cc-safety-net 2.4.5 → 2.4.6

package/dist/openclaw/cc-safety-net/index.js

@@ -1,48 +1,48 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.4.5
-var al={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Ci="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",$e="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",_n="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var yi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Rn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...yi},processedCandidateBytes:{cap:4194304,...yi},pathEnvironmentExpansion:{cap:64,...yi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Rn},trackedHeredocFiles:{cap:64,...Rn},controlFlowStates:{cap:64,...Rn},wrapperPeelIterations:{cap:20,...Rn},derivedCommandShape:Rn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function ye(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var pp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function st(e){return gp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function gp(e){return pp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var hp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function yp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,hp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+// version: 2.4.6
+var pl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Ci="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",He="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",_n="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var yi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Rn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...yi},processedCandidateBytes:{cap:4194304,...yi},pathEnvironmentExpansion:{cap:64,...yi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Rn},trackedHeredocFiles:{cap:64,...Rn},controlFlowStates:{cap:64,...Rn},wrapperPeelIterations:{cap:20,...Rn},derivedCommandShape:Rn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function Ce(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var Rp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function at(e){return _p(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function _p(e){return Rp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var wp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Ap(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":wp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function ll(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function wn(e={}){return{reason:_n,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function cl(e){return yp({...e,redact:st})}function ul(e){return st(e instanceof Error?e.message:String(e))}import{isAbsolute as Ol,relative as jp,resolve as Vp,sep as Kp}from"node:path";import{basename as fl,dirname as Cp,isAbsolute as bp,join as Sp,normalize as vp,resolve as dl}from"node:path";var Ep=256,_r=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function at(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ei(e,t){return bi(e,0,t)}function bi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Si(e,o+2),a=xp(e,o,t);if(a===null){if(_r.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Rp(l,t,n),o=a+1;continue}let i=Si(e,o+1);if(!i){r+="$",o++;continue}r+=vi(i,n)??`$${i}`,o+=i.length+1}return r}function xp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Rp(e,t,n){let r=e.slice(2,-1),o=Si(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return vi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(_r.has(o))throw new N("pathEnvironmentExpansion");return e}if(!_r.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=vi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":bi(i.slice(s.length),t+1,n);return l?bi(i.slice(s.length),t+1,n):""}function Si(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function vi(e,t){if(!_r.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function F(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){pl(n,i);let s=t.realpath(i);if(s!==null)return ml(n,e,s,o);let a=Cp(i);if(a===i||o.length>=Ep)return ml(n,e,i,o);o.push(fl(i)),i=a}}function ml(e,t,n,r){let o=r.length===0?n:Sp(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function _p(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;pl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function pl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=hl(e,t,n);if(!o)return"";return F(o,n.paths,r).replace(/\\/g,"/")}function gl(e,t,n,r,o){let i=hl(e,t,n);if(!i)return null;if(o(fl(i)))return F(i,n.paths,r).replace(/\\/g,"/");let s=_p(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function hl(e,t,n){let r=n.home,o=Ei(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?dl(r,o.slice(2)):o,s=Ce(i);return vp(bp(s)?s:dl(t,s))}import{types as wp}from"node:util";var Pp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Ap=new Set(["command","diff","input","patch","patchtext"]),yl=new TextEncoder,Tp=new TextDecoder,Ip=/\s/,kp=64;class Ve extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Pn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Op(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Pr(e){return Pp.has(Op(e))}function Tn(e){if(!e||typeof e!=="object")return;Al(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ue();return}if(t.get||t.set)Ue();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function El(e,t){return xl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function xl(e,t,n,r){let o=Pl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=xl(a,t,n,r+1);return typeof a==="string"&&t.has(Rl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Rl(e){return e.replace(/-/g,"_").toLowerCase()}function _l(e){return wl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Np)}function wl(e,t,n,r){let o=Pl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>wl(a,o.array?t:Ap.has(Rl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Mp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Pn.maxDepth||t.nodes>Pn.maxNodes)Ue();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Pn.maxStringBytes||t.stringBytes>Pn.maxAggregateStringBytes)Ue()}function Pl(e,t,n){if(Mp(e,t,n),!e||typeof e!=="object")return null;let r=Al(e);if(t.ancestors.has(e))Ue();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Pn.maxKeys)Ue();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ue();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Al(e){if(wp.isProxy(e))Ue();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ue();return t}function Ue(){throw new Ve}function Np(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Dp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...xi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...xi(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(..._i(wr(c.slice(4),!0),wr(u.slice(4),!0))),l++;continue}if(!r)t.push(...xi(c))}return t}function Dp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function xi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return vl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return vl(n[1]);if(e.startsWith("diff --git "))return Lp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Sl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Sl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Up(i[1]);return[]}function Lp(e){let t=Wp(e);if(t.length===2&&t[0]&&t[1])return _i(t[0],t[1]);let n=Gp(e);return n?_i(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Wp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(xt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!xt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Tl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(xt(e[n]))n++;return n===e.length?t:[]}function Gp(e){let t=0;while(t<e.length&&xt(e[t]))t++;let n=e.length;while(n>t&&xt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!xt(e[o])){o++;continue}let i=o;while(o<n&&xt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>kp)Ue();if(Fp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Fp(e,t,n,r,o){if(Ri(e,t,n,r,o))return!0;let i=Cl(e,"/",t,n),s=Cl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ri(e,t,i,r,s))return!1;return Ri(e,i+1,n,s+1,o)}function Ri(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Cl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function xt(e){return e!==void 0&&Ip.test(e)}function Tl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Tp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...yl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...yl.encode(zp(s[0]??""))),o+=2}return null}function zp(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function Bp(e){return An(Hp(e))}function _i(e,t){if(e==="/dev/null")return bl(t);if(t==="/dev/null")return bl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(An);let n=$p(e,t)??(e===t?Il(e):null);return[e,t,...n?[n]:[]].flatMap(An)}function bl(e){let t=Il(e);return[e,...t?[t]:[]].flatMap(An)}function Il(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function $p(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Sl(e){return Bp(wr(e,!0))}function Up(e){return An(wr(e,!1))}function wr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Tl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Hp(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function An(e){return e===""||e==="/dev/null"?[]:[e]}function vl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function wi(e,t,n){if(at(e))return;let r=t.flatMap((i)=>kl(i,n));if(!r[0])return;let o=kl(Ol(e)?e:Vp(r[0],e),n)[0];if(!o)return;return r.some((i)=>qp(o,i))?o:void 0}function kl(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function qp(e,t){let n=jp(t,e);return n===""||n!==".."&&!n.startsWith(`..${Kp}`)&&!Ol(n)}function In(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Eg,realpathSync as xg,statSync as Rg}from"node:fs";import{homedir as _g,tmpdir as wg}from"node:os";import{statSync as bg}from"node:fs";import{join as Sg}from"node:path";import{spawnSync as Yp}from"node:child_process";import{existsSync as On,lstatSync as Zp,readFileSync as Mn,realpathSync as Yt,statSync as kn}from"node:fs";import{dirname as Pi,isAbsolute as Ai,join as Zt,resolve as Ar}from"node:path";var Xp=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Jp=5000;function Nl(e,t=gg(),n=Jp){let r=Qp(e),o=r===null?null:eg(r);if(r===null||o===null)return null;let i=fg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Qp(e){try{let t=Yt(Ar(e));return kn(t).isDirectory()?t:null}catch{return null}}function eg(e){let t=mg(e);if(!t)return null;try{let n=Zp(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Ti(t);if(!r?.commonDir)return null;if(!rg(r.gitDir,t))return null;return og(r.gitDir,Pi(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Ti(e){try{let t=tg(e);if(!t)return null;let n=Yt(Ai(t)?t:Ar(Pi(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:ng(n)}}catch{return null}}function tg(e){let t=Mn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function ng(e){try{let t=Mn(Zt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Yt(Ai(t)?t:Ar(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function rg(e,t){let n=ig(e);return n===null?!1:Dl(e,n,t)}function og(e,t){let n=sg(e);return n===null?!0:Dl(e,n,t)}function ig(e){let t=Zt(e,"gitdir");if(!On(t))return null;let n=Mn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function sg(e){let t=Zt(e,"config.worktree");return On(t)?lg(t):null}function Dl(e,t,n){try{return ag(Ai(t)?t:Ar(e,t),n)}catch{return!1}}function ag(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Ml(Yt.native(e))===Ml(Yt.native(t))}function Ml(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function lg(e){let t=Mn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=cg(s[1]??"")}return r}function cg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return dg(t.slice(1,-1))}var ug={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function dg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:ug[n]??t)}function mg(e){try{return Ii(Yt(e))}catch{return null}}function Ii(e){let t=e;while(!0){let n=Zt(t,".git");if(On(n))return n;let r=Pi(t);if(r===t)return null;t=r}}function fg(e,t,n,r){if(pg(t))return!0;if(n===null)return!0;let o=Yp(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:hg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Ll(o.stdout.trim())}function pg(e){return[Zt(e.commonDir,"config"),Zt(e.gitDir,"config.worktree")].filter((t)=>On(t)).some((t)=>yg(t))}function gg(){return Xp.find((e)=>On(e))??null}function Nn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function hg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Nn(t)))}function yg(e){let t;try{t=Mn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Cg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Ll(c)}return r}function Cg(e){return e==="include"||e.startsWith("includeif ")}function Ll(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Wl(e,t){if(e==="")return null;let n=ye(),r=Ii(se(e,e,t,n)),o=r?vg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function vg(e,t,n,r){try{let o=se(e,t,n,r),i=bg(e),s=i.isFile()?o:null,a=i.isFile()?Ti(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Xt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Xt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Xt(o),markerFile:s?Xt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=Xt(Sg(u,"hooks").replace(/\\/g,"/"));return[m,Xt(se(m,t,n,r))]}))]}}catch{return null}}function Xt(e){return process.platform==="win32"?e.toLowerCase():e}var Pg={realpath:(e)=>{try{return xg(e)}catch{return null}},entryKind:(e)=>{let t=Eg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Rg(e).isDirectory()}catch{return!1}}};function Fl(){return Ag({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ce(process.env.HOME||_g()),tmpdir:wg(),paths:Pg})}function Ag(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Gl(n,i,()=>Wl(i,o)),worktreeFacts:(i)=>Gl(r,i,()=>Nl(i)),...t};return o}function Gl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Jt=["fail_closed","paranoid_rm","paranoid_interpreters"],Tr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Ir=["standard","strict","paranoid"];function Tg(e,t){if(!t)return e;return Ir.indexOf(t)>Ir.indexOf(e)?t:e}function Ig(e){let t=Ni(Q.level,e);if(t===void 0||t==="")return;if(Ir.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Ir.join(", ")}.`);return}function kg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function zl(e){return kg(Ni(Q.auditScope,e))==="all"}function Oi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Mi(e={},t){let n=e.safety?.level??"standard",r=Ig(t),o=Tg(n,r),i=Tr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Rt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(Rt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(Rt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(Rt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Rt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Oi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Rt(e,t){let n=typeof e==="string"?ki(e,t):Ni(e,t);return n==="1"||n?.toLowerCase()==="true"}function ki(e,t){return t.get(e)}function Ni(e,t){let n=ki(e.name,t);if(n!==void 0)return n;if(e.legacyName)return ki(e.legacyName,t);return}import{dirname as Fr}from"node:path";import{closeSync as Og,constants as Bl,fstatSync as Mg,fsyncSync as eA,lstatSync as Wi,mkdirSync as tA,openSync as Ng,readdirSync as nA,readFileSync as Dg,realpathSync as Gi,renameSync as rA,rmdirSync as oA,statSync as Lg,unlinkSync as iA,writeFileSync as sA}from"node:fs";import{isAbsolute as $l,join as Fi,normalize as Wg,parse as Li,relative as zi,resolve as Bi,sep as $i}from"node:path";function Di(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Gg=Symbol("PolicyFilesystemScope"),Fg=Symbol("PolicyFilesystemTarget"),zg=Bl.