dialect==="powershell"&&B.kind==="group"&&B.style==="brace"&&qx(O,D)}function ec(O,D,B,Q,ee){let he=B?D.map((at)=>Ts(O,at)):[...D],je=ee?he.flatMap((at)=>oo(O.literalHeredocFiles,at.literalHeredocFiles)?[at]:[{...at,literalHeredocFiles:new Map(O.literalHeredocFiles)},at]):he;return Q?[O,...je]:je}function Ts(O,D){return{...O,literalHeredocFiles:new Map(D.literalHeredocFiles)}}function qx(O,D){let B=[...O.nodes.slice(0,D)].reverse().find((ee)=>ee.kind==="command"||ee.kind==="connector");if(!B||B.kind!=="command")return!0;let Q=B.words[0]?.text.toLowerCase();if(Q==="&"||Q===".")return!1;if(Q==="write-output"||Q==="function"||Q==="start-job")return!0;if(Xx(B))return!0;return B.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Os(O){return O==="|"||O==="|&"}function Yx(O){if(O?.dialect!=="powershell")return;if(O.words.length===1&&O.words[0]?.quoted&&O.words[0].provenance==="literal")return O.words[0].text;if(O.words[0]?.text.toLowerCase()==="write-output"&&O.words.length===2&&O.words[1]?.provenance==="literal")return O.words[1].text;return}function io(O){return O==="&&"||O==="||"}function tc(O,D,B,Q,ee,he){let je={success:Is([...B,...O]),failure:Is([...Q,...D])},at=io(he)?je:void 0;return{states:io(ee)||at?Is([...je.success,...je.failure]):je.success,conditionalStates:at}}function hp(O,D,B=O.flattenNested){return{currentSegmentIndex:D,flattenNested:B,allocateSegment:O.allocateSegment,getNextSegmentIndex:O.getNextSegmentIndex,recordGlobal:O.recordGlobal,recordSegment:(Q,ee=D)=>O.recordSegment(Q,ee)}}function Zx(O,D,B,Q,ee){let he=O.nested.map((je)=>({program:je,depth:D}));if(O.dialect==="powershell"){let je=Jx(O);if(je){if(D+1>=a.recursionDepth.cap)return nc(je,B,ee);let at=h(je,"powershell");if(at.status==="limited")return nc(je,B,ee);if(at.status!=="complete")return up(he,B,Q,ee);B.budget.charge("derivedTokens",Ms(at)),he.push({program:at,depth:D+1})}}return up(he,B,Q,ee)}function Xx(O){let D=O.words[0];return D?.provenance==="variable"&&O.words.at(-1)?.text==="="?D.text.toLowerCase():void 0}function up(O,D,B,Q){let ee=[...Q];for(let he of O){let je=[];for(let at of ee){let lt=ks(he.program,he.depth,D,B,[so(at)]);if(lt.result)return lt;je.push(...lt.states)}ee=Is(je)}return{result:null,states:ee}}function Jx(O){let D=O.words[0]?.provenance==="literal"&&!O.words[0].quoted&&O.words[0].raw===O.words[0].text&&(O.words[0].text==="&"||O.words[0].text==="."),B=D?1:0,Q=O.words[B];if(Q?.provenance!=="literal"||!D&&(Q.quoted||Q.raw!==Q.text)||!["iex","invoke-expression"].includes(Q.text.toLowerCase()))return;let ee=O.words.slice(B+1),he=ee[0]&&!ee[0].quoted&&ee[0].raw===ee[0].text&&["-c","-command"].includes(ee[0].text.toLowerCase())?1:0,je=ee[he];return ee.length===he+1&&je?.quoted&&je.provenance==="literal"?je.text:void 0}function Ms(O){return O.nodes.reduce((D,B)=>D+(B.kind==="command"?B.words.length+B.nested.reduce((Q,ee)=>Q+Ms(ee),0):B.kind==="group"||B.kind==="function"?Ms(B.body):0),0)}function nc(O,D,B){return D.trace?.recordSegment({type:"error",message:Nn}),{result:{reason:Nn,segment:O,intent:"stop_and_explain"},states:[...B]}}function Qx(O,D,B,Q,ee,he,je){let at={...B,environment:{...B.environment,env:ee.shellGitContextState.env}},lt=s_(O);if(lt&&at.strict)return at.trace?.recordSegment({type:"error",message:lt}),{reason:lt,segment:O.source,intent:"stop_and_explain"};yp(O,ee,"before-consumer",at.environment.paths,at.budget);let ct=X(O.dialect,O.words),ut=ct.map(t),ft=O.displayText,dt=Yf(ct,ee.shellGitContextState),mt=Jf(dt,ee.shellGitContextState);if(O.dialect==="powershell"){let gt=wt(_f(O,he,y_(at,ee.effectiveCwd)),at.policy);if(at.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!gt,reason:gt?.reason}),gt)return h_(ft,gt)}if(ut.length===1&&ut[0]?.includes(" ")&&!Ro(O.dialect,O.words)){let gt=wt($n(ut[0]),at.policy),yt=gt!==null&&!at.strict&&wd(O,at.rootProgram);if(gt&&!yt)return at.trace?.recordSegment({type:"dangerous-text",token:ut[0],matched:!0,reason:gt.reason}),{reason:gt.reason,segment:ft,ruleId:gt.id,intent:gt.intent};at.trace?.recordSegment({type:"dangerous-text",token:ut[0],matched:!1});let vt=dp(O,lt,ee,mt,je,at);if(vt)return vt;return Ll(dt,ee.shellGitContextState),null}let pt=no(O.words,D,{...at,commandView:O,cwd:Q,effectiveCwd:ee.effectiveCwd,envAssignments:mt,shellAssignments:ee.shellGitContextState.shellAssignments,literalHeredocFiles:ee.literalHeredocFiles,functionDefinitions:ee.functionDefinitions,hasPipelineInput:he,literalShellInput:je,analyzeNested:(gt,yt)=>{let vt=yt&&Object.hasOwn(yt,"effectiveCwd")?yt.effectiveCwd:ee.effectiveCwd,Et=oc(gt,D+1,{...at,effectiveCwd:vt,envAssignments:yt?.envAssignments??mt,literalHeredocFiles:ee.literalHeredocFiles,functionDefinitions:yt?.functionDefinitions,worktreeMode:yt?.worktreeMode??at.worktreeMode,trace:at.trace?hp(at.trace,at.trace.currentSegmentIndex,!0):void 0});return Et?{reason:Et.reason,ruleId:Et.ruleId,intent:Et.intent}:null}});if(pt)return{...pt,segment:ft};let ht=dp(O,lt,ee,mt,je,at);if(ht)return ht;return Ll(dt,ee.shellGitContextState),null}function dp(O,D,B,Q,ee,he){let je=a_(O,D,B,Q??new Map,he);if(je)return je;return yp(O,B,"after-consumer",he.environment.paths,he.budget),B.literalHeredocFiles.clear(),n_(O,D,B,he.environment.paths,he.budget),u_(O,B,ee,he.environment,he.trace),null}var e_=new Set([">>","<>"]);function yp(O,D,B,Q,ee){for(let je of O.redirections){if(!(B==="before-consumer"?t_(je):e_.has(je.operator)))continue;fp(je.target,D,Q,ee)}if(B!=="before-consumer"||!Sn(O.words[0],"tee"))return;let he=bp(O.words.slice(1));if(!he)return;for(let je of he.operands)fp(je,D,Q,ee)}function t_(O){if(O.operator===">"||O.operator===">|")return!0;return O.operator===">&"&&O.fd===void 0&&O.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(O.target.text)}function fp(O,D,B,Q){let ee=O?.provenance==="literal"?Io(O.text,D.effectiveCwd,B,Q):void 0;if(!ee)return;D.literalHeredocFiles.delete(ee)}function n_(O,D,B,Q,ee){if(D)return;let he=O.redirections.find((je)=>je.operator==="<<"||je.operator==="<<-")?.heredoc;if(!he||!Ds(he))return;for(let je of r_(O)){let at=Io(je.text,B.effectiveCwd,Q,ee);if(!at||!Td(at))continue;if(!B.literalHeredocFiles.has(at)&&B.literalHeredocFiles.size>=a.trackedHeredocFiles.cap)throw new s("trackedHeredocFiles");B.literalHeredocFiles.set(at,he.body)}}function r_(O){let D=i_(O.redirections)?.target,B=mp(D)?