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function _t(e,t){return{[Gg]:!0,root:Bi(e),label:t}}function Ul(e,t){let n=Wg(t);if(t===""||$l(t)||n===".."||n.startsWith(`..${$i}`))throw new ae(e.label);return{[Fg]:!0,scope:e,relativePath:n,path:Fi(e.root,n)}}function Dn(e,t){return Ul(e,zi(e.root,Bi(t)))}function Hl(e,t="rules policy"){let n=Bi(e),r=Li(n).dir;return Ul(_t(r,t),zi(r,n))}function Or(e){return Vl(e.scope.label,()=>{if(!kr(e))return null;let t=Ng(e.path,Bl.O_RDONLY|zg);return Bg(t,()=>{let n=Mg(t);if(!n.isFile())throw new ae(e.scope.label);let r=Dg(t,"utf-8"),o=Wi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return kr(e),r})})}function jl(e,t){if(e.path===t.path)return!0;return Vl(e.scope.label,()=>{if(!kr(e)||!kr(t))return!1;let n=(r)=>Fi(Gi(Li(r).dir),Li(r).base);return n(e.path)===n(t.path)})}function Vl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function Bg(e,t){try{return t()}finally{Og(e)}}function kr(e,t="file"){let n=$g(e.scope);if(!n)return!1;let r=e.relativePath.split($i);for(let o of r.keys()){let i=Fi(e.scope.root,...r.slice(0,o+1)),s=Wi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);Ug(n,Gi(i),e.scope.label)}return!0}function $g(e){if(!Wi(e.root,{throwIfNoEntry:!1}))return null;if(!Lg(e.root).isDirectory())throw new ae(e.label);return Gi(e.root)}function Ug(e,t,n){let r=zi(e,t);if(r===".."||r.startsWith(`..${$i}`)||$l(r))throw new ae(n)}import{dirname as Pt,isAbsolute as qg,join as Tt,relative as Yg,resolve as At,sep as Zg}from"node:path";var wt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Kl="rulebook.json",ql=".cc-safety-net/rules";var Yl=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Hg=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,jg=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Vg="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),uA=new RegExp(`^${jg}/(${wt.source.slice(1,-1)})/${Vg}$`);function Kg(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Zl(e){if(Mr(e))try{return Ui(e),null}catch(t){return t instanceof Error?t.message:String(t)}return wt.test(e)?null:`Local rulebook sources must be bare names matching ${wt}: ${e}`}function Ui(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Yl);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Hg.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!wt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Kg(o),name:o}}function Mr(e){return Yl.test(e)}var Xl="rule.json",Nr="policy.json",Jl=".cc-safety-net",Xg="rules",Jg="CC_SAFETY_NET_HOME",Ql="`cc-safety-net rule update`";function Qg(e){return At(e,ql)}function eh(e){return Tt(Qg(e),Xl)}function Ln(e){return Tt(At(e),Jl,Nr)}function Hi(e,t={}){return t.userConfigDir??(t.userConfigPath?Pt(t.userConfigPath):Tt(th(e),Xg))}function th(e){let t=e.env.get(Jg);return t?At(Ce(t)):Tt(e.home,Jl)}function nh(e,t={}){return Tt(Hi(e,t),Xl)}function Qt(e,t={}){return Tt(Pt(Hi(e,t)),Nr)}function ec(e,t){let n=t.userConfigPath??nh(e,t),r=t.projectConfigPath??eh(t.cwd),o=rh(e,t),i=oh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Dn(o,n),projectConfigTarget:Dn(i,r)}}function rh(e,t){let n=t.userConfigPath?Pt(Pt(At(t.userConfigPath))):Pt(At(t.userConfigDir??Hi(e,t)));return _t(n,"user policy")}function oh(e,t){let n=At(t),r=At(e),o=Yg(n,r);if(o!==".."&&!o.startsWith(`..${Zg}`)&&!qg(o))return _t(n,"project policy");return _t(Pt(Pt(r)),"project policy")}function tc(e,t){return Tt(e,t,Kl)}var be=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),lt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ct=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),nc=new Set(["python","python3","python2","node","ruby","perl"]),Dr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Lr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var rc="Rulebook exceeds CC Safety Net's safe validation limits.",oc="Additional rulebook validation errors were omitted.",ke=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function ic(e){if(ji(e.allowed_commands,ke.maxAllowedCommands)||ji(e.rules,ke.maxRules)||ji(e.tests,ke.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=ke,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>ke.maxStringCodeUnits||i&&o.length>ke.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>ke.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function ji(e,t){return Array.isArray(e)&&e.length>t}var Vi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ki=64,qi="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var ih={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Yi=new Set(["--init-file","--rcfile"]);function Zi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!ih[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Se(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Yi.has(l)&&!s.includes("="))i++;continue}let a=Zi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Wn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Wr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of sh(e))Wn(n,t);return t.inSingle||t.inDouble}function sh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Wn(s,n)}return t}var Xi=new Set(["rm","find","xargs","parallel"]),ah=new Set(["git","busybox",...Xi,...J,...nc,...we]),lh=new Set(["python","node","ruby","perl"]);function sc(e){let t=M(e);return ah.has(t)||Oe(t)}function Oe(e){return lh.has(ch(e))}function ch(e){let t=k(e).toLowerCase();return Dr.test(t)?"python":t}function Ji(e){try{let t=Or(uh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=fh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function uh(e){return typeof e==="string"?Hl(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function ac(e){let t=new Set;return e.flatMap((n,r)=>{let o=en(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Qi=`must be one of ${Vi.join(", ")}`,dh=/^[^/]+\/[^/]+$/,mh=["version","rules","overrides","transparent_wrappers"];function fh(e){let t=ph(e);return{errors:es(xh(t,mh,(n)=>n.kind==="custom"),": "," "),sources:Eh(e,t)}}function ph(e){if(!en(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Ki;return[...e.version===1?[]:[_(["version"],"must be 1")],...gh(e.rules,t),...Ch(e.overrides),...Sh(e.transparent_wrappers),...t?[]:yh(e.rules),...en(e.overrides)?Object.keys(e.overrides).filter((n)=>!dh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...vh(e.transparent_wrappers)]}function gh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...lc(e,Ki)?[_(["rules"],qi)]:[]];if(t)return[{path:["rules"],message:qi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...hh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function lc(e,t){let n=cc(e);return n!==void 0&&!(n<=t)}function hh(e,t){let n=cc(e);return n!==void 0&&!(n>=t)}function cc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function yh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=Zl(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Ch(e){if(e===void 0)return[];if(!en(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!en(n))return[_(["overrides",t],'must be "off" or an object')];return[...bh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||ns(n.intent)?[]:[_(["overrides",t,"intent"],Qi)]]})}function bh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...lc(e,ct)?[_(t,`must be at most ${ct} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ct?[_(t,`must be at most ${ct} characters`)]:[]}function Sh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return lt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function vh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(sc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Eh(e,t){let n=en(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function xh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function es(e,t,n){return[...new Set(e.map((r)=>{let o=ts(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ts(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function ns(e){return Vi.includes(e)}function en(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function dc(e){let t=wh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Rh=`required non-empty string up to ${ct} characters`,uc="must be a non-empty array of unique non-empty strings",_h="required non-empty array of non-empty strings";function wh(e){if(!ut(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!ic(e))return{errors:[rc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...es(Ph(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>ke.maxValidationErrors?[...t.slice(0,ke.maxValidationErrors),oc]:t,ruleNames:new Set(mc(e).map((n)=>n.toLowerCase()))}}function mc(e){let t=ut(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ut(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Ph(e,t){return[...typeof e.name==="string"&&wt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Ah(e.allowed_commands),...Th(e.rules,t),...Mh(e.tests),...Nh(e),...Dh(e)]}function Ah(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&lt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Th(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!ut(n))return[_(["rules",r],"must be an object")];return t?kh(n,["rules",r]):Ih(n,["rules",r])}),...ac(e)]}function Ih(e,t){return[...fc(e.name,t),...pc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&lt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Gr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...gc(e.reason,t),...hc(e.intent,t)]}function kh(e,t){return[...fc(e.name,t),...pc(e.command,t),...gc(e.reason,t),...hc(e.intent,t),...Oh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function fc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return wt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function pc(e,t){return typeof e==="string"&&lt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function gc(e,t){return typeof e==="string"&&e!==""&&e.length<=ct?[]:[_([...t,"reason"],Rh)]}function hc(e,t){return e===void 0||ns(e)?[]:[_([...t,"intent"],Qi)]}function Oh(e,t){if(!ut(e))return[_(t,"required object")];return[...Gr(e.command_path,[...t,"command_path"],_h,!1),...e.any_args===void 0?[]:Gr(e.any_args,[...t,"any_args"],uc,!0),...e.exclude_args===void 0?[]:Gr(e.exclude_args,[...t,"exclude_args"],uc,!0)]}function Gr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Mh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!ut(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Nh(e){if(!Array.isArray(e.tests))return[];let t=new Set(mc(e));return[...new Set(e.tests.flatMap((n)=>ut(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function Dh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=ut(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function ut(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ec(e,t){let n=ec(e,t),r=!1;try{r=jl(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ae)return Hh(n,f.message);throw f}let o=Ji(n.userConfigTarget),i=r?{config:null,errors:[]}:Ji(n.projectConfigTarget),s=Sc(n.userConfigPath,o.errors),a=Sc(n.projectConfigPath,i.errors),l=new Set,c=o.config?yc(o.config,Fr(n.userConfigPath),"user",n.userScope,l):vc(),u=i.config?yc(i.config,Fr(n.projectConfigPath),"project",n.projectScope,l):vc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Cc(c.rules,m),...Cc(u.rules,d)],transparent_wrappers:$h(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?bc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Uh(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?bc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function yc(e,t,n,r=_t(Fr(Fr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Wh(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:Lh(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Lh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Wh(e,t,n){let r=Gh(e),o=tc(t,r),i=zh(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Fh(e)}`]};let s=Bh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Gh(e){return Mr(e)?Ui(e).name:e}function Fh(e){return Mr(e)?`run ${Ql} to vendor ${e}`:"create that file or remove that source from the rules config"}function zh(e,t){try{return{content:Or(Dn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function Bh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:dc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function $h(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Cc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function bc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Uh(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Sc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Hh(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function vc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as ry,readFileSync as oy}from"node:fs";var xc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],rs=new Set(xc.map((e)=>e.id)),zr=xc,jh=new Map(zr.map((e)=>[e.id,e.intent]));function b(e,t){return{id:e,reason:t,intent:jh.get(e)??"manual_only"}}var os=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Br={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Vh=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Kh=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],is=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Kh.flatMap((e)=>Vh.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var $r=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Rc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],qh=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ss=Rc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),as=Rc.flatMap((e)=>qh.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Gn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ls=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),cs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Yh=[...os,Br,...is,...ss,...as,Gn,...ls,...cs,...$r].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Ur=new Set($r.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),us=new Set(Yh.map((e)=>e.id));import{isAbsolute as ds,join as Zh,normalize as Xh,sep as Hr}from"node:path";var _c=process.platform==="win32",Jh=/[*?]/;function Fn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ms(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Fn(e.trim(),t);if(!ds(n))return"must be an absolute path or start with ~/";return zn(n,t)}function fs(e,t){let n=wc(e,t);if(n===null)return"must be a non-empty path string";if(!ds(n))return null;if(zn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Qh="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",ey="cannot cover the guard's own configuration";function wc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Fn(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ps(e,t){let n=wc(e,t);if(n===null)return"must be a non-empty path string";if(Jh.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!ds(n))return null;if(zn(n,t)!