[D]:[];if(Sn(O.words[0],"cat"))return o_(O.words)?B:[];if(!Sn(O.words[0],"tee"))return[];let Q=bp(O.words.slice(1));if(!Q||Q.append||Q.hasUnsupportedOptions||!Q.operands.every(mp))return[];return[...Q.operands,...B]}function o_(O){let D=!1;for(let B of O.slice(1)){if(D||B.provenance!=="literal")return!1;if(B.text==="--"){D=!0;continue}if(!/^-u+$/.test(B.text))return!1}return!0}function i_(O){let D=O.findLast((B)=>(B.fd??([">",">|",">>",">&"].includes(B.operator)?1:0))===1);return D?.operator===">"||D?.operator===">|"?D:void 0}function bp(O){let D=[],B=!0,Q=!1,ee=!1;for(let he of O){if(he.provenance!=="literal")return;if(B&&Sn(he,"--")){B=!1;continue}if(B&&!he.quoted&&he.raw===he.text&&/^-[^-]/.test(he.text)){Q||=he.text.slice(1).includes("a"),ee||=[...he.text.slice(1)].some((je)=>je!=="a"&&je!=="i");continue}if(B&&!he.quoted&&he.raw===he.text&&he.text.startsWith("--")){Q||=he.text==="--append",ee||=he.text!=="--append"&&he.text!=="--ignore-interrupts";continue}D.push(he)}return{operands:D,append:Q,hasUnsupportedOptions:ee}}function mp(O){if(!O||O.provenance!=="literal"||O.text.length===0)return!1;if(O.quoted||O.raw!==O.text)return!0;return!O.raw.startsWith("~")&&!/[{}]/.test(O.raw)}function Sn(O,D){return O?.text===D&&O.raw===D&&O.provenance==="literal"&&!O.quoted}function Ds(O){return O.quotedDelimiter||!/[$`\\]/.test(O.body)}function s_(O){let D=O.redirections.filter((je)=>je.operator==="<<"||je.operator==="<<-");if(D.length===0)return;if(D.length!==1)return Or;let B=D[0];if(!B?.heredoc)return Or;if(!Ds(B.heredoc))return Vx;if(B.fd!==void 0&&B.fd!==0)return Or;if(O.redirections.some((je)=>je!==B&&["<","<<","<<-","<<<","<&","<>"].includes(je.operator)))return Or;let Q=O.redirections.some((je)=>je!==B&&pp(je.target));if(Sn(O.words[0],"cat"))return Q?Or:void 0;if(Sn(O.words[0],"tee"))return Q||O.words.slice(1).some(pp)?Or:void 0;let ee=O.words[0],he=O.words[1];if(Sn(ee,"git")&&(Sn(he,"apply")||Sn(he,"commit")))return;if(Sn(ee,"gh")&&(Sn(he,"pr")||Sn(he,"issue"))&&Sn(O.words[2],"create"))return;return Or}function pp(O){return O?.parts.some((D)=>D.provenance==="command-substitution"&&D.raw.startsWith(">("))??!1}function a_(O,D,B,Q,ee){if(!D)return null;let he=O.redirections.filter((ct)=>ct.operator==="<<"||ct.operator==="<<-"),je=he.flatMap((ct)=>ct.heredoc?[ct.heredoc.body]:[]);if(c_(O,he,B,Q,ee))return null;let at=l_(O,he,ee);if(at!==void 0)return at?{reason:at.reason,segment:O.displayText,ruleId:at.id,intent:at.intent}:null;let lt=rc(je.length===he.length?je.join(`
-`):O.source,ee);return lt?{...lt,segment:O.displayText}:null}function l_(O,D,B){let Q=D.length===1?D[0]:void 0;if(!Q?.heredoc||!Ds(Q.heredoc)||Q.fd!==void 0&&Q.fd!==0)return;let ee=O.words[0];if(ee?.provenance!=="literal"||!Pn(ee.text))return;if(!O.words.slice(1).every((ct)=>ct.provenance==="literal"&&ct.text.startsWith("-")))return;let je=Q.heredoc.body,at=Jt(B.policy,"interpreter.one-liner-paranoid",!!B.paranoidInterpreters);if(B.trace?.recordSegment({type:"interpreter",interpreter:ee.text,codeArg:je,paranoidBlocked:at}),at){let ct=wt(St("interpreter.one-liner-paranoid",ko),B.policy);if(ct)return ct}if(!Oo(je))return null;let lt=wt(St("interpreter.dangerous-command",Kr),B.policy);if(!lt)return null;return B.trace?.recordSegment({type:"dangerous-text",token:je,matched:!0,reason:lt.reason}),lt}function c_(O,D,B,Q,ee){let he=D.length===1?D[0]:void 0;if(!he?.heredoc||!Ds(he.heredoc)||he.fd!==void 0&&he.fd!==0)return!1;let je=Sr(O.words,ee.environment,B.effectiveCwd,Q),at=je.words.map(t),lt=kt(at[0]??"");if((je.envSplitValues?.length??0)>0||!Kt.has(lt)&&!Kt.has(Tt(lt)))return!1;return qn(at)}function u_(O,D,B,Q,ee){let he=ap(O,D.effectiveCwd,Q,D.shellGitContextState.shellAssignments,B);if(he===null)ee?.recordSegment({type:"cwd-change",segment:O.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(he!==void 0)D.effectiveCwd=he}var d_=/^[A-Za-z_][A-Za-z0-9_]*$/,f_=8;function m_(O,D){let B=O.words[1]?.text;if(O.dialect!=="posix"||O.words[0]?.text!=="for"||B===void 0||!d_.test(B))return[D];let Q=O.words.slice(3);if(!(O.words[2]?.text==="in"&&Q.length>=1&&Q.length<=f_&&Q.every((he)=>he.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(he.text))))return D.shellGitContextState.shellAssignments.delete(B),[D];return Q.map((he)=>{let je=so(D);return je.shellGitContextState.shellAssignments.set(B,he.text),je})}function so(O){return{effectiveCwd:O.effectiveCwd,shellGitContextState:Xf(O.shellGitContextState),literalHeredocFiles:new Map(O.literalHeredocFiles),functionDefinitions:new Map(O.functionDefinitions)}}function Is(O){let D=[];for(let B of O){if(!D.some((Q)=>p_(Q,B)))D.push(B);if(D.length>a.controlFlowStates.cap)throw new s("controlFlowStates")}return D}function p_(O,D){return O.effectiveCwd===D.effectiveCwd&&oo(O.shellGitContextState.env,D.shellGitContextState.env)&&oo(O.literalHeredocFiles,D.literalHeredocFiles)&&oo(O.functionDefinitions,D.functionDefinitions)&&oo(O.shellGitContextState.effectiveEnvAssignments,D.shellGitContextState.effectiveEnvAssignments)&&oo(O.shellGitContextState.shellAssignments,D.shellGitContextState.shellAssignments)&&O.shellGitContextState.bodyDepth===D.shellGitContextState.bodyDepth&&O.shellGitContextState.bodyAssignments.size===D.shellGitContextState.bodyAssignments.size&&[...O.shellGitContextState.bodyAssignments].every((B)=>D.shellGitContextState.bodyAssignments.has(B))}function oo(O,D){if(O===D)return!0;if(!O||!D||O.size!==D.size)return!1;return[...O].every(([B,Q])=>D.get(B)===Q&&D.has(B))}function g_(O,D){let B=xo(O);return B===void 0?void 0:D.get(B)}function h_(O,D){if(!D)return null;return{reason:D.reason,segment:O,ruleId:D.id,intent:D.intent}}function y_(O,D=O.effectiveCwd){let B=D===null;return{environment:O.environment,cwd:B?void 0:D??O.cwd,originalCwd:B?void 0:O.cwd,strict:O.strict,paranoid:O.paranoidRm,allowTmpdirVar:O.allowTmpdirVar,protectedGitMetadata:O.protectedGitMetadata,policy:O.policy,budget:O.budget}}function rc(O,D){let B=wt($n(O),D.policy),Q=D.trace?.currentSegmentIndex??D.trace?.allocateSegment(),ee={type:"dangerous-text",token:O,matched:!!B,reason:B?.reason};if(D.trace?.recordSegment(ee,Q),!B&&/^(?:cd|pushd)\s/.test(O))D.trace?.recordSegment({type:"cwd-change",segment:O,effectiveCwdNowUnknown:!0},Q);return B?{reason:B.reason,segment:O,ruleId:B.id,intent:B.intent}:null}function gp(O,D){let B={type:"strict-unparseable",rawCommand:O,reason:Xr},Q=D.trace?.currentSegmentIndex;if(Q===void 0)D.trace?.recordGlobal(B);if(Q!==void 0)D.trace?.recordSegment(B)}var b_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Sp(O,D,B,Q){let ee=oc(O,0,{...D,...Fe(D),budget:D.budget??fn(),factStore:Q},B);if(!ee)return null;return{kind:"deny",reason:ee.reason,intent:ee.intent??"manual_only",...ee.ruleId?{ruleId:ee.ruleId}:{},evidence:{command:O,segment:ee.segment}}}function Cp(O,D,B){try{return{decision:O()}}catch(Q){let ee=S_(Q,D,B);if(!ee)throw Q;return ee}}function S_(O,D,B){if(!(O instanceof s)||!b_.has(O.kind))return null;let Q=a[O.kind];if(B?.currentSegmentIndex!==void 0)B.recordSegment({type:"error",message:Q.reason});if(B?.currentSegmentIndex===void 0)B?.recordGlobal({type:"error",message:Q.reason});return{decision:{kind:"deny",reason:Q.reason,intent:"stop_and_explain",evidence:{command:D,segment:D}},errorCode:Q.errorCode}}var C_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),sc=new Set(["cc-safety-net","ccsn"]),v_=new Set(["bunx","npx","pnpx"]),E_=new Set(["pnpm","yarn"]),R_=new Set(["npm","pnpm","yarn"]),x_=new Set(["bun","node"]);function Ls(O,D,B={}){if(sc.has(O))return 0;if(v_.has(O)){if(B.broad)return ic(D);let ee=D[0]==="-y"||D[0]==="--yes"?1:0;return Ns(D[ee])?ee+1:null}let Q=B.broad?D.findIndex((ee)=>!ee.startsWith("-")):0;if(Q!==-1&&R_.has(O)&&B.broad&&D[Q]==="exec"){let ee=ic(D.slice(Q+1));return ee===null?null:Q+1+ee}if(E_.has(O)){if(O==="yarn"&&!B.broad)return null;if(!B.broad)return D[0]==="dlx"&&Ns(D[1])?2:null;if(Q===-1||D[Q]!=="dlx")return null;let ee=ic(D.slice(Q+1));return ee===null?null:Q+1+ee}if(x_.has(O)){let ee=B.broad&&Q!==-1?Q:0;if(vp(D[ee]))return ee+1;if(O==="bun"&&D[ee]==="run"&&vp(D[ee+1]))return ee+2}return null}function ic(O){let D=O.findIndex((Q)=>Ns(Q));if(D===-1)return null;let B=D;while(B<O.length){let Q=O[B]??"";if(!Q.startsWith("-")&&!Ns(Q))break;B++}return B}function Ns(O){if(!O)return!1;let D=O.indexOf("@");if(D===-1)return sc.has(O);if(D===0)return!1;let B=O.slice(D+1);if(B===""||B.includes("/")||B.includes(":"))return!1;return sc.has(O.slice(0,D))}function vp(O){let D=O?.replaceAll("\\","/");return[...C_].some((B)=>D===B||D?.endsWith(`/${B}`))}var Me="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Ep(O,D,B){let Q=cn(O,"input-candidate");if(!Q)return null;let ee=Yr(Q.shell,O.invocation.context.executionCwd,D,B,{findSegmentTarget:(he)=>__(he,D),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return ee?{target:ee}:null}function __(O,D){let B=nr([...O],D),Q=B.slice(1),ee=Ls(Tt(B[0]??"").toLowerCase(),Q,{broad:!0});if(ee===null)return null;let he=Q.slice(ee).filter((je)=>je!=="-g"&&je!=="--global");return he[0]==="policy"&&he[1]==="apply"?B.join(" "):null}import{dirname as Ws}from"node:path";var $e="This path contains the protected policy config and you must not modify or delete it.",w_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function wp(O,D,B){let Q=O_(O.invocation.context,D,B);if(O.invocation.route.kind==="patch")return Rp(O.paths,!1,O.invocation.context.executionCwd,Q,D,B);let ee=cn(O,"input-candidate");if(O.invocation.route.kind==="command")return ee?xp(ee.shell,O.invocation.context.executionCwd,Q,D,B):null;if(O.invocation.route.kind==="unknown"&&ee){let he=xp(ee.shell,O.invocation.context.executionCwd,Q,D,B);if(he)return he}return Rp(O.paths,O.invocation.route.kind==="grep"||O.invocation.route.kind==="glob"||ci(O.invocation.toolName),O.invocation.context.executionCwd,Q,D,B)}function Rp(O,D,B,Q,ee,he){if(D)return null;let je=O.find((at)=>Qo(at,B,Q,ee,he));return je?{target:je}:null}function xp(O,D,B,Q,ee){let he=Yr(O,D,Q,ee,{findSegmentTarget:(je,at)=>P_(je,at,B,Q,ee)?.target??null,isRedirectionTarget:(je,at)=>Qo(je,at.cwd,B,Q,ee),findMalformedTarget:(je)=>k_(je,D,B,Q,ee)?.target??null});return he?{target:he}:null}function P_(O,D,B,Q,ee){if(Wo(O))return null;let he=Cr([...O],Q),je=Tt(he[0]??"").toLowerCase(),at=he.slice(1);if(je==="rm"&&A_(at)){let lt=T_(at).find((ct)=>_p(ln(ct,D.variables),D.cwd,B,Q,ee));if(lt)return{target:lt}}if(je==="find"){if(ms(he,1)||Pl(he,Q)){let ct=(fs($t(he))??$t(["."])).find((ut)=>{let ft=ln(ut.text,D.variables);return Qo(ft,D.cwd,B,Q,ee)||_p(ft,D.cwd,B,Q,ee)})?.text;if(ct)return{target:ct}}}if(je==="mv"){let lt=Qi(at).sources.find((ct)=>M_(ln(ct,D.variables),D.cwd,B,Q,ee));if(lt)return{target:lt}}if(I_(he,je))return null;for(let lt of[...O,...he])for(let ct of Pp(lt))if(Qo(ln(ct,D.variables),D.cwd,B,Q,ee))return{target:ct};return null}function A_(O){return O.some((D)=>D==="--recursive"||D.startsWith("-")&&!D.startsWith("--")&&/[rR]/.test(D.slice(1)))}function T_(O){let D=O.indexOf("--");if(D!==-1)return[...O.slice(0,D).filter((B)=>!B.startsWith("-")),...O.slice(D+1)];return O.filter((B)=>!B.startsWith("-"))}function I_(O,D){if(!w_.has(D))return!1;if(D!=="sed")return!0;return!O.slice(1).some((B)=>B.startsWith("-i")||B==="--in-place"||B.startsWith("--in-place="))}function k_(O,D,B,Q,ee){for(let he of O.split(/\s+/))for(let je of Pp(he))if(Qo(je,D,B,Q,ee))return{target:je};return null}function Pp(O){let D=O.trim().replace(/^['"]|['"]$/g,""),B=D.indexOf("=");return B===-1||B===D.length-1?[D]:[D,D.slice(B+1)]}function O_(O,D,B){let Q=(at)=>ei(tn(at,O.executionCwd,D,B)),ee=Q(u(D)),he=[Q(b(O.executionCwd)),Q(b(O.configCwd))],je=new Set(he.map((at)=>Ws(at)));for(let at=Ws(ee);;at=Ws(at))if(je.add(at),Ws(at)===at)break;return{files:new Set([ee,...he]),directoriesAndAncestors:je}}function Qo(O,D,B,Q,ee){let he=_c(O,D,Q,ee,(je)=>ei(je)===gi);return he!