==null)return Qh;return ty(n,t)?ey:null}function ty(e,t){let n=jr(e),r=jr(Zh(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Hr}`)}function zn(e,t){let n=jr(e),r=jr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Hr)?n:`${n}${Hr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function jr(e){let t=Xh(e);if(_c)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(_c?3:1)&&t.endsWith(Hr))t=t.slice(0,-1);return t}var Pc=30,Vr=1,Kr=365;function Ac(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Tc=new Set(zr.filter((e)=>e.catastrophic).map((e)=>e.id));function A(e,t){if(!e)return null;if(Tc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Tc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Ic(e,t){return Object.freeze(Object.fromEntries(zr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function kc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Ic(e,t)})}var Oc={standard:0,strict:1,paranoid:2};function Dc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:gs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:gs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:gs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:ny(e,t)}}function gs(e,t){return[...new Set([...e,...t??[]])]}function ny(e,t){let n=t.safety?.level,r=Tr[e.safety.level];return[...n&&Oc[n]<Oc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Jt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Mc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Mc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Ur.has(o))),...e.destructive_command_protection.enabled?Nc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Nc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Mc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Nc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Cs=new Set(["standard","strict","paranoid"]),Fc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Pc}};function zc(e,t){let n=py(Qt(e,t),e.home),r=Zr(Ln(t.cwd),e.home),o=sy(r.parsed,e.home),i=Object.keys(o.policy).length>0?Dc(n.gui??Fc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ys(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var iy="project policy audit settings are ignored; audit is user scope only";function sy(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...Cs.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Lc({overrides:Bc(n.overrides,Jt,["safety","overrides"],It)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Yr(o.overrides,rs,Uc,It)}:{},...o.allow_paths!==void 0?{allow_paths:nn(o.allow_paths,ms,t,["destructive_command_protection","allow_paths"],It)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Yr(i.overrides,us,Hc,It)}:{},...i.deny_paths!==void 0?{deny_paths:nn(i.deny_paths,fs,t,["secret_protection","deny_paths"],It)}:{},...i.allow_paths!==void 0?{allow_paths:nn(i.allow_paths,ps,t,["secret_protection","allow_paths"],It)}:{}};return{policy:Lc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[iy]}}function Bc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],bs));return[]}))}function Lc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var It=()=>{return},bs="must be a boolean",Ss="must be an object if provided",$c=`must be an integer between ${Vr} and ${Kr}`,Uc={path:["destructive_command_protection","overrides"],label:"destructive command"},Hc={path:["secret_protection","overrides"],label:"secret protection"},ay=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function ly(e,t){let n=[];return{policy:jc(e,t,(o)=>{n.push(o)}),issues:n}}function cy(e,t){return jc(e,t,It)}function jc(e,t,n){if(!ve(e))return n(_([],"Config must be an object")),qr();if(e.version!==1)n(_(["version"],"must be 1"));let r=tn(e.safety,["safety"],["level","overrides"],n),o=tn(r.overrides,["safety","overrides"],Jt,n),i=tn(e.workflow,["workflow"],["worktree_mode"],n),s=tn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=tn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=tn(e.audit,["audit"],["retention_days"],n);return Vc(e,ay,[],n),{version:1,safety:{level:uy(r.level,n),overrides:Bc(o,Jt,["safety","overrides"],n)},workflow:{worktree_mode:hs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:hs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Yr(s.overrides,rs,Uc,n),allow_paths:nn(s.allow_paths,ms,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:hs(a.enabled,["secret_protection","enabled"],!0,n),overrides:Yr(a.overrides,us,Hc,n),deny_paths:nn(a.deny_paths,fs,t,["secret_protection","deny_paths"],n),allow_paths:nn(a.allow_paths,ps,t,["secret_protection","allow_paths"],n)},audit:{retention_days:dy(l.retention_days,n)}}}function tn(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(t,Ss)),{};return Vc(e,n,t,r),e}function Vc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function uy(e,t){if(e===void 0)return"standard";if(Cs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function hs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,bs));return n}function dy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Vr&&e<=Kr))t(_(["audit","retention_days"],$c));return Ac(e)}function Yr(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(n.path,Ss)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function nn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function qr(){return structuredClone(Fc)}function Zr(e,t){if(!ry(e))return{exists:!1,policy:qr(),errors:[]};try{let n=oy(e,"utf-8");if(!n.trim())return{exists:!0,policy:qr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=ly(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${fy(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:qr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var my=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ss,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[bs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[$c,`not an integer between ${Vr} and ${Kr}`]]);function fy(e){let t=ts(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=my.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function py(e,t){let n=Zr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:Gc(),errors:[]};let o=cy(r,t);return{policy:ys(o),gui:o,errors:[],levelPresent:Wc(r)}}if(n.parsed===void 0)return{policy:Gc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ys(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Wc(n.parsed)}}function Wc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return Cs.has(t.level)}function Kc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Ur].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Gc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Kc({}),denyPaths:[],allowPaths:[]}}}function ys(e){return{safety:gy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Kc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function gy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function qc(e,t){let n=Ec(e,t),r=zc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...by(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Sy(o,hy(n,r),s,r.policyScopes)}function hy(e,t){let n=Cy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:vy(e.errors.length>0?yy(e.errors):void 0,e.warnings.length>0?Es(e.warnings.join("; ")):void 0,n)}}function yy(e){return`${Es(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Cy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function by(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Sy(e,t,n=Object.freeze({}),r){let o=vs(structuredClone(e)),i=r?{policyScopes:vs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function vs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))vs(t);return Object.freeze(e)}function vy(...e){return Es(e.filter((t)=>!!t).join("; "))}function Es(e){return/[.!?]$/.test(e)?e:`${e}.`}function Yc(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:xs(t.fail_closed,e.strict,"strict"),paranoid_rm:xs(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:xs(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:kc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Oi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function xs(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Bn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Ey=/^[A-Za-z_][A-Za-z0-9_]*=/;function Xr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function $n(e){let t=Xr(e.words[0],"time")?1:0,n=t===1&&Xr(e.words[t],"-p")?t+1:t,r=t===1&&Xr(e.words[n],"--")?n+1:n,o=Xr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Ey.test(s.text));return i?.provenance==="literal"?i.text:void 0}var dt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Jr(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function xy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>me(t)))})}function Qr(e,t,n){e.push(n),t.reset()}function eo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Rs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function rn(e,t,n,r,o,i,s){return Rs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function me(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return xy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:me(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function _s(e,t,n){if(t>=n||Xc(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Xc(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Zc(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Zc(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function ws(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Ry(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?_y(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Zc(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Xc(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Ry(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function _y(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var tu=new Set(["&&","||","|","|&"]);function nu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=ro(e,0,e.length,t,{used:0,max:t.maxWords},0);return me({kind:"program",dialect:"posix",source:e,span:n,status:so(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function ro(e,t,n,r,o,i,s){let a=[],l=[],c=Jr(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((h)=>h.text);Qr(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),eu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(io(f)){if(f===`
-`||f==="\r"){m();let S=f==="\r"&&e[d+1]===`
-`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!tu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,S),span:Object.freeze({start:d,end:S})}));if(u.length>0){let x=ws(e,S,n,u.splice(0));l.push(...x.issues),d=x.next;continue}d=S;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
-`&&e[d]!=="\r")d++;continue}let p=c.start===-1?Vy(e,d,n):void 0;if(p){if(As(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);if(!Ps(o))return on(a,l,d,"word-limit",r.maxWords);let S=ro(e,p.braceIndex+1,n,r,o,i+1,"}"),T=S.next,x={start:p.braceIndex+1,end:S.closed?T-1:T},P=Jc(e,x,S);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:P}),l.push(...S.issues),S.pendingHeredocs.length>0||Hn(S.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...S.pendingHeredocs),S.limited)return no(a,l,S.next);if(!S.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let h=oo(e,d);if(h){if(m(),!uu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:d,end:d+h.length})})),d+=h.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&My(e,d,n))&&c.start===-1){if(As(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);let S=f==="("?")":"}",T=ro(e,d+1,n,r,o,i+1,S),x=T.next,P={start:d+1,end:T.closed?x-1:x},q=Jc(e,P,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:x},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Hn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return no(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=x;continue}let g=(f==="<"||f===">")&&e[d+1]!=="("?Ty(e,d):null;if(g){let S=c.words.at(-1),T=S&&S.span.end===d&&/^[0-9]+$/.test(S.raw)?Number(S.raw):void 0;if(T!==void 0)c.words.pop();let x=T===void 0?d:S?.span.start??d;c.start=c.start===-1?d:c.start;let P=d+g.length;while(P<n&&/[ \t]/.test(e[P]??""))P++;let q=e[P],Z=P>d+g.length&&q==="#",ee=!q||io(q)||!!oo(e,P)||q===s||q===")"||Z||(q==="<"||q===">")&&e[P+1]!=="(",X=g==="<<"||g==="<<-",U=X?_s(e,P,n):void 0,D=U?{word:rn(e,P,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Ts(e,P,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return no(a,l,D.next);if(!Ps(o))return on(a,l,D.next,"word-limit",r.maxWords)}let ce=D?.next??d+g.length,_e={kind:"redirection",operator:g,span:{start:x,end:ce},...T===void 0?{}:{fd:T},...D?{target:D.word}:{}};if(c.redirections.push(_e),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let je=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:g==="<<-",attach:(Ie)=>{if(_e.heredoc=Ie,Ie.quotedDelimiter)return;je.push(...Py(e,Ie.bodySpan.start,Ie.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`});if(D)c.nested.push(...D.nested);c.end=ce,d=ce;continue}if(c.start===-1)As(a,l);let y=Ts(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return no(a,l,y.next);let v=Ly(c.words)?By(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return on(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let S of E){if(!Ps(o))return on(a,l,y.next,"word-limit",r.maxWords);c.words.push(S)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return m(),eu(a,l),l.push(...Ky(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Jc(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:so(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ts(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||io(f)||(f===";"||f==="|"||f==="&")&&oo(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(f==='"'){l=!0;let g=wy(e,a,n,r,o,i);if(s+=g.text,u.push(...g.nested),m.push(...g.issues),d||=g.limited,c=Un(c,g.provenance),a=g.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Iy(e,a+2,n);if(s+=g.text,m.push(...g.issues),!g.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=g.next;continue}if(f==="\\"){let g=e[a+1];if(!g){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(g===`
-`){a+=2;continue}s+=g,a+=2;continue}let h=f==="$"||f==="<"||f===">"||f==="`"?ao(e,a,n,r,o,i):null;if(h){let g=ru(h,u,m);if(d||=g.limited,c=Un(c,g.provenance),a=g.next,d)break;continue}if(f==="$"){let g=su(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(f==="*"||f==="?"||f==="[")c=Un(c,"glob");s+=f,a++}return{word:rn(e,t,a,s,c,l,c==="literal"?void 0:Oy(e,t,a)),nested:u,issues:m,next:a,limited:d}}function wy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
-`){m+=2;continue}if(p==="\r"&&e[m+2]===`