==null&&B.files.has(ei(he))}function _p(O,D,B,Q,ee){return B.directoriesAndAncestors.has(ei(tn(O,D,Q,ee)))}function M_(O,D,B,Q,ee){let he=ei(tn(O,D,Q,ee));return B.files.has(he)||B.directoriesAndAncestors.has(he)}function ei(O){return process.platform==="win32"?O.toLowerCase():O}import{isAbsolute as Gs,posix as D_,resolve as zs,win32 as N_}from"node:path";import{fileURLToPath as L_}from"node:url";var Wp="Access to a sensitive path is not allowed.",Gp=new Set(["echo","printf"]),W_=new Set(["find"]),G_=new Set(["-exec","-execdir"]),F_=new Set([";","+"]),z_=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),B_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Fp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),$_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),U_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),zp=new Set(["-c","-e","-r","-E","--eval","--exec"]),H_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),j_=new Set(["grep","rg"]),Ap=new Set(["jq","gojq","jaq"]),Tp="f",Ip="file",V_="files",K_=new Set(["e","f"]),q_=new Set(["regexp","file"]),Y_=new Set(["e","f","A","B","C","m"]),Z_=new Set(["regexp","file","after-context","before-context","context","max-count"]),ac="__CC_SAFETY_NET_PIPE_INPUT__",cc=/[\w./~@+-]*[./~][\w./~@+-]*/g,X_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,J_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,Q_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,ew=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,tw=/\b(?:system|exec)\s*$/,nw=/\b(?:eval|exec)\s*\(/g,rw=/\b(?:eval|exec)\s*$/,ow=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function kp(O,D,B,Q,ee,he){for(let je of O){let at=je.target;if(nP(at,je.cwd,D?.denyPaths??[],B,Q,ee))return{target:at,ruleId:"secret.deny-path"};if(he&&!he.has(at))continue;let lt=eP(at,je.cwd,D,Q,ee);if(lt){if(!lt.startsWith("secret.cli.")&&rP(at,je.cwd,D?.allowPaths??[],B,Q,ee))continue;return{target:at,ruleId:lt}}}return null}function Bp(O,D,B,Q,ee={}){let he=Op(O,B,Q),je=kp(he,D,O.invocation.context.configCwd,B,Q);if(je===null)return null;let at=je.ruleId!=="secret.deny-path"&&ee.strict===!1?Op(O,B,Q,{refineInlineData:!0}):he,lt=at.length===he.length?je:kp(he,D,O.invocation.context.configCwd,B,Q,new Set(at.map((ct)=>ct.target)));if(lt?.ruleId!=="secret.deny-path"&&ee.strict===!1&&iw(O,B))return null;return lt}function iw(O,D){let B=cn(O,"input-candidate")??cn(O,"declared-command");if(!B)return!1;if(B.program.nodes.some((at)=>at.kind==="command"&&at.nested.length>0))return!1;let Q=[];for(let at of Ji(B.shell)){if(at.kind==="operator"&&at.boundary)return!1;if(at.kind==="redirection")return!1;if(at.kind==="operator")continue;Q.push(Hn(at.text,D))}let ee=cr(Q);if(ee.length===0)return!1;let he=Xn(ee[0]??"").toLowerCase(),je=ee.slice(1);if(O.invocation.route.kind==="unknown")return B.program.dialect==="powershell"&&(he==="ls"||he==="stat");if(he==="ls"||he==="stat")return!0;if(he==="test")return je.length===2&&(je[0]==="-e"||je[0]==="-f");if(he!=="find")return!1;return!je.some((at)=>z_.has(at))}function Op(O,D,B,Q={}){let ee=O.invocation.context.executionCwd,he=O.invocation.route.kind;if(he!=="command"&&he!=="unknown")return O.paths.map((at)=>({target:at,cwd:ee}));let je=cn(O,"input-candidate");return[...je?ao(je.shell,O.store,Q,D,ee,B,sw(je)):[],...he==="unknown"?O.paths.map((at)=>({target:at,cwd:ee})):[]]}function sw(O){return O.program.dialect==="powershell"}function ao(O,D,B,Q,ee,he,je=!1){if(O.status==="structural-limit")throw new y;if(O.status==="unclosed-quote")return[];if(O.status==="invalid")throw Error("Unable to parse command for secret protection");let at=[...O.assignmentFallbacks.map((ct)=>({target:ct,cwd:ee})),...Lw(Hn(O.source,Q),D,B,Q,ee,he)],lt=(ct)=>Hn(yw(ct,je),Q);return Xi(O,ee,Q,he,{word:lt,segment:(ct,ut,ft,dt,mt)=>{if(ct.length===0)return null;if(at.push(...Bs(ct,D,B,Q,ut.cwd,he,mt)),ft!==null)at.push(...lw(ft,ct,D,B,Q,ut.cwd,he));return null},redirection:(ct,ut)=>{if(ct.body!==void 0&&ct.consumer!==void 0)at.push(...$p(ct.consumer,[ct.body],D,B,Q,ut.cwd,he,(ft)=>cw(ct.consumer??[],ft,D,B,Q,ut.cwd,he)));if(ct.targetOrder==="legacy-segment")return ul;return at.push({target:lt(ct.target),cwd:ut.cwd}),null}}),at}function uc(O,D,B,Q,ee,he){let je=D.getShellSyntax(O);if(je.status==="structural-limit")throw new y;return je.status==="complete"?ao(je,D,B,Q,ee,he):null}function Bs(O,D,B,Q,ee,he,je){let at=(pt)=>({target:pt,cwd:ee});if(je?.size){let pt=O.filter((ht,gt)=>!je.has(gt));if(Ap.has(Xn(cr(pt)[0]??"").toLowerCase()))return[...O.filter((ht,gt)=>je.has(gt)).map(at),...Bs(pt,D,B,Q,ee,he)]}let lt=hw(O).map(at),ct=cr(O);if(ct.length===0)return lt;let ut=ct[0]??"",ft=Xn(ut).toLowerCase(),dt=ct.slice(1),mt=aw(ut,ft,dt);if(mt)return[...lt,...mt.map(at)];if(Gp.has(ft))return B.capturedOutput===!0?[...lt,...Up(O).map(at)]:lt;if(ft==="eval")return[...lt,...uc(dt.join(" "),D,B,Q,ee,he)??dt.map(at)];if(ft==="export")return[...lt,...dt.flatMap((pt)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(pt)?[pt.slice(pt.indexOf("=")+1)]:Zn(ft,pt)).map(at)];if(ft==="git")return[...lt,...Sw(dt).map(at)];if(Ap.has(ft))return[...lt,...bw(dt).map(at)];if(j_.has(ft))return[...lt,...Hw(dt).map(at)];if(W_.has(ft))return[...lt,...Rw(dt,D,B,Q,ee,he).map(at)];if(En.has(ft))return[...lt,...dt.flatMap((pt)=>Zn("awk",pt)).map(at),...dt.flatMap((pt)=>_w(pt,D,B,Q,ee,he)),...dt.flatMap(ww).map(at)];if(ft==="curl")return[...lt,...dt.flatMap((pt)=>Zn(ft,pt)).map(at),...Cw(dt).map(at)];if(Go(ft)){let pt=Lo.has(ft)?gn([ft,...dt]):null;if(pt!==null&&pt.command!==null&&pt.commandIndex!==null){let ht=D.getShellSyntax(pt.command);if(ht.status==="structural-limit")throw new y;if(ht.status==="complete")return[...lt,...ao(ht,D,B,Q,ee,he),...dt.slice(pt.commandIndex).filter((gt)=>!gt.startsWith("-")).map(at)]}return[...lt,...xw(ft,dt,D,B,Q,ee,he)]}return[...lt,...dt.flatMap((pt)=>Zn(ft,pt)).map(at)]}function aw(O,D,B){let Q=Ls(D,B);if(Q===null||B[Q]!=="explain")return null;let ee=[O,...B.slice(0,Q)],he=B.slice(Q+1);for(let je=0;je<he.length;je++){let at=he[je];if(at==="--json"||at==="--help"||at==="-h")continue;if(at==="--cwd"){let lt=he[je+1];if(lt&&!lt.startsWith("--"))ee.push(lt);je++;continue}return ee}return ee}function lw(O,D,B,Q,ee,he,je){if(mw(D,B,Q,ee,he,je))return Up(O).map((at)=>({target:at,cwd:he}));return $p(D,uw(O),B,Q,ee,he,je,()=>[])}function cw(O,D,B,Q,ee,he,je){let at=cr(O);if(!Go(Xn(at[0]??"").toLowerCase()))return[];return uc(D,B,Q,ee,he,je)??[{target:D,cwd:he}]}function $p(O,D,B,Q,ee,he,je,at){let lt=pw(O);if(lt===null)return D.flatMap(at);return D.flatMap((ct)=>Lo.has(lt)?ao(B.getShellSyntax(ct),B,Q,ee,he,je):Fs(lt,ct,B,Q,ee,he,je))}function Up(O){let D=cr(O);if(D.length===0)return[];let B=Xn(D[0]??"").toLowerCase();if(!Gp.has(B))return[];let Q=D[D[1]==="--"?2:1];if(B==="printf"&&Q!