-`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=Is(e,m+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(m,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=h;continue}let f=ao(e,m,n,r,o,i);if(f){let p=ru(f,l,c);if(m=p.next,u||=p.limited,a=Un(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=su(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function ao(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=Is(e,t+u,n,m),f=d===-1?n:d,p=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:jy(e,t+u,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],S=!1,T=t+u;while(T<f){let x=ao(e,T,f,r,o,i+1);if(!x){T++;continue}if(v.push(...x.program.nodes),E.push(...x.program.issues),S||=x.program.status==="limited",T=x.next,S)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:so(E,S),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=ro(e,t+u,f,r,o,i+1),g=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Hn(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:so([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function Py(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?ao(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function ru(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Is(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`)}function gl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.ask?{ask:!0}:{}}}function wn(e={}){return{reason:_n,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function hl(e){return Ap({...e,redact:at})}function yl(e){return at(e instanceof Error?e.message:String(e))}import{isAbsolute as Fl,relative as tg,resolve as ng,sep as rg}from"node:path";import{basename as Sl,dirname as Pp,isAbsolute as Tp,join as Ip,normalize as kp,resolve as Cl}from"node:path";var Op=256,wr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function be(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function lt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ei(e,t){return bi(e,0,t)}function bi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Si(e,o+2),a=Mp(e,o,t);if(a===null){if(wr.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Np(l,t,n),o=a+1;continue}let i=Si(e,o+1);if(!i){r+="$",o++;continue}r+=vi(i,n)??`$${i}`,o+=i.length+1}return r}function Mp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Np(e,t,n){let r=e.slice(2,-1),o=Si(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return vi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(wr.has(o))throw new N("pathEnvironmentExpansion");return e}if(!wr.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=vi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":bi(i.slice(s.length),t+1,n);return l?bi(i.slice(s.length),t+1,n):""}function Si(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function vi(e,t){if(!wr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function F(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){vl(n,i);let s=t.realpath(i);if(s!==null)return bl(n,e,s,o);let a=Pp(i);if(a===i||o.length>=Op)return bl(n,e,i,o);o.push(Sl(i)),i=a}}function bl(e,t,n,r){let o=r.length===0?n:Ip(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Dp(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;vl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function vl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=xl(e,t,n);if(!o)return"";return F(o,n.paths,r).replace(/\\/g,"/")}function El(e,t,n,r,o){let i=xl(e,t,n);if(!i)return null;if(o(Sl(i)))return F(i,n.paths,r).replace(/\\/g,"/");let s=Dp(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function xl(e,t,n){let r=n.home,o=Ei(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Cl(r,o.slice(2)):o,s=be(i);return kp(Tp(s)?s:Cl(t,s))}import{types as Lp}from"node:util";var Wp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Gp=new Set(["command","diff","input","patch","patchtext"]),Rl=new TextEncoder,Fp=new TextDecoder,zp=/\s/,Bp=64;class Ye extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var An=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function $p(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Pr(e){return Wp.has($p(e))}function Tn(e){if(!e||typeof e!=="object")return;Dl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)je();return}if(t.get||t.set)je();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Tl(e,t){return Il(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Il(e,t,n,r){let o=Nl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Il(a,t,n,r+1);return typeof a==="string"&&t.has(kl(s))?[a]:l});return n.ancestors.delete(o.object),i}function kl(e){return e.replace(/-/g,"_").toLowerCase()}function Ol(e){return Ml(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Hp)}function Ml(e,t,n,r){let o=Nl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Ml(a,o.array?t:Gp.has(kl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Up(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>An.maxDepth||t.nodes>An.maxNodes)je();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>An.maxStringBytes||t.stringBytes>An.maxAggregateStringBytes)je()}function Nl(e,t,n){if(Up(e,t,n),!e||typeof e!=="object")return null;let r=Dl(e);if(t.ancestors.has(e))je();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>An.maxKeys)je();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)je();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Dl(e){if(Lp.isProxy(e))je();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)je();return t}function je(){throw new Ye}function Hp(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=jp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...xi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...xi(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(..._i(Ar(c.slice(4),!0),Ar(u.slice(4),!0))),l++;continue}if(!r)t.push(...xi(c))}return t}function jp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function xi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Pl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Pl(n[1]);if(e.startsWith("diff --git "))return Vp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Al(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Al(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Qp(i[1]);return[]}function Vp(e){let t=Kp(e);if(t.length===2&&t[0]&&t[1])return _i(t[0],t[1]);let n=qp(e);return n?_i(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Kp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(xt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!xt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Ll(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(xt(e[n]))n++;return n===e.length?t:[]}function qp(e){let t=0;while(t<e.length&&xt(e[t]))t++;let n=e.length;while(n>t&&xt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!xt(e[o])){o++;continue}let i=o;while(o<n&&xt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Bp)je();if(Yp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Yp(e,t,n,r,o){if(Ri(e,t,n,r,o))return!0;let i=_l(e,"/",t,n),s=_l(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ri(e,t,i,r,s))return!1;return Ri(e,i+1,n,s+1,o)}function Ri(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function _l(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function xt(e){return e!==void 0&&zp.test(e)}function Ll(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Fp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Rl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Rl.encode(Zp(s[0]??""))),o+=2}return null}function Zp(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function Xp(e){return Pn(eg(e))}function _i(e,t){if(e==="/dev/null")return wl(t);if(t==="/dev/null")return wl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Pn);let n=Jp(e,t)??(e===t?Wl(e):null);return[e,t,...n?[n]:[]].flatMap(Pn)}function wl(e){let t=Wl(e);return[e,...t?[t]:[]].flatMap(Pn)}function Wl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Jp(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Al(e){return Xp(Ar(e,!0))}function Qp(e){return Pn(Ar(e,!1))}function Ar(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Ll(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function eg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Pn(e){return e===""||e==="/dev/null"?[]:[e]}function Pl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function wi(e,t,n){if(lt(e))return;let r=t.flatMap((i)=>Gl(i,n));if(!r[0])return;let o=Gl(Fl(e)?e:ng(r[0],e),n)[0];if(!o)return;return r.some((i)=>og(o,i))?o:void 0}function Gl(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function og(e,t){let n=tg(t,e);return n===""||n!==".."&&!n.startsWith(`..${rg}`)&&!Fl(n)}function In(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Og,realpathSync as Mg,statSync as Ng}from"node:fs";import{homedir as Dg,tmpdir as Lg}from"node:os";import{statSync as Tg}from"node:fs";import{join as Ig}from"node:path";import{spawnSync as ig}from"node:child_process";import{existsSync as On,lstatSync as sg,readFileSync as Mn,realpathSync as Yt,statSync as kn}from"node:fs";import{dirname as Ai,isAbsolute as Pi,join as Zt,resolve as Tr}from"node:path";var ag=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],lg=5000;function Bl(e,t=_g(),n=lg){let r=cg(e),o=r===null?null:ug(r);if(r===null||o===null)return null;let i=xg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function cg(e){try{let t=Yt(Tr(e));return kn(t).isDirectory()?t:null}catch{return null}}function ug(e){let t=Eg(e);if(!t)return null;try{let n=sg(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Ti(t);if(!r?.commonDir)return null;if(!mg(r.gitDir,t))return null;return pg(r.gitDir,Ai(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Ti(e){try{let t=dg(e);if(!t)return null;let n=Yt(Pi(t)?t:Tr(Ai(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:fg(n)}}catch{return null}}function dg(e){let t=Mn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function fg(e){try{let t=Mn(Zt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Yt(Pi(t)?t:Tr(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function mg(e,t){let n=gg(e);return n===null?!1:$l(e,n,t)}function pg(e,t){let n=hg(e);return n===null?!0:$l(e,n,t)}function gg(e){let t=Zt(e,"gitdir");if(!On(t))return null;let n=Mn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function hg(e){let t=Zt(e,"config.worktree");return On(t)?Cg(t):null}function $l(e,t,n){try{return yg(Pi(t)?t:Tr(e,t),n)}catch{return!1}}function yg(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return zl(Yt.native(e))===zl(Yt.native(t))}function zl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Cg(e){let t=Mn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=bg(s[1]??"")}return r}function bg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return vg(t.slice(1,-1))}var Sg={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function vg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:Sg[n]??t)}function Eg(e){try{return Ii(Yt(e))}catch{return null}}function Ii(e){let t=e;while(!0){let n=Zt(t,".git");if(On(n))return n;let r=Ai(t);if(r===t)return null;t=r}}function xg(e,t,n,r){if(Rg(t))return!0;if(n===null)return!0;let o=ig(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:wg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Ul(o.stdout.trim())}function Rg(e){return[Zt(e.commonDir,"config"),Zt(e.gitDir,"config.worktree")].filter((t)=>On(t)).some((t)=>Ag(t))}function _g(){return ag.find((e)=>On(e))??null}function Nn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function wg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Nn(t)))}function Ag(e){let t;try{t=Mn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Pg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Ul(c)}return r}function Pg(e){return e==="include"||e.startsWith("includeif ")}function Ul(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Hl(e,t){if(e==="")return null;let n=Ce(),r=Ii(se(e,e,t,n)),o=r?kg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function kg(e,t,n,r){try{let o=se(e,t,n,r),i=Tg(e),s=i.isFile()?o:null,a=i.isFile()?Ti(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Xt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Xt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Xt(o),markerFile:s?Xt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let f=Xt(Ig(u,"hooks").replace(/\\/g,"/"));return[f,Xt(se(f,t,n,r))]}))]}}catch{return null}}function Xt(e){return process.platform==="win32"?e.toLowerCase():e}var Wg={realpath:(e)=>{try{return Mg(e)}catch{return null}},entryKind:(e)=>{let t=Og(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Ng(e).isDirectory()}catch{return!1}}};function Vl(){return Gg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:be(process.env.HOME||Dg()),tmpdir:Lg(),paths:Wg})}function Gg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>jl(n,i,()=>Hl(i,o)),worktreeFacts:(i)=>jl(r,i,()=>Bl(i)),...t};return o}function jl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Jt=["fail_closed","paranoid_rm","paranoid_interpreters"],Ir={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},kr=["standard","strict","paranoid"];function Fg(e,t){if(!t)return e;return kr.indexOf(t)>kr.indexOf(e)?t:e}function zg(e){let t=Ni(Q.level,e);if(t===void 0||t==="")return;if(kr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${kr.join(", ")}.`);return}function Bg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Kl(e){return Bg(Ni(Q.auditScope,e))==="all"}function Oi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Mi(e={},t){let n=e.safety?.level??"standard",r=zg(t),o=Fg(n,r),i=Ir[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Rt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(Rt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(Rt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(Rt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Rt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Oi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Rt(e,t){let n=typeof e==="string"?ki(e,t):Ni(e,t);return n==="1"||n?.toLowerCase()==="true"}function ki(e,t){return t.get(e)}function Ni(e,t){let n=ki(e.name,t);if(n!==void 0)return n;if(e.legacyName)return ki(e.legacyName,t);return}import{dirname as zr}from"node:path";import{closeSync as $g,constants as ql,fstatSync as Ug,fsyncSync as fP,lstatSync as Wi,mkdirSync as mP,openSync as Hg,readdirSync as pP,readFileSync as jg,realpathSync as Gi,renameSync as gP,rmdirSync as hP,statSync as Vg,unlinkSync as yP,writeFileSync as CP}from"node:fs";import{isAbsolute as Yl,join as Fi,normalize as Kg,parse as Li,relative as zi,resolve as Bi,sep as $i}from"node:path";function Di(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var qg=Symbol("PolicyFilesystemScope"),Yg=Symbol("PolicyFilesystemTarget"),Zg=ql.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function _t(e,t){return{[qg]:!0,root:Bi(e),label:t}}function Zl(e,t){let n=Kg(t);if(t===""||Yl(t)||n===".."||n.startsWith(`..${$i}`))throw new ae(e.label);return{[Yg]:!0,scope:e,relativePath:n,path:Fi(e.root,n)}}function Dn(e,t){return Zl(e,zi(e.root,Bi(t)))}function Xl(e,t="rules policy"){let n=Bi(e),r=Li(n).dir;return Zl(_t(r,t),zi(r,n))}function Mr(e){return Ql(e.scope.label,()=>{if(!Or(e))return null;let t=Hg(e.path,ql.O_RDONLY|Zg);return Xg(t,()=>{let n=Ug(t);if(!n.isFile())throw new ae(e.scope.label);let r=jg(t,"utf-8"),o=Wi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return Or(e),r})})}function Jl(e,t){if(e.path===t.path)return!0;return Ql(e.scope.label,()=>{if(!Or(e)||!Or(t))return!1;let n=(r)=>Fi(Gi(Li(r).dir),Li(r).base);return n(e.path)===n(t.path)})}function Ql(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function Xg(e,t){try{return t()}finally{$g(e)}}function Or(e,t="file"){let n=Jg(e.scope);if(!n)return!1;let r=e.relativePath.split($i);for(let o of r.keys()){let i=Fi(e.scope.root,...r.slice(0,o+1)),s=Wi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);Qg(n,Gi(i),e.scope.label)}return!0}function Jg(e){if(!Wi(e.root,{throwIfNoEntry:!1}))return null;if(!Vg(e.root).isDirectory())throw new ae(e.label);return Gi(e.root)}function Qg(e,t,n){let r=zi(e,t);if(r===".."||r.startsWith(`..${$i}`)||Yl(r))throw new ae(n)}import{dirname as At,isAbsolute as oh,join as Tt,relative as ih,resolve as Pt,sep as sh}from"node:path";var wt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,ec="rulebook.json",tc=".cc-safety-net/rules";var nc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var eh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,th=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),nh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),EP=new RegExp(`^${th}/(${wt.source.slice(1,-1)})/${nh}$`);function rh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function rc(e){if(Nr(e))try{return Ui(e),null}catch(t){return t instanceof Error?t.message:String(t)}return wt.test(e)?null:`Local rulebook sources must be bare names matching ${wt}: ${e}`}function Ui(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(nc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!eh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!wt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:rh(o),name:o}}function Nr(e){return nc.test(e)}var oc="rule.json",Dr="policy.json",ic=".cc-safety-net",ah="rules",lh="CC_SAFETY_NET_HOME",sc="`cc-safety-net rule update`";function ch(e){return Pt(e,tc)}function uh(e){return Tt(ch(e),oc)}function Ln(e){return Tt(Pt(e),ic,Dr)}function Hi(e,t={}){return t.userConfigDir??