==void 0&&!Q.startsWith("-")&&!Q.replaceAll("%%","").includes("%"))return[dc(Q.replaceAll("%%","%"))];return D.slice(1)}function uw(O){let D=cr(O);if(D.length===0)return[];let B=Xn(D[0]??"").toLowerCase(),Q=D.slice(1);if(B==="echo"){let ee=Q.findIndex((he)=>!/^-[neE]+$/.test(he));return[(ee===-1?[]:Q.slice(ee)).join(" ")]}if(B==="printf")return dw(Q);return[]}function dw(O){let D=O[0];if(D===void 0)return[];let B=(D.match(/%%|%[bqs]/g)??[]).filter((ee)=>ee!=="%%").length;if(B===0||O.length===1)return[dc(D)];let Q=O.slice(1);return Array.from({length:Math.ceil(Q.length/B)},(ee,he)=>fw(D,Q.slice(he*B,(he+1)*B)))}function fw(O,D){let B=0;return dc(O.replace(/%%|%[bqs]/g,(Q)=>{if(Q==="%%")return"%";let ee=D[B]??"";return B++,ee}))}function dc(O){return O.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function mw(O,D,B,Q,ee,he){let je=cr(O);if(je.length===0||Xn(je[0]??"").toLowerCase()!=="xargs")return!1;let at=Ir(je),lt=je.slice(at.childStart);if(lt.length===0)return!1;if(at.replacementToken==="")return!1;let ct=at.replacementToken,ut=ct===null?[...lt,ac]:lt.map((ft)=>ft.split(ct).join(ac));return Bs(ut,D,B,Q,ee,he).some((ft)=>ft.target.includes(ac))}function pw(O){let D=cr(O);if(D.length===0)return null;let B=Xn(D[0]??"").toLowerCase();if(!Go(B))return null;return gw(B,D.slice(1))?B:null}function gw(O,D){let B=fc(O);for(let Q=0;Q<D.length;Q++){let ee=D[Q];if(ee===void 0)break;if(zp.has(ee)||Hp(O,ee)||/^--(?:eval|exec)=/.test(ee))return!1;if(ee==="-")return!0;if(ee.startsWith("-")){if(B==="python"&&ee==="-m")return!1;if(ow.get(B)?.has(ee))Q++;continue}return!1}return!0}function fc(O){return/^python\d/.test(O)?"python":O}function hw(O){let D=[];for(let B of O){if(Vp(B))continue;let Q=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(B);if(Q===null)break;if(Q[1]!==void 0&&Q[1]!=="")D.push(Q[1])}return D}var Mp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function yw(O,D){if(!D||!Mp.test(O))return O;return`~${O.replace(Mp,"").replace(/\\/g,"/")}`}function Zn(O,D){if(D==="--")return[];let B=[],Q=D.indexOf("=");if(Q>0&&Q<D.length-1)B.push(D.slice(Q+1));if(D.startsWith("-"))return B;if(O==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(D))return B;if(O==="zip"&&/\.zip$/i.test(D))return B;return B.push(D),B}function bw(O){let D=-1,B=!1;for(let Q=0;Q<O.length;Q++){let ee=O[Q]??"";if(!B&&ee==="--"){B=!0;continue}if(B||!/^-(?:[A-Za-z]|-)/.test(ee)){if(D===-1)D=Q;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(ee)){Q+=2;continue}if(ee==="--indent"||ee==="-L"){Q++;continue}if(ee.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(ee)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(ee))continue;return O.flatMap((he)=>Zn("jq",he))}return O.flatMap((Q,ee)=>ee===D?[]:Zn("jq",Q))}function Sw(O){let D=[];for(let B=0;B<O.length;B++){let Q=O[B]??"";if(Q==="--"||!Q.startsWith("-"))return[...D,...O.slice(B).flatMap((he)=>Zn("git",he))];if(D.push(...Zn("git",Q)),!pn.has(Q))continue;let ee=O[B+1];if(ee===void 0)break;D.push(...Q==="-c"&&ee.includes("=")?[ee.slice(ee.indexOf("=")+1)]:Zn("git",ee)),B++}return D}function Cw(O){return O.flatMap((D,B)=>{let Q=Ew(D);if(Q!==null)return Dp(Q.flag,Q.value);let ee=vw(O[B-1]);return ee===null?[]:Dp(ee,D)})}function Dp(O,D){if(O==="-F"||O==="--form"){let B=D.indexOf("="),Q=B===-1?D:D.slice(B+1);if(!Q.startsWith("@")&&!Q.startsWith("<"))return[];return lc(Q.slice(1).split(";")[0]??"")}if(O==="--data-urlencode"){let B=D.indexOf("@"),Q=D.indexOf("=");if(B===-1||Q!==-1&&Q<B)return[];return lc(D.slice(B+1))}return D.startsWith("@")?lc(D.slice(1)):[]}function vw(O){if(O===void 0)return null;if(Fp.has(O))return O;return/^-[A-Za-z]+[dF]$/.test(O)?`-${O.slice(-1)}`:null}function Ew(O){let D=O.slice(0,2);if(O.length>2&&(D==="-d"||D==="-F"))return{flag:D,value:O.slice(2)};let B=O.indexOf("=");if(B===-1)return null;let Q=O.slice(0,B);return Fp.has(Q)?{flag:Q,value:O.slice(B+1)}:null}function lc(O){return O===""||O==="-"?[]:[O]}function Rw(O,D,B,Q,ee,he){let je=O.findIndex((lt)=>lt.startsWith("-")||lt==="("||lt==="!"||lt===";"),at=[...O.slice(0,je===-1?O.length:je)];for(let lt=0;lt<O.length;lt++){if(!G_.has(O[lt]??""))continue;let ct=O.slice(lt+1),ut=ct.findIndex((mt)=>F_.has(mt)),ft=ut===-1?ct:ct.slice(0,ut),dt=Bs(ft,D,B,Q,ee,he).map((mt)=>mt.target);if(at.push(...dt.filter((mt)=>mt!=="{}")),!dt.includes("{}"))continue;at.push(...O.slice(0,lt).flatMap((mt,pt,ht)=>{if(!B_.has(mt))return[];let gt=ht[pt+1];return gt===void 0?[]:[gt,gt.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return at}function xw(O,D,B,Q,ee,he,je){let at=[];for(let lt=0;lt<D.length;lt++){let ct=D[lt];if(ct===void 0)break;if(zp.has(ct)||Hp(O,ct)){let ft=D[lt+1];if(ft!==void 0)at.push(...Fs(O,ft,B,Q,ee,he,je)),lt++;continue}let ut=/^--(?:eval|exec)=(.*)$/.exec(ct);if(ut!==null&&ut[1]!==void 0){at.push(...Fs(O,ut[1],B,Q,ee,he,je));continue}if(!ct.startsWith("-"))at.push({target:ct,cwd:he})}return at}function Hp(O,D){if(!D.startsWith("-")||D.startsWith("--")||D.length<=2)return!1;return H_.get(D[D.length-1]??"")?.has(fc(O))??!1}function _w(O,D,B,Q,ee,he){if(!O.includes("system"))return[];return Rl(O)?.commands.flatMap((je)=>ao(D.getShellSyntax(je),D,B,Q,ee,he))??[]}function ww(O){return Array.from(O.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((D)=>D[1]).filter((D)=>D!==void 0&&D!=="")}function Pw(O){let D=Array.from(O.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((B)=>B[2]).filter((B)=>B!==void 0&&B!=="");return[...D,...D.flatMap(mc),...O.match(cc)??[]]}function Fs(O,D,B,Q,ee,he,je){let at=(mt)=>({target:mt,cwd:he}),lt=Tw(D,Aw(O));if(lt===null)return Pw(D).map(at);let ct=lt.masked.match(ew)!==null||lt.literals.some((mt)=>tw.test(lt.masked.slice(0,mt.start))),ut=lt.masked.match(nw)!==null||lt.literals.some((mt)=>rw.test(lt.masked.slice(0,mt.start))),ft=Q.refineInlineData===!0&&!Lo.has(O),dt=ft&&!(Mw(lt.masked)||ct||ut)?[]:lt.literals;return[...dt.map((mt)=>mt.text).filter((mt)=>mt!=="").map(at),...dt.flatMap((mt)=>mc(mt.text)).map(at),...ft?[]:lt.literals.flatMap((mt)=>mt.text.match(cc)??[]).map(at),...ct?lt.literals.flatMap((mt)=>uc(mt.text,B,Q,ee,he,je)??[at(mt.text)]):[],...ut?lt.literals.flatMap((mt)=>Fs(O,mt.text.replace(/\\(.)/g,(pt,ht)=>ht==="n"?`
-`:ht),B,Q,ee,he,je)):[],...(lt.masked.match(cc)??[]).map(at)]}function Aw(O){let D=fc(O);if(D==="python")return"python";if(D==="osascript")return"opaque";return D==="node"||D==="bun"||D==="deno"?"javascript":"simple"}function Tw(O,D){if(D==="opaque")return null;let B=O.split(""),Q=[];for(let ee=0;ee<O.length;ee++){let he=O[ee]??"";if(D==="simple"&&(he==="`"||he==="%"||he==="<")){if(J_.test(O.slice(ee)))return null}let je=he==="'"||he==='"'||D==="javascript"&&he==="`"?he:null;if(je===null)continue;if(je==="`"&&Ow(O,ee))return null;let at=D==="python"?Iw(O,ee):"",lt=D==="python"&&O.startsWith(je.repeat(3),ee)?je.repeat(3):je,ct=ee+lt.length,ut=kw(O,ct,lt);if(ut===null)return null;let ft=O.slice(ct,ut);if(/[fF]/.test(at)&&ft.includes("{"))return null;if(D==="simple"&&je==='"'&&Q_.test(ft))return null;Q.push({start:ct,text:ft});for(let dt=ee;dt<ut+lt.length;dt++)B[dt]=" ";ee=ut+lt.length-1}return{masked:B.join(""),literals:Q}}function Iw(O,D){return X_.exec(O.slice(Math.max(0,D-3),D))?.[1]??""}function kw(O,D,B){let Q=B==="`",ee=Q||B.length===3;for(let he=D;he<O.length;he++){let je=O[he];if(je==="\\"){he++;continue}if(Q&&je==="$"&&O[he+1]==="{")return null;if(!ee&&(je===`
-`||je==="\r"))return null;if(O.startsWith(B,he))return he}return null}function Ow(O,D){for(let B=D-1;B>=0;B--){let Q=O[B];if(!Q||/\s/.test(Q))continue;return/[\w$\])]/.test(Q)}return!1}function Mw(O){for(let D of O.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let B=D[0],Q=D.index;if($_.has(B.toLowerCase()))return!0;let ee=B.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((he)=>he.toLowerCase());if(!ee.some((he)=>U_.has(he)))continue;if(ee.length>1)return!0;if(Dw(O,Q)===".")return!0;if(Nw(O,Q+B.length)==="(")return!0}return!1}function Dw(O,D){for(let B=D-1;B>=0;B--)if(!/\s/.test(O[B]??""))return O[B];return}function Nw(O,D){for(let B=D;B<O.length;B++)if(!/\s/.test(O[B]??""))return O[B];return}function Lw(O,D,B,Q,ee,he){return Bw(O).flatMap((je)=>{let at=D.getShellSyntax(je);if(at.status==="invalid")return[];return[...ao(at,D,{...B,capturedOutput:!0},Q,ee,he),...Ww(at,Q)?Gw(at,Q).map((lt)=>({target:lt,cwd:ee})):[]]})}function Ww(O,D){let B=Ji(O);for(let Q=0;Q<B.length;Q++){let ee=B[Q];if(ee?.kind!=="word"||Xn(Hn(ee.text,D)).toLowerCase()!=="base64")continue;for(let he=Q+1;he<B.length;he++){let je=B[he];if(je?.kind==="operator")break;if(je?.kind!=="word")continue;let at=Hn(je.text,D);if(at==="--decode"||!at.startsWith("--")&&at.startsWith("-")&&/[dD]/.test(at))return!0}}return!1}function Gw(O,D){return Ji(O).flatMap((B)=>B.kind==="word"?[Hn(B.text,D)]:B.kind==="redirection"&&B.target?[Hn(B.target,D)]:[]).flatMap(mc)}function mc(O){let D=zw(O);if(D===null)return[];let B=Buffer.from(D,"base64").toString("utf8");if(B===""||Fw(B))return[];return Buffer.from(B,"utf8").toString("base64").replace(/=+$/g,"")===D.replace(/=+$/g,"")?[B]:[]}function Fw(O){return Array.from(O).some((D)=>{let B=D.charCodeAt(0);return B<32||B===127})}function zw(O){if(O.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(O))return null;if(/=/.test(O.replace(/=+$/g,"")))return null;let D=O.replace(/=+$/g,"");if(D.length%4===1)return null;return`${D.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-D.length%4)%4)}`}function Bw(O){let D=[],B={inSingle:!1,inDouble:!1,escaped:!1};for(let Q=0;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(So(ee,B))continue;if(jp(O,Q,B)){let he=$w(O,Q+1);if(he!==null)D.push(he.body),Q=he.endIndex;continue}if(!B.inSingle&&ee==="`"){let he=Uw(O,Q);if(he!==null)D.push(he.body),Q=he.endIndex}}return D}function $w(O,D){let B={inSingle:!1,inDouble:!1,escaped:!1},Q=1;for(let ee=D+1;ee<O.length;ee++){let he=O[ee];if(!he)break;if(So(he,B))continue;if(jp(O,ee,B)){Q++,ee++;continue}if(!B.inSingle&&!B.inDouble&&he===")"){if(Q--,Q===0)return{body:O.slice(D+1,ee),endIndex:ee}}}return null}function Uw(O,D){let B=!1;for(let Q=D+1;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(B){B=!1;continue}if(ee==="\\"){B=!0;continue}if(ee==="`")return{body:O.slice(D+1,Q),endIndex:Q}}return null}function jp(O,D,B){return!B.inSingle&&O[D]==="$"&&O[D+1]==="("&&O[D+2]!=="("}function Hw(O){let D=[],B=[],Q=!1,ee=!1,he=!1;for(let lt=0;lt<O.length;lt++){let ct=O[lt];if(ct===void 0)break;if(!he&&ct==="--"){he=!0;continue}if(he){B.push(ct);continue}let ut=/^--([^=]+)(?:=(.*))?$/.exec(ct);if(ut!==null){let ft=ut[1]??"",dt=ut[2];if(ft===V_)ee=!0;if(q_.has(ft))Q=!0;if(dt!==void 0){if(ft===Ip)D.push(dt);continue}if(Z_.has(ft)){let mt=O[lt+1];if(ft===Ip&&mt!==void 0)D.push(mt);lt++}continue}if(ct.startsWith("-")&&ct.length>1){let ft=ct.slice(1),dt="",mt="";for(let ht=0;ht<ft.length;ht++){let gt=ft[ht]??"";if(K_.has(gt))Q=!0;if(Y_.has(gt)){dt=gt,mt=ft.slice(ht+1);break}}if(dt==="")continue;if(mt.length>0){if(dt===Tp)D.push(mt);continue}let pt=O[lt+1];if(dt===Tp&&pt!==void 0)D.push(pt);lt++;continue}B.push(ct)}let at=!Q&&!ee?B.slice(1):B;return[...D,...at]}function cr(O){let D=O.findIndex((B)=>!Vp(B)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(B));return D===-1?[]:[...O.slice(D)]}function Vp(O){return O==="env"||O==="command"||O==="builtin"||O==="sudo"}var jw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Vw=".env.",Kw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),qw=[".env.example.",".env.sample."];function Yw(O){let D;try{D=new URL(O.trim())}catch{return!1}return D.protocol!=="file:"&&D.host!==""}function Zw(O){return O.length>0&&!/\s/.test(O)}function Xw(O,D,B,Q){try{let ee=ri(O,D,B,Q);return ee!==""&&B.paths.entryKind(ee)!=="missing"}catch(ee){if(ee instanceof s)throw ee;return!1}}var Jw=new Set(["node_modules","__pycache__"]),Qw=[["vendor","bundle"],["vendor","cache"]];function eP(O,D,B,Q,ee){if(Yw(O))return null;let he=Wn(O,D,Q,ee);if(!he)return null;let je=Gt(he.split("/").pop()??""),at=Gt(he),lt=()=>Zw(je)||Xw(O,D,Q,ee);if(Kw.has(je)||qw.some((dt)=>je.startsWith(dt)))return null;let ct=Gt(sP(O,D,Q,ee));for(let dt of Ea){let mt=`~/${dt.suffixParts.join("/")}`;if((Lp(at,mt)||Lp(ct,mt))&&Yn(dt.id,B))return dt.id}let ut=tP(he,D,B,Q,ee);if(ut)return ut;if(jw.has(je))return null;for(let dt of va)if(je===dt.basename&&Yn(dt.id,B))return dt.id;if(je.startsWith(Vw)&&Yn(Ci.id,B)&&lt())return Ci.id;for(let dt of Ra)if(je.length>dt.prefix.length&&je.startsWith(dt.prefix)){let mt=je.slice(dt.prefix.length)[0];if((mt==="-"||mt==="_")&&Yn(dt.id,B)&&lt())return dt.id}for(let dt of xa)if(je.length>dt.prefix.length&&je.startsWith(dt.prefix)){if(je.slice(dt.prefix.length)===dt.suffix&&Yn(dt.id,B))return dt.id}if(oP(at))return null;if(!je.includes(".")