(t.userConfigPath?At(t.userConfigPath):Tt(dh(e),ah))}function dh(e){let t=e.env.get(lh);return t?Pt(be(t)):Tt(e.home,ic)}function fh(e,t={}){return Tt(Hi(e,t),oc)}function Qt(e,t={}){return Tt(At(Hi(e,t)),Dr)}function ac(e,t){let n=t.userConfigPath??fh(e,t),r=t.projectConfigPath??uh(t.cwd),o=mh(e,t),i=ph(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Dn(o,n),projectConfigTarget:Dn(i,r)}}function mh(e,t){let n=t.userConfigPath?At(At(Pt(t.userConfigPath))):At(Pt(t.userConfigDir??Hi(e,t)));return _t(n,"user policy")}function ph(e,t){let n=Pt(t),r=Pt(e),o=ih(n,r);if(o!==".."&&!o.startsWith(`..${sh}`)&&!oh(o))return _t(n,"project policy");return _t(At(At(r)),"project policy")}function lc(e,t){return Tt(e,t,ec)}var Se=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ct=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ut=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),cc=new Set(["python","python3","python2","node","ruby","perl"]),Lr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Wr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var uc="Rulebook exceeds CC Safety Net's safe validation limits.",dc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function fc(e){if(ji(e.allowed_commands,Oe.maxAllowedCommands)||ji(e.rules,Oe.maxRules)||ji(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function ji(e,t){return Array.isArray(e)&&e.length>t}var Vi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ki=64,qi="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function fe(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var gh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Yi=new Set(["--init-file","--rcfile"]);function Zi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let f=t.slice(c+1);if(t[0]==="-"&&(f==="c"||f[0]==="-"&&f.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!gh[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function ve(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Yi.has(l)&&!s.includes("="))i++;continue}let a=Zi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Wn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Gr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of hh(e))Wn(n,t);return t.inSingle||t.inDouble}function hh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Wn(s,n)}return t}var Xi=new Set(["rm","find","xargs","parallel"]),yh=new Set(["git","busybox",...Xi,...J,...cc,...we]),Ch=new Set(["python","node","ruby","perl"]);function mc(e){let t=M(e);return yh.has(t)||Me(t)}function Me(e){return Ch.has(bh(e))}function bh(e){let t=k(e).toLowerCase();return Lr.test(t)?"python":t}function Ji(e){try{let t=Mr(Sh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=xh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Sh(e){return typeof e==="string"?Xl(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function pc(e){let t=new Set;return e.flatMap((n,r)=>{let o=en(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Qi=`must be one of ${Vi.join(", ")}`,vh=/^[^/]+\/[^/]+$/,Eh=["version","rules","overrides","transparent_wrappers"];function xh(e){let t=Rh(e);return{errors:es(Mh(t,Eh,(n)=>n.kind==="custom"),": "," "),sources:Oh(e,t)}}function Rh(e){if(!en(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Ki;return[...e.version===1?[]:[_(["version"],"must be 1")],..._h(e.rules,t),...Ph(e.overrides),...Ih(e.transparent_wrappers),...t?[]:Ah(e.rules),...en(e.overrides)?Object.keys(e.overrides).filter((n)=>!vh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...kh(e.transparent_wrappers)]}function _h(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...gc(e,Ki)?[_(["rules"],qi)]:[]];if(t)return[{path:["rules"],message:qi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...wh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function gc(e,t){let n=hc(e);return n!==void 0&&!(n<=t)}function wh(e,t){let n=hc(e);return n!==void 0&&!(n>=t)}function hc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Ah(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=rc(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Ph(e){if(e===void 0)return[];if(!en(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!en(n))return[_(["overrides",t],'must be "off" or an object')];return[...Th(n.reason,["overrides",t,"reason"]),...n.intent===void 0||ns(n.intent)?[]:[_(["overrides",t,"intent"],Qi)]]})}function Th(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...gc(e,ut)?[_(t,`must be at most ${ut} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ut?[_(t,`must be at most ${ut} characters`)]:[]}function Ih(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return ct.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function kh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ct.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(mc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Oh(e,t){let n=en(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Mh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function es(e,t,n){return[...new Set(e.map((r)=>{let o=ts(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ts(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function ns(e){return Vi.includes(e)}function en(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Cc(e){let t=Lh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Nh=`required non-empty string up to ${ut} characters`,yc="must be a non-empty array of unique non-empty strings",Dh="required non-empty array of non-empty strings";function Lh(e){if(!dt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!fc(e))return{errors:[uc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...es(Wh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),dc]:t,ruleNames:new Set(bc(e).map((n)=>n.toLowerCase()))}}function bc(e){let t=dt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=dt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Wh(e,t){return[...typeof e.name==="string"&&wt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Gh(e.allowed_commands),...Fh(e.rules,t),...Uh(e.tests),...Hh(e),...jh(e)]}function Gh(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ct.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ct.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Fh(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!dt(n))return[_(["rules",r],"must be an object")];return t?Bh(n,["rules",r]):zh(n,["rules",r])}),...pc(e)]}function zh(e,t){return[...Sc(e.name,t),...vc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ct.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Fr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Ec(e.reason,t),...xc(e.intent,t)]}function Bh(e,t){return[...Sc(e.name,t),...vc(e.command,t),...Ec(e.reason,t),...xc(e.intent,t),...$h(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function Sc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return wt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function vc(e,t){return typeof e==="string"&&ct.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function Ec(e,t){return typeof e==="string"&&e!==""&&e.length<=ut?[]:[_([...t,"reason"],Nh)]}function xc(e,t){return e===void 0||ns(e)?[]:[_([...t,"intent"],Qi)]}function $h(e,t){if(!dt(e))return[_(t,"required object")];return[...Fr(e.command_path,[...t,"command_path"],Dh,!1),...e.any_args===void 0?[]:Fr(e.any_args,[...t,"any_args"],yc,!0),...e.exclude_args===void 0?[]:Fr(e.exclude_args,[...t,"exclude_args"],yc,!0)]}function Fr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Uh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!dt(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Hh(e){if(!Array.isArray(e.tests))return[];let t=new Set(bc(e));return[...new Set(e.tests.flatMap((n)=>dt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function jh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=dt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function dt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Tc(e,t){let n=ac(e,t),r;try{r=Jl(n.userConfigTarget,n.projectConfigTarget)}catch(m){if(m instanceof ae)return ey(n,m.message);throw m}let o=Ji(n.userConfigTarget),i=r?{config:null,errors:[]}:Ji(n.projectConfigTarget),s=Ac(n.userConfigPath,o.errors),a=Ac(n.projectConfigPath,i.errors),l=new Set,c=o.config?Rc(o.config,zr(n.userConfigPath),"user",n.userScope,l):Pc(),u=i.config?Rc(i.config,zr(n.projectConfigPath),"project",n.projectScope,l):Pc(),f=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[..._c(c.rules,f),..._c(u.rules,d)],transparent_wrappers:Jh(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?wc(f,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Qh(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?wc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Rc(e,t,n,r=_t(zr(zr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Kh(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let f=u.rulebook;if(o.has(f.name))return s.push(`duplicate active rulebook name "${f.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(f.name),[{rules:Vh(f),rulebook:{source:n,spec:c,name:f.name,version:f.version,rules:f.rules.map((d)=>`${f.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Vh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Kh(e,t,n){let r=qh(e),o=lc(t,r),i=Zh(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Yh(e)}`]};let s=Xh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function qh(e){return Nr(e)?Ui(e).name:e}function Yh(e){return Nr(e)?`run ${sc} to vendor ${e}`:"create that file or remove that source from the rules config"}function Zh(e,t){try{return{content:Mr(Dn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function Xh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Cc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function Jh(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function _c(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function wc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Qh(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Ac(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function ey(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Pc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as my,readFileSync as py}from"node:fs";var Ic=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],rs=new Set(Ic.map((e)=>e.id)),Br=Ic,ty=new Map(Br.map((e)=>[e.id,e.intent]));function b(e,t){return{id:e,reason:t,intent:ty.get(e)??"manual_only"}}var os=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],$r={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},ny=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],ry=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],is=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...ry.flatMap((e)=>ny.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Ur=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],kc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],oy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ss=kc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),as=kc.flatMap((e)=>oy.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Gn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ls=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),cs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],iy=[...os,$r,...is,...ss,...as,Gn,...ls,...cs,...Ur].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Hr=new Set(Ur.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),us=new Set(iy.map((e)=>e.id));import{isAbsolute as ds,join as sy,normalize as ay,sep as jr}from"node:path";var Oc=process.platform==="win32",ly=/[*?]/;function Fn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function fs(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Fn(e.trim(),t);if(!ds(n))return"must be an absolute path or start with ~/";return zn(n,t)}function ms(e,t){let n=Mc(e,t);if(n===null)return"must be a non-empty path string";if(!ds(n))return null;if(zn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var cy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",uy="cannot cover the guard's own configuration";function Mc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Fn(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ps(e,t){let n=Mc(e,t);if(n===null)return"must be a non-empty path string";if(ly.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!ds(n))return null;if(zn(n,t)!==null)return cy;return dy(n,t)?uy:null}function dy(e,t){let n=Vr(e),r=Vr(sy(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${jr}`)}function zn(e,t){let n=Vr(e),r=Vr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(jr)?n:`${n}${jr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Vr(e){let t=ay(e);if(Oc)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Oc?3:1)&&t.endsWith(jr))t=t.slice(0,-1);return t}var Nc=30,Kr=1,qr=365;function Dc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Lc=new Set(Br.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(Lc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Lc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Wc(e,t){return Object.freeze(Object.fromEntries(Br.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Gc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Wc(e,t)})}var Fc={standard:0,strict:1,paranoid:2};function $c(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:gs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:gs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:gs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:fy(e,t)}}function gs(e,t){return[...new Set([...e,...t??[]])]}function fy(e,t){let n=t.safety?.level,r=Ir[e.safety.level];return[...n&&Fc[n]<Fc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Jt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...zc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...zc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Hr.has(o))),...e.destructive_command_protection.enabled?Bc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Bc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function zc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Bc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Cs=new Set(["standard","strict","paranoid"]),Vc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Nc}};function Kc(e,t){let n=Ry(Qt(e,t),e.home),r=Xr(Ln(t.cwd),e.home),o=hy(r.parsed,e.home),i=Object.keys(o.policy).length>0?$c(n.gui??Vc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ys(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var gy="project policy audit settings are ignored; audit is user scope only";function hy(e,t){if(!Ee(e))return{policy:{},diagnostics:[]};let n=Ee(e.safety)?e.safety:{},r=Ee(e.workflow)?e.workflow:{},o=Ee(e.destructive_command_protection)?e.destructive_command_protection:{},i=Ee(e.secret_protection)?e.secret_protection:{},s={...Cs.has(n.level)?{level:n.level}:{},...Ee(n.overrides)?Uc({overrides:qc(n.overrides,Jt,["safety","overrides"],It)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Zr(o.overrides,rs,Zc,It)}:{},...o.allow_paths!==void 0?{allow_paths:nn(o.allow_paths,fs,t,["destructive_command_protection","allow_paths"],It)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Zr(i.overrides,us,Xc,It)}:{},...i.deny_paths!==void 0?{deny_paths:nn(i.deny_paths,ms,t,["secret_protection","deny_paths"],It)}:{},...i.allow_paths!==void 0?{allow_paths:nn(i.allow_paths,ps,t,["secret_protection","allow_paths"],It)}:{}};return{policy:Uc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[gy]}}function qc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],bs));return[]}))}function Uc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var It=()=>{return},bs="must be a boolean",Ss="must be an object if provided",Yc=`must be an integer between ${Kr} and ${qr}`,Zc={path:["destructive_command_protection","overrides"],label:"destructive command"},Xc={path:["secret_protection","overrides"],label:"secret protection"},yy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Cy(e,t){let n=[];return{policy:Jc(e,t,(o)=>{n.push(o)}),issues:n}}function by(e,t){return Jc(e,t,It)}function Jc(e,t,n){if(!Ee(e))return n(_([],"Config must be an object")),Yr();if(e.version!==1)n(_(["version"],"must be 1"));let r=tn(e.safety,["safety"],["level","overrides"],n),o=tn(r.overrides,["safety","overrides"],Jt,n),i=tn(e.workflow,["workflow"],["worktree_mode"],n),s=tn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=tn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=tn(e.audit,["audit"],["retention_days"],n);return Qc(e,yy,[],n),{version:1,safety:{level:Sy(r.level,n),overrides:qc(o,Jt,["safety","overrides"],n)},workflow:{worktree_mode:hs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:hs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Zr(s.overrides,rs,Zc,n),allow_paths:nn(s.allow_paths,fs,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:hs(a.enabled,["secret_protection","enabled"],!0,n),overrides:Zr(a.overrides,us,Xc,n),deny_paths:nn(a.deny_paths,ms,t,["secret_protection","deny_paths"],n),allow_paths:nn(a.allow_paths,ps,t,["secret_protection","allow_paths"],n)},audit:{retention_days:vy(l.retention_days,n)}}}function tn(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(t,Ss)),{};return Qc(e,n,t,r),e}function Qc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function Sy(e,t){if(e===void 0)return"standard";if(Cs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function hs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,bs));return n}function vy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Kr&&e<=qr))t(_(["audit","retention_days"],Yc));return Dc(e)}function Zr(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(n.path,Ss)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function nn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function Ee(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Yr(){return structuredClone(Vc)}function Xr(e,t){if(!my(e))return{exists:!1,policy:Yr(),errors:[]};try{let n=py(e,"utf-8");if(!n.trim())return{exists:!0,policy:Yr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Cy(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${xy(i)}`),fallback:Ee(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Yr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var Ey=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ss,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[bs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Yc,`not an integer between ${Kr} and ${qr}`]]);function xy(e){let t=ts(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=Ey.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function Ry(e,t){let n=Xr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ee(r))return{policy:jc(),errors:[]};let o=by(r,t);return{policy:ys(o),gui:o,errors:[],levelPresent:Hc(r)}}if(n.parsed===void 0)return{policy:jc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ys(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Hc(n.parsed)}}function Hc(e){let t=Ee(e)&&Ee(e.safety)?e.safety:{};return Cs.has(t.level)}function eu(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Hr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function jc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:eu({}),denyPaths:[],allowPaths:[]}}}function ys(e){return{safety:_y(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:eu(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function _y(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function tu(e,t){let n=Tc(e,t),r=Kc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Ty(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Iy(o,wy(n,r),s,r.policyScopes)}function wy(e,t){let n=Py(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:ky(e.errors.length>0?Ay(e.errors):void 0,e.warnings.length>0?Es(e.warnings.join("; ")):void 0,n)}}function Ay(e){return`${Es(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Py(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Ty(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Iy(e,t,n=Object.freeze({}),r){let o=vs(structuredClone(e)),i=r?{policyScopes:vs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function vs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))vs(t);return Object.freeze(e)}function ky(...e){return Es(e.filter((t)=>!!t).join("; "))}function Es(e){return/[.!?]$/.test(e)?e:`${e}.`}function nu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:xs(t.fail_closed,e.strict,"strict"),paranoid_rm:xs(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:xs(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Gc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Oi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function xs(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Bn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Oy=/^[A-Za-z_][A-Za-z0-9_]*=/;function Jr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function $n(e){let t=Jr(e.words[0],"time")?1:0,n=t===1&&Jr(e.words[t],"-p")?t+1:t,r=t===1&&Jr(e.words[n],"--")?n+1:n,o=Jr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Oy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var ft=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Qr(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function My(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>me(t)))})}function eo(e,t,n){e.push(n),t.reset()}function to(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Rs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function rn(e,t,n,r,o,i,s){return Rs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function me(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return My(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:me(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function _s(e,t,n){if(t>=n||ou(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!ou(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=ru(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=ru(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function ws(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Ny(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?Dy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function ru(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function ou(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Ny(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function Dy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var lu=new Set(["&&","||","|","|&"]);function cu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=oo(e,0,e.length,t,{used:0,max:t.maxWords},0);return me({kind:"program",dialect:"posix",source:e,span:n,status:ao(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function oo(e,t,n,r,o,i,s){let a=[],l=[],c=Qr(),u=[],f=()=>{if(c.words.length===0&&c.redirections.length===0)return;let m={start:c.start,end:c.end},p=c.words.map((g)=>g.text);eo(a,c,{kind:"command",dialect:"posix",source:e.slice(m.start,m.end),span:m,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let m=e[d];if(!m)break;if(s&&m===s)return f(),au(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(so(m)){if(m===`
+`||m==="\r"){f();let v=m==="\r"&&e[d+1]===`
+`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!lu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,v),span:Object.freeze({start:d,end:v})}));if(u.length>0){let x=ws(e,v,n,u.splice(0));l.push(...x.issues),d=x.next;continue}d=v;continue}d++;continue}if(m==="#"){while(d<n&&e[d]!==`
+`&&e[d]!=="\r")d++;continue}let p=c.start===-1?nC(e,d,n):void 0;if(p){if(Ps(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);if(!As(o))return on(a,l,d,"word-limit",r.maxWords);let v=oo(e,p.braceIndex+1,n,r,o,i+1,"}"),T=v.next,x={start:p.braceIndex+1,end:v.closed?T-1:T},A=iu(e,x,v);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:A}),l.push(...v.issues),v.pendingHeredocs.length>0||Hn(v.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...v.pendingHeredocs),v.limited)return ro(a,l,v.next);if(!v.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let g=io(e,d);if(g){if(f(),!yu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:g,span:Object.freeze({start:d,end:d+g.length})})),d+=g.length;continue}if(m===")"){f(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:m,span:{start:d,end:d+1}}),d++;continue}if((m==="("||m==="{"&&Uy(e,d,n))&&c.start===-1){if(Ps(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);let v=m==="("?")":"}",T=oo(e,d+1,n,r,o,i+1,v),x=T.next,A={start:d+1,end:T.closed?x-1:x},q=iu(e,A,T);if(a.push({kind:"group",style:m==="("?"subshell":"brace",span:{start:d,end:x},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Hn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return ro(a,l,T.next);if(!T.closed)l.push({code:m==="("?"unclosed-subshell":"unclosed-brace-group",message:`${m} group is not closed`});d=x;continue}let h=(m==="<"||m===">")&&e[d+1]!=="("?Fy(e,d):null;if(h){let v=c.words.at(-1),T=v&&v.span.end===d&&/^[0-9]+$/.test(v.raw)?Number(v.raw):void 0;if(T!==void 0)c.words.pop();let x=T===void 0?d:v?.span.start??d;c.start=c.start===-1?d:c.start;let A=d+h.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let q=e[A],Z=A>d+h.length&&q==="#",ee=!q||so(q)||!!io(e,A)||q===s||q===")"||Z||(q==="<"||q===">")&&e[A+1]!=="(",X=h==="<<"||h==="<<-",U=X?_s(e,A,n):void 0,D=U?{word:rn(e,A,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Ts(e,A,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return ro(a,l,D.next);if(!As(o))return on(a,l,D.next,"word-limit",r.maxWords)}let ue=D?.next??d+h.length,_e={kind:"redirection",operator:h,span:{start:x,end:ue},...T===void 0?{}:{fd:T},...D?{target:D.word}:{}};if(c.redirections.push(_e),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let qe=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:h==="<<-",attach:(ke)=>{if(_e.heredoc=ke,ke.quotedDelimiter)return;qe.push(...Wy(e,ke.bodySpan.start,ke.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(D)c.nested.push(...D.nested);c.end=ue,d=ue;continue}if(c.start===-1)Ps(a,l);let y=Ts(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return ro(a,l,y.next);let S=Vy(c.words)?Xy(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(S?.limitCode)return on(a,l,y.next,S.limitCode,S.limitCode==="word-limit"?r.maxWords:S.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=S?.words??[y.word];for(let v of E){if(!As(o))return on(a,l,y.next,"word-limit",r.maxWords);c.words.push(v)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return f(),au(a,l),l.push(...rC(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function iu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:ao(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ts(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],f=[],d=!1;while(a<n){let m=e[a],p=(m==="<"||m===">")&&e[a+1]==="(";if(!m||so(m)||(m===";"||m==="|"||m==="&")&&io(e,a)||(m==="<"||m===">")&&!p)break;if(m===")")break;if(m==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),f.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(m==='"'){l=!0;let h=Ly(e,a,n,r,o,i);if(s+=h.text,u.push(...h.nested),f.push(...h.issues),d||=h.limited,c=Un(c,h.provenance),a=h.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let h=zy(e,a+2,n);if(s+=h.text,f.push(...h.issues),!h.closed)f.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(m==="\\"){let h=e[a+1];if(!h){f.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
+`){a+=2;continue}s+=h,a+=2;continue}let g=m==="$"||m==="<"||m===">"||m==="`"?lo(e,a,n,r,o,i):null;if(g){let h=uu(g,u,f);if(d||=h.limited,c=Un(c,h.provenance),a=h.next,d)break;continue}if(m==="$"){let h=mu(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(m==="*"||m==="?"||m==="[")c=Un(c,"glob");s+=m,a++}return{word:rn(e,t,a,s,c,l,c==="literal"?void 0:$y(e,t,a)),nested:u,issues:f,next:a,limited:d}}function Ly(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,f=t+1;while(f<n){let d=e[f];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:f+1,limited:u};if(d==="\\"&&e[f+1]){let p=e[f+1]??"";if(p===`
+`){f+=2;continue}if(p==="\r"&&e[f+2]===`
+`){f+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,f+=2;continue}if(e.startsWith("$((",f)){let p=Is(e,f+3,n,"))"),g=p===-1?n:p+2;if(s+=e.slice(f,g),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});f=g;continue}let m=lo(e,f,n,r,o,i);if(m){let p=uu(m,l,c);if(f=p.next,u||=p.limited,a=Un(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:f,limited:u};continue}if(d==="$"){let p=mu(e,f,n,s,a);s=p.text,a=p.provenance,f=p.next;continue}s+=d??"",f++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function lo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,f=s?"))":c?"`":")",d=Is(e,t+u,n,f),m=d===-1?n:d,p=d===-1?n:d+f.length;if(i>=r.maxDepth)return{program:tC(e,t+u,m,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let S=[],E=[],v=!1,T=t+u;while(T<m){let x=lo(e,T,m,r,o,i+1);if(!x){T++;continue}if(S.push(...x.program.nodes),E.push(...x.program.issues),v||=x.program.status==="limited",T=x.next,v)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,m),span:{start:t+u,end:m},status:ao(E,v),issues:E,nodes:S}),next:p,provenance:"arithmetic"}}let g=oo(e,t+u,m,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Hn(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,m),span:{start:t+u,end:m},status:ao([...g.issues,...h,...y],g.limited),issues:[...g.issues,...h,...y],nodes:g.nodes}),next:p,provenance:"command-substitution"}}function Wy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?lo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function uu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Is(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