&&Co.pattern.test(je)&&Yn(Co.id,B))return Co.id;let ft=iP(je,B);if(ft)return ft;return null}function tP(O,D,B,Q,ee){return vi.find((he)=>{if(!Yn(he.id,B))return!1;switch(he.id){case"secret.cli.claude-code":return Dt(O,Wt(Q.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",D,Q,ee),[".credentials.json"]);case"secret.cli.claude-code.config":{let je=Gt(O).split("/");return Dt(O,Wt(Q.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",D,Q,ee),["settings.json","settings.local.json"])||ni(O,"~/.claude.json",D,Q,ee)||je.at(-1)==="settings.local.json"&&je.at(-2)===".claude"||je.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Dt(O,Wn("~/.gemini/config",D,Q,ee),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let je=Wt(Q.env.get("CODEX_HOME"),"~/.codex",D,Q,ee);return Dt(O,je,["auth.json",".credentials.json"])||ti(O,je,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let je=Wt(Q.env.get("CODEX_HOME"),"~/.codex",D,Q,ee),at=Gt(O).split("/").at(-1)??"";return Dt(O,je,["config.toml"])||at.endsWith(".config.toml")&&Dt(O,je,[at])}case"secret.cli.gemini":return Dt(O,nn(Wt(Q.env.get("GEMINI_CLI_HOME"),"~",D,Q,ee),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let je=Gt(O).split("/"),at=Q.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),lt=Q.env.get("ProgramData")?[nn(Wt(Q.env.get("ProgramData"),"",D,Q,ee),"gemini-cli")]:[];return Dt(O,nn(Wt(Q.env.get("GEMINI_CLI_HOME"),"~",D,Q,ee),".gemini"),["settings.json","google_accounts.json"])||je.at(-1)==="settings.json"&&je.at(-2)===".gemini"||(at?.trim()?ni(O,at,D,Q,ee):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...lt].some((ct)=>Dt(O,Wn(ct,D,Q,ee),["settings.json"]))}case"secret.cli.copilot-cli":{let je=Wt(Q.env.get("COPILOT_HOME"),"~/.copilot",D,Q,ee);return Dt(O,je,["config.json"])||ti(O,je,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Dt(O,Wt(Q.env.get("COPILOT_HOME"),"~/.copilot",D,Q,ee),["mcp-config.json"]);case"secret.cli.kimi-code":{let je=Wt(Q.env.get("KIMI_CODE_HOME"),"~/.kimi-code",D,Q,ee),at=Wt(Q.env.get("KIMI_SHARE_DIR"),"~/.kimi",D,Q,ee);return Dt(O,je,["server.token"])||ti(O,je,["credentials"])||ti(O,at,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let je=["config.toml","mcp.json"],at=Gt(O).split("/");return at.at(-1)==="mcp.json"&&at.at(-2)===".kimi-code"||Dt(O,Wt(Q.env.get("KIMI_CODE_HOME"),"~/.kimi-code",D,Q,ee),je)||Dt(O,Wt(Q.env.get("KIMI_SHARE_DIR"),"~/.kimi",D,Q,ee),[...je,"config.json","config.json.bak"])}case"secret.cli.opencode":{let je=nn(Wt(Q.env.get("XDG_DATA_HOME"),"~/.local/share",D,Q,ee),"opencode"),at=Gt(O).split("/").at(-1)??"",lt=Q.env.get("OPENCODE_DB")?.trim(),ct=lt&&lt!==":memory:"?[lt,`${lt}-wal`,`${lt}-shm`]:[];return Dt(O,je,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(at)&&Dt(O,je,[at])||ct.some((ut)=>ni(O,ut,D,Q,ee))}case"secret.cli.opencode.config":{let je=Q.env.get("OPENCODE_CONFIG_DIR")?Wt(Q.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",D,Q,ee):nn(Wt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"opencode"),at=Q.env.get("ProgramData")?[nn(Wt(Q.env.get("ProgramData"),"",D,Q,ee),"opencode")]:[],lt=["opencode.json","opencode.jsonc"],ct=Q.env.get("OPENCODE_CONFIG");return lt.includes(Gt(O).split("/").at(-1)??"")||Dt(O,je,lt)||(ct?.trim()?ni(O,ct,D,Q,ee):!1)||["/Library/Application Support/opencode","/etc/opencode",...at].some((ut)=>Dt(O,Wn(ut,D,Q,ee),lt))}case"secret.cli.pi":return Dt(O,Wt(Q.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",D,Q,ee),["auth.json"]);case"secret.cli.pi.config":return Dt(O,Wt(Q.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",D,Q,ee),["models.json"]);case"secret.cli.amp":{let je=Wn("~",D,Q,ee);return[nn(Wt(Q.env.get("XDG_DATA_HOME"),"~/.local/share",D,Q,ee),"amp"),nn(je,".local","share","amp")].some((lt)=>Dt(O,lt,["secrets.json"]))||ti(O,nn(je,".amp"),["oauth"])}case"secret.cli.amp.config":{let je=["settings.json","settings.jsonc"],at=[nn(Wt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"amp"),nn(Wn("~",D,Q,ee),".config","amp")],lt=Gt(O).split("/"),ct=Q.env.get("AMP_SETTINGS_FILE");return at.some((ut)=>Dt(O,ut,je))||lt.at(-2)===".amp"&&je.includes(lt.at(-1)??"")||(ct?.trim()?ni(O,ct,D,Q,ee):!1)}case"secret.cli.cursor":{let je=nn(Wt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"cursor"),at=nn(Wt(Q.env.get("CURSOR_DATA_DIR"),"~/.cursor",D,Q,ee),"projects");return Dt(O,Wn("~/.cursor",D,Q,ee),["auth.json"])||Dt(O,je,["auth.json"])||Gt(O).split("/").at(-1)==="mcp-auth.json"&&Mr(Gt(O),Gt(at))}case"secret.cli.cursor.config":{let je=Gt(O).split("/");return je.at(-1)==="mcp.json"&&je.at(-2)===".cursor"}case"secret.cli.grok-build":return Dt(O,Wt(Q.env.get("GROK_HOME"),"~/.grok",D,Q,ee),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let je=Gt(O).split("/");return je.at(-1)==="config.toml"&&je.at(-2)===".grok"||Dt(O,Wt(Q.env.get("GROK_HOME"),"~/.grok",D,Q,ee),["config.toml","managed_config.toml","requirements.toml"])||Dt(O,Wn("/etc/grok",D,Q,ee),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Np=new WeakMap;function Wt(O,D,B,Q,ee){let he=Np.get(ee)??new Map;Np.set(ee,he);let je=`${B}\x00${O??""}\x00${D}`,at=he.get(je);if(at!==void 0)return at;let lt=Wn(O?.trim()?O:D,B,Q,ee);return he.set(je,lt),lt}function Dt(O,D,B){return B.some((Q)=>Kp(O,nn(D,Q)))}function ti(O,D,B){return B.some((Q)=>Mr(Gt(O),Gt(nn(D,Q))))}function ni(O,D,B,Q,ee){return Kp(O,Wn(D,B,Q,ee))}function Kp(O,D){return Gt(O)===Gt(D)}function nn(O,...D){return Dn([O,...D].filter(Boolean).join("/"))}function nP(O,D,B,Q,ee,he){if(B.length===0)return!1;let je=Gt(ri(O,D,ee,he));return B.some((at)=>Mr(je,Gt(ri(at,Q,ee,he))))}function rP(O,D,B,Q,ee,he){if(B.length===0)return!1;let je=Gt(ri(O,D,ee,he));if(!je)return!1;let at=ee.env.get("HOME")??ee.home,lt=at?Dn(Lt(mn(at),ee.paths,he)):"",ct=Gt(lt),ut=ee.env.get("CC_SAFETY_NET_HOME"),ft=Gt(ut?Dn(Lt(zs(mn(ut)),ee.paths,he)):lt&&Dn(Lt(`${lt}/.cc-safety-net`,ee.paths,he)));if(ft&&Mr(je,ft))return!1;return B.some((dt)=>{let mt=Gt(ri(dt,Q,ee,he));if(!mt)return!1;if(ct&&(ct===mt||ct.startsWith(mt.endsWith("/")?mt:`${mt}/`)))return!1;return Mr(je,mt)})}function oP(O){let D=O.split("/");return D.some((B)=>Jw.has(B))||Qw.some(([B,Q])=>D.some((ee,he)=>ee===B&&D[he+1]===Q))}function iP(O,D){let B=O.lastIndexOf("."),Q=B>0&&B<O.length-1?O.slice(B+1):"";if(Q==="")return null;for(let ee of _a)if(Q===ee.extension&&Yn(ee.id,D))return ee.id;for(let ee of wa)if(ee.pattern.test(Q)&&Yn(ee.id,D))return ee.id;return null}function Gt(O){return O.toLowerCase()}function Yn(O,D){return!D?.disabledRules?.includes(O)}function Wn(O,D,B,Q){let{home:ee,normalized:he}=pc(O,B,Q);if(!he)return"";if(!ee)return he;let je=gc(he,ee),at=Gs(je)?je:Dn(zs(D,je)),lt=Dn(Lt(at,B.paths,Q));if(!Mr(lt,ee)){if(Gs(je))return lt;return lt===at?he:lt}let ct=lt.slice(ee.length);return ct?