 `||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=ws(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=ou(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=Ay(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=_s(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Ay(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=ou(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function ou(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!qy(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function oo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Ty(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function io(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function iu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Iy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=ky(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function ky(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return to(e,t+1,n,16,2,t+1);if(r==="u")return to(e,t+1,n,16,4,t+1);if(r==="U")return to(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return to(e,t,n,8,3,t+1);return{text:r,next:t+1}}function to(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function so(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function su(e,t,n,r,o){let i=iu(e,t,n);return{text:r+e.slice(t,i),provenance:Un(o,"variable"),next:i}}function Oy(e,t,n){let r=eo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,p=c?"))":d?"`":")",h=Is(e,a+f,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let f=iu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Un(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function My(e,t,n){return t+1>=n||io(e[t+1]??"")||oo(e,t+1)!==null}var Ny=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Dy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Ly(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Wy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Wy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Gy(e,t);if(n==="env")return Fy(e,t);if(n==="sudo")return zy(e,t);return}function Gy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Fy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Ny.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function zy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Dy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function au(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=lu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>cu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function By(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=lu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>cu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>rn(e,t.span.start,t.span.end,a,"literal",!1))}}function lu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>Qc(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=Qc(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...$y(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function Qc(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Hy(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:Uy(e,r)}}function $y(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function Uy(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Hy(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function cu(e,t){let n=`x${e}`,r=Ts(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function jy(e,t,n,r){return me({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function on(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function no(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ps(e){return e.used++,e.used<=e.max}function Vy(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Hn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Hn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Hn(t.body.nodes)})}function Ky(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function uu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function eu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!tu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function As(e,t){if(!uu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function qy(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var mu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Yy=new Set(["gc","cat","type","cp","mv","rm"]),fu=["-rec","-for","-path","-literalpath","-whatif"],Zy=/^\$env:\w/i,Xy=/^(?:\$\{?\w+\}?|~)\\./;function pu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...mu].some((o)=>n.includes(o))&&!(n.includes("rm")&&fu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!Jy(n))return!1;let r=Ns(e,t);if(gu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ms(r).some(Qy)}function gu(e){return e.nodes.some((t)=>{if(t.kind==="group")return gu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function Jy(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Qy(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&mu.has(n))return!0;let r=e.slice(t+1);if(n&&Yy.has(n)&&r.some(eC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return fu.some((s)=>i.startsWith(s))})}function eC(e){return Zy.test(e)||Xy.test(e)}function Ns(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ds(e,0,e.length,t,0);return me({kind:"program",dialect:"powershell",source:e,span:n,status:iC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ds(e,t,n,r,o,i=!1){let s=[],a=[],l=Jr(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};Qr(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=oC(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
-`){m();let y=f==="\r"&&e[d+1]===`
-`?d+2:d+1;s.push(ks(e,d,y)),d=y;continue}d++;continue}let h=Cu(e,d);if(h){m(),s.push(ks(e,d,d+h.length)),d+=h.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(yu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ds(e,d+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=me({kind:"program",dialect:"powershell",source:e.slice(d+1,v),span:{start:d+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(ks(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?du(e,v,n,r,o):void 0,S=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:S}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=S,d=S;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Rs({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let g=du(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,u||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next>d?g.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function du(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(p)=>{let h=tC(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),u+=Os(h.program),m||=h.program.status==="limited",s="command-substitution",h.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||Cu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[f+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=h,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(p==="'"){a=!0,f++;let h=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){h=!0,f++;break}i+=e[f]??"",f++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let h=!1;while(f<n){let g=e[f];if(g==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(g==='"'){h=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=g??"",f++}if(!h)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:rn(e,t,f,i,s,a,s==="literal"?void 0:nC(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function tC(e,t,n,r,o){let i=hu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[yu(r.maxDepth)],nodes:[]}),next:a};let l=Ds(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function hu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Os(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Os(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Os(r)}}return t}function nC(e,t,n){let r=eo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=hu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=rC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function rC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function yu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ms(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ms(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ms)]})}function Cu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function oC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function iC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ks(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Me(e,t="auto",n=dt){if(t==="powershell"||t==="auto"&&pu(e.slice(0,n.maxInputLength),n))return Ns(e,n);return nu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function sn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function lo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Ls(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function jn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){jn(e,t)}function kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Ws(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Y(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function Ke(e,t,n){return!kt(C(e,t-1))&&j(e,t,n)&&!kt(C(e,t+n.length))}function qe(e,t){return kt(C(e,t-1))!==kt(C(e,t))}function oe(e){return e===`
-`||e===";"||e==="&"||e==="|"}function an(e){return e==="|"||e===";"}function co(e,t,n){let r=Ls(e,n);if(t==="rm")return sC(r);if(t==="dd")return lC(r);return Ru(r,!0)}function uo(e,t,n){let r=Ls(e,n);if(t==="rm")return cC(r);if(t==="reset-hard")return Eu(r,"--ha","rd");if(t==="reset-merge")return Eu(r,"--me","rge");if(t==="clean")return fC(r);if(t==="checkout")return gC(r);if(t==="push-force")return hC(r);if(t==="push-refspec")return yC(r);if(t==="push-delete")return CC(r);if(t==="branch")return bC(r);if(t==="tag")return EC(r);if(t==="restore")return xC(r);return Ru(r,!1)}function sC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Ke(e,i,"rm")&&H(l)&&l!==`
-`)t=!0,i++;continue}let a=aC(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=bu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=bu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function aC(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function bu(e,t,n){if(Su(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Su(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Su(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function lC(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(C(e,n))){t=!1;continue}if(Ke(e,n,"dd")){t=!0,n++;continue}if(!t||!Ke(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function cC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=C(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=dC(e,o);if(s>=0){if(uC(e,s))return!0;let a=s,l=!1;while(H(C(e,a)))l||=C(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(C(e,o-1)))&&(!C(e,o+2)||H(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&qe(e,o+11)||Gs(e,o,"recursive"),r||=j(e,o,"--force")&&qe(e,o+7)||Gs(e,o,"force"),n&&r)return!0;o++}return!1}function Gs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&qe(e,t+r+2)}function uC(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(C(e,n)))n++;let i=n;while(n<Y(e)&&!H(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=vu(e,i,"recursive"),a=vu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=mC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function vu(e,t,n){return j(e,t,`--${n}`)&&qe(e,t+n.length+2)||Gs(e,t,n)}function dC(e,t){if(t>0&&kt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!H(C(e,n+1)))return-1;return n+1}function mC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=C(e,c)??"",m=(u==="r"||u==="f")&&qe(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Eu(e,t,n){return Kn(e,"reset",an,!0,(r)=>C(e,r)==="-"&&ln(e,r,t,n)?!0:r)}function fC(e){return Kn(e,"clean",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(ln(e,t,"--fo","rce"))return!0;let n=Vn(e,t,an);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function mo(e,t,n){if(!Ke(e,t,"git"))return null;let r=t+3;if(!H(C(e,r)))return{commandEnd:-1,next:r};while(H(C(e,r)))r++;while(r<Y(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=Vn(e,r,oe);if(Ke(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=pC(e,r,o);r=o;while(H(C(e,r)))r++;if(i)return{commandEnd:Ke(e,r,n)?r+n.length:-1,next:Vn(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=Vn(e,r,oe);while(H(C(e,r)))r++}return{commandEnd:-1,next:r}}function pC(e,t,n){for(let r of be)if(n-t===r.length&&j(e,t,r))return!0;return!1}function gC(e){return xu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function hC(e){return Kn(e,"push",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!kt(C(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=_u(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function yC(e){return Kn(e,"push",oe,!1,(t)=>{if(H(C(e,t))&&C(e,t+1)==="+"&&t+2<Y(e)&&!oe(C(e,t+2))&&!H(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function CC(e){return Kn(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&ln(e,t,"--de","lete"))return!0;if(H(C(e,t))&&C(e,t+1)===":"&&t+2<Y(e)&&!H(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function bC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=mo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=Vn(e,o,oe),s=SC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function SC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(ln(e,i,"--de","lete"))r=!0;if(ln(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&vC(C(e,s))){let u=C(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!qe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function vC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function EC(e){return xu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function xu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=mo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(ln(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&qe(e,r+1))return!0;if(an(o))i.outerActive=!1}return!1}function Kn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=mo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(C(e,u)))i=!1;s=c}if(l)i=!1}return!1}function xC(e){let t=!1;for(let n=0;n<Y(e);n++){if(Ws(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=mo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Ru(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=C(e,r),i=t?Ws(o):oe(o);if(n&&H(o)&&C(e,r+1)==="-"&&Ke(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Ke(e,r,"find"))n=!0,r+=3}return!1}function Vn(e,t,n){let r=t;while(r<Y(e)&&!H(C(e,r))&&!n(C(e,r)))r++;return r}function _u(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return qe(e,o)?o:-1}function ln(e,t,n,r){return _u(e,t,n,r)>=0}function Ye(e,t){jn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&uo(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var RC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;jn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Au(t.nodes,r,i)}function Au(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Au(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return _C(r,t,n)})}function _C(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!RC.test(o.text));return e.words.every((o,i)=>o===t||wu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||wu(o.target.raw,n.anchored,!0)))}function wu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as wC,resolve as Tu}from"node:path";function qn(e,t,n,r){let o=wC(e)?Tu(e):t?Tu(t,e):void 0;if(!o)return;try{return F(o,n,r)}catch{return o}}function Iu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var cn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Yn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Fs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),PC=new Set(["-p","--print"]),AC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),TC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),IC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),kC=new Map([["python",new Set(["m"])]]),OC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),MC=new Set(["always","default","never"]),NC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),DC=/\\\r?\n/g,LC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Ou(e){return po(e).code}function fo(e){return po(e).sources}function Mu(e){return LC.get(Bs(e))??[]}function po(e){let t=Bs(e[0]??"");if(!Fs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&PC.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(GC(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(FC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=WC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(OC.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&NC.has(s))||t==="python"&&!MC.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(kC.get(t)?.has(d)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(AC.