`~${ct}`:"~"}function Lp(O,D){return O===D||O.startsWith(`${D}/`)}function sP(O,D,B,Q){let{home:ee,normalized:he}=pc(O,B,Q);if(!he||!ee)return"";let je=gc(he,ee),at=D_.normalize(Gs(je)?je:Dn(zs(D,je))),lt=Dn(mn(B.env.get("HOME")??B.home)),ct=(dt)=>process.platform==="win32"?dt.toLowerCase():dt,ut=[ee,lt].find((dt)=>dt!==""&&Mr(ct(at),ct(dt)));if(ut===void 0)return"";let ft=at.slice(ut.length);return ft?`~${ft}`:"~"}function ri(O,D,B,Q){let{home:ee,normalized:he}=pc(O,B,Q);if(!he)return"";let je=ee?gc(he,ee):he;return Dn(Lt(Gs(je)?je:zs(D,je),B.paths,Q))}function pc(O,D,B){let Q=D.env.get("HOME")??D.home,ee=Q?Dn(Lt(mn(Q),D.paths,B)):"",he=Dn(mn(aP(Hn(O,D))));return{home:ee,normalized:he}}function aP(O){if(!O.trim().toLowerCase().startsWith("file:"))return O;try{return L_(O)}catch{return O}}function gc(O,D){if(O==="~")return D;if(O.startsWith("~/"))return nn(D,O.slice(2));return O}function lP(O){if(process.platform==="win32")return!0;return N_.parse(O).root.length>1}function Dn(O){let D=O.trim(),B=(D.includes("\\")&&lP(D)?D.replace(/\\/g,"/"):D).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(B==="/")return B;return B.replace(/\/+$/g,"")}function Mr(O,D){return O===D||O.startsWith(D.endsWith("/")?D:`${D}/`)}function Xn(O){return O.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??O}class p extends Error{stage;evaluation;name="GuardEvaluationError";constructor(O,D,B){super(`CC Safety Net ${O} dependency failed`,{cause:B});this.stage=O;this.evaluation=D}}var cP={findPolicyMutation:wp,findGitMetadataMutation:af,resolveGitMetadata:uP,loadPolicySnapshot:E,findSensitiveTarget:Bp,analyzeCommand:Sp,getModes:R};function W(O,D){let B={...cP,...D.dependencies},Q=mP(O),ee=oi(O)?O.command:Q,he=ur("policy-protection",ee,()=>Fo(O)),je=cn(he,"input-candidate"),at=cn(he,"declared-command");if(oi(O)&&O.command?.trim()&&at?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Nn,intent:"stop_and_explain",evidence:{command:O.command,segment:O.command}}};if(je?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:wf,intent:"stop_and_explain"}};let lt=fn(),ct=ur("policy-protection",ee,()=>B.resolveGitMetadata([O.context.executionCwd,O.context.configCwd],D.environment)),ut=ur("policy-protection",ee,()=>B.findPolicyMutation(he,D.environment,lt));if(ut){let Et=ee??ut.target;return{stage:"policy-protection",decision:{kind:"deny",reason:$e,intent:"hard_stop",evidence:{command:Et,segment:ut.target}}}}let ft=ur("policy-protection",ee,()=>Ep(he,D.environment,lt));if(ft){let Et=ee??ft.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Me,intent:"hard_stop",evidence:{command:Et,segment:ft.target}}}}let dt=ur("policy-protection",ee,()=>B.findGitMetadataMutation(he,ct,D.environment,lt));if(dt){let Et=ee??dt.target;return{stage:"policy-protection",decision:{kind:"deny",reason:x,intent:"hard_stop",evidence:{command:Et,segment:dt.target}}}}let mt=ur("config-load",ee,()=>B.loadPolicySnapshot(D.environment,{...D.policyOptions,cwd:O.context.configCwd})),pt=mt.policy,ht=B.getModes(pt,D.environment.env),gt={level:ht.effectiveLevel,...dP(mt)},yt=pt.secretProtection.enabled===!1?null:ur("secret-protection",ee,()=>B.findSensitiveTarget(he,pt.secretProtection,D.environment,lt,{strict:oi(O)||je?.program.dialect==="powershell"?ht.strict:void 0}));if(yt){let Et=ee??yt.target;return{stage:"secret-protection",...gt,decision:{kind:"deny",reason:Wp,intent:"hard_stop",ruleId:yt.ruleId,evidence:{command:Et,segment:yt.target}}}}if(!oi(O))return{stage:"non-command",...gt,decision:{kind:"allow"}};if(!O.command||O.command.trim()==="")return{...hc("command-validation",ee),...gt};let vt=ur("command-analysis",ee,()=>Cp(()=>B.analyzeCommand(O.command,{cwd:O.context.executionCwd,shell:O.route.shell,policySnapshot:mt,environment:D.environment,protectedGitMetadata:ct,effectiveCapabilities:ht.capabilities,strict:ht.strict,paranoidRm:ht.paranoidRm,paranoidInterpreters:ht.paranoidInterpreters,worktreeMode:ht.worktreeMode,budget:lt,...D.trace?{trace:D.trace}:{}},fP(he),he.store),O.command,D.trace));if(vt.decision)return{stage:"command-analysis",...gt,..."errorCode"in vt?{errorCode:vt.errorCode}:{},decision:vt.decision};return{stage:"command-analysis",...gt,decision:{kind:"allow"}}}function uP(O,D){let B=[...new Set(O.filter((Q)=>typeof Q==="string"&&Q!==""))].flatMap((Q)=>D.gitMetadata(Q)??[]);if(B.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(B.flatMap((Q)=>Q.entries))]),markerFiles:Object.freeze([...new Set(B.flatMap((Q)=>Q.markerFiles))]),directories:Object.freeze([...new Set(B.flatMap((Q)=>Q.directories))]),hooksDirectories:Object.freeze([...new Set(B.flatMap((Q)=>Q.hooksDirectories))])})}function dP(O){if(O.state==="ready")return{};return{configFallback:{reason:O.reason}}}function fP(O){return cn(O,"declared-command")?.program}function mP(O){try{return ne(O.input)}catch(D){let B=oi(O)?O.command:void 0;throw new p("policy-protection",hc("policy-protection",D instanceof f?void 0:B,D),D)}}function ur(O,D,B){try{return B()}catch(Q){throw new p(O,hc(O,Q instanceof f?void 0:D,Q),Q)}}function hc(O,D,B){let Q=B instanceof s||B instanceof y;return{stage:O,decision:{kind:"deny",reason:Q?Vs:te,intent:"stop_and_explain",...D?{evidence:{command:D,segment:D}}:{}}}}function oi(O){return O.route.kind==="command"}
-export{te,a,s,z,ke,Ue,k,Ze,Ge,ye,P,be,Xe,c,o,He,xe,R,L,ve,Qe,f,V,ne,ce,et,We,d,Re,r,v,i,re,n,g,le,N,tt,nt,l,ue,de,rt,A,q,oe,S,ot,F,b,Se,M,u,K,Be,ze,I,w,T,pe,fe,Le,it,m,e,Te,we,Ve,qe,ie,Ce,se,_e,J,j,Pe,me,U,Ke,G,Y,Z,ae,Je,Ye,C,H,Ae,Ie,Oe,De,E,Ne,Ee,Fe,h,t,X,ge,y,x,_,st,Me,$e,p,W};