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(TC.get(t)?.has(d)){if(m+1===s.length)i++;break}if(IC.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function WC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function zs(e,t){return Bs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Bs(e){let t=k(e).toLowerCase();return Dr.test(t)?"python":t}function GC(e,t){return Fs.get(e)?.has(t)??!1}function FC(e){return Fs.get(e)?.has("--eval")??!1}function Zn(e,t){let n=$C(e,t);if(!ku(n,t))return!1;Ee(t,n);let r=BC(n);if(ku(r,t))return!0;return Ee(t,r),zC.test(r)}var zC=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function BC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function ku(e,t){if(co(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(co(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(co(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>uo(o,r))))}function $C(e,t){return Ee(t,e),e.replace(DC,"")}import{isAbsolute as id,relative as sd}from"node:path";import{isAbsolute as zu,parse as JC}from"node:path";import{dirname as UC,isAbsolute as HC,parse as jC,sep as VC}from"node:path";function mt(e,t,n){if(at(t))throw Error("Unsupported Windows namespace path");let r=HC(t)?jC(t).root:"",o=r||e;for(let i of qC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=UC(o);continue}let s=KC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function KC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${VC}${t}`}function qC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var $s=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],YC=new Set($s),ZC=1024,Nu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Du=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),XC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function go(e){return YC.has(e)}function Us(e){return go(e)||Nu.has(e)||Du.has(e)||Nn(e)}function Ze(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Lu(e,t){let n=Ze("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=ZC?{state:"valid",count:r}:{state:"invalid"}}function ho(e,t,n){let o=e.match(XC)?.[1];if(!o||!Us(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ze(o,t,n)??""}${e.slice(i+1)}`}}function Wu(e){return Fu(e,Du)}function Gu(e){return Fu(e,Nu)}function Fu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var $u=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!$u.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function yo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Uu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Ot(e,t,n,r){if(!Uu(un(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let d=Bu(i),f=yo(i);for(let[h,g]of f.envAssignments)s.set(h,g),a.set(h,g);if(i=f.words,i.length===0)break;while(i.length>0&&un(i).includes("=")&&!eb(i)){let h=tb(un(i),a,t.env)??ho(un(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=un(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=rb(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=sb(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=ab(i);if(p==="builtin")i=i.slice(De(i,1)==="--"?2:1);if(Bu(i)===d)break}let u=yo(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:QC(u.words,o)}}function QC(e,t){return e.some((n)=>!t.has(n))}function Bu(e){return e.map(w).join(" ")}function un(e){let t=e[0];return t?w(t):""}function De(e,t){let n=e[t];return n?w(n):void 0}function eb(e){return $u.test(un(e))}function tb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var nb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function rb(e,t,n){let r=1,o=n;while(r<e.length){let i=De(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=De(e,r+1);o=s?Xn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Xn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Xn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(nb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var ob=new Set(["-i","-0","--null"]),ib=new Set(["-u","--unset","-C","--chdir","-P"]);function sb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=De(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(ob.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=De(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:De(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(ib.has(c)){if(c==="-C"||c==="--chdir"){let m=De(e,a+1);s=m?Xn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Xn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(De(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(De(e,a)==="--")a++;return l(a)}return l(a)}function Xn(e,t,n){if(t==="")return null;if(!e&&!zu(t))return null;let r=zu(t)?JC(t).root:n.realpath(e??"/");if(r===null)return null;try{return mt(r,t,n)}catch{return null}}function ab(e){if(De(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=De(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var lb=/['"\\$`{}#]/;function Co(e,t){if(e.some((r)=>lb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function ft(e,t,n){return bo(e,t,n).tokens}function cb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Mt(e,t,n,r=0){let o=bo(e,t,n),i=(o.envSplitValues??[]).flatMap(cb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Mt(s,t,n,r+1)}function bo(e,t,n,r){if(!Uu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Ot(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Ks=Symbol("adopt-as-operand"),ub=new Set(["env","sudo","command","builtin"]),db=new Set(["&&","||","|&","|","&",";"]),mb=new Set(["<<","<<<",">|"]),fb=new Set(["|","|&"]),pb=/[*@#?$!_-]/,gb=/^\w+(?::\w+)*/,hb=Object.freeze([]),Jn=Object.freeze({kind:"scope",edge:"enter"}),Qn=Object.freeze({kind:"scope",edge:"exit"}),yb=Object.freeze([]),Cb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),er=new Set(["bash","sh","zsh","dash","ksh"]),bb=256,qu=new WeakMap;function Yu(e,t){let n=t.status==="complete"?new Set(Vs(t)):new Set,r=Eb(e,n);if(Wr(r))return So("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Nt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return So("structural-limit",r,t);if(o.invalid)return So("invalid",r,t);let s=So("complete",r,t,o.assignmentFallbacks);return qu.set(s,Object.freeze(i)),s}function Eo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of Zu(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=Sb(a,s,n,r),c=a.length>0&&fb.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===Ks){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function xo(e){return Zu(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function fe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:fe(i,t);return a?fe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function Sb(e,t,n,r){let o=tr(e)?new Map([...t.variables,...vb(e,t.variables)]):t.variables,i=ft([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(fe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function vb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],fe(o,t)]]:[]})}function Zu(e){return qu.get(e)??hb}function Eb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function So(e,t,n,r=yb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Nt(e,t){return e.nodes.flatMap((n,r)=>xb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function xb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Le(Ab(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Le(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[vo("{"),...Nt(e.body,a),...s?[vo("}")]:[]]:[Jn,Le("("),...Nt(e.body,a),...s?[Le(")")]:[],Qn]}]}let o=Ob(e,r.functions);if(o){if(r.depth>=dt.maxDepth||++r.flags.expansions>bb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Hu(e,r),vo(";"),...Nt(o,{...r,depth:r.depth+1}),vo(";")]},...ju(e,t,n,r)]}return[{start:e.span.start,events:Hu(e,r)},...ju(e,t,n,r)]}function Hu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Ju(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:Rb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function Rb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Ju(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[qs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:Tb(r),targetOrder:mb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:ed(t)}:{}}),...s===void 0?o:o.slice(1)]}function ju(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[qs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Le(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...Xu(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?_b(t,n,r):[]]}function _b(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:Xu(n.source.slice(r.span.end,e.span.end),n)}]}function Xu(e,t){if(t.depth>=dt.maxDepth)return t.flags.limited=!0,[];let n=Me(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Nt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Ju(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Le("glob"):s!==""||e.quoted&&o.length===0?qs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of Hs(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Le(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=Hs(f,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=u?Nt(u,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(Jn,...p,Qn);continue}let m=u?Nt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Jn,...m,Qn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Le("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Jn,...m,...c.raw.endsWith(")")?[Le(")")]:[],Qn);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>Le("(")),...d===1?[Jn]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>Le(")")):[],...d===1?[Qn]:[])}return l(),o}function Hs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Vu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Vu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Vu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=Pb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return wb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&pb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?gb:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function wb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Hs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function Pb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Ab(e){return/^[\r\n]+$/.test(e)?";":e}function Le(e){return Object.freeze({kind:"operator",operator:e,boundary:db.has(e)})}function vo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function qs(e){return Object.freeze({kind:"word",text:e})}function Tb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function nr(e){return Cb.has(e)||/^python\d/.test(e)}var Ib=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Qu(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=Ib.get(e)?.has(n)??!1;return Qu(e,t.slice(r?2:1))}function js(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return js(e.slice(1));if(!ub.has(t))return[...e];return js(Qu(t,e.slice(1)))}function ed(e){let t=$n(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return js(n<0?[]:e.words.slice(n).map((r)=>r.text))}function kb(e){let t=ed(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return nr(n)&&!er.has(n)}function Vs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Vs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Vs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(kb(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!Nb(t))return r;return[...r,...o]})}function Ob(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function pt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function Mb(e){if(pt(e.words[0],"git"))return pt(e.words[1],"commit");if(!pt(e.words[0],"gh")||!pt(e.words[2],"create"))return!1;return pt(e.words[1],"pr")||pt(e.words[1],"issue")}function Nb(e){return(pt(e.words[0],"cat")||pt(e.words[0],"tee")||Mb(e))&&!e.words.some(Ku)&&!e.redirections.some((n)=>Ku(n.target))}function Ku(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var td=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),nd=new Set([...td,"glob"]),Db=new Set([...nd,"pattern"]);class We extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function rr(e){let t=Lb(),n=Tn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:Wb(e),store:t}}function pe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Xe(e,t){if(!e.includes("$"))return e;return Ei(e,t)}function Lb(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Me(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=Yu(i,a);return e.set(i,c),c},getCommandProgram:r}}function Wb(e){let t=e.route.kind==="grep"?nd:e.route.kind==="glob"?Db:td;return[...El(e.input,t),...e.route.kind==="patch"?_l(e.input):[]]}var Gb=new Set(["-S","--suffix"]);function dn(e,t,n,r,o){if(e.status==="structural-limit")throw new We;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Eo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(fe(i.target,s.variables),s)?i.target:null})}function Ro(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Gb.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Ae="Git metadata and hooks are protected. Ask the user before modifying them.";function ad(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Pr(e.invocation.toolName))return null;let a=e.paths.find((l)=>rd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=pe(e,"input-candidate");if(!i)return null;let s=dn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>$b(a,l,t,n,r),isRedirectionTarget:(a,l)=>rd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=wo(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Ys(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?_o(m,l):Fb(m,l);if(n.markerFiles.some(u))return!0;return r&&od(n).some(u)}if(Ys(a,n))return!0;return r&&od(n).some((c)=>_o(c,a))}function Fb(e,t){let n=sd(t,e);if(n===""||n.startsWith("..")||id(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function zb(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function Bb(e,t,n,r,o){if(!n)return!1;return Ys(wo(se(e,t,r,o)),n)}function rd(e,t,n,r,o,i){let s=wo(se(e,t,r,o));return i.includes(s)||cd(s,n)}function ld(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>_o(i,wo(se(s,t,r,o)))))}function Ys(e,t){return t.entries.includes(e)||t.directories.includes(e)||cd(e,t)}function cd(e,t){return t.hooksDirectories.some((n)=>_o(e,n))}function od(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function _o(e,t){let n=sd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!id(n)}function wo(e){return process.platform==="win32"?e.toLowerCase():e}function $b(e,t,n,r,o){if(tr(e))return null;let i=Mt([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=Ro(i.slice(1)),a=s.sources.find((l)=>zb(fe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&Bb(fe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as ko,normalize as Zb,parse as Xb,posix as yd,resolve as Wt,sep as Qs}from"node:path";import{isAbsolute as Ub,join as ud,normalize as fd,parse as Hb,sep as dd}from"node:path";var jb=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Vb=` 	
-`;function or(e,t){if(gt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Zs(e.get("TMPDIR")??"",t)}function Lt(e,t){if(e.has("TMPDIR"))return Zs(e.get("TMPDIR")??"",t);let n=Xs(e,t);if(n===void 0)return!0;return Zs(n,t)}function Xs(e,t){return gd(e,t,"TMPDIR")}function Zs(e,t){if(!e)return!1;if(qb(e))return!1;return mn(e,t)}function gt(e,t){let n=gd(e,t,"IFS");return n!==void 0&&n!==""&&n!==Vb}function mn(e,t){let n=Po(e,t.paths);if(n===null)return!1;return pd(t).some((r)=>Io(n,r))}function To(e,t){let n=Po(e,t.paths);if(n===null)return!1;return pd(t).some((r)=>Ao(r)===Ao(n))}var md=new WeakMap;function pd(e){let t=md.get(e);if(t)return t;let n=Kb(e);return md.set(e,n),n}function Kb(e){let t=jb.map((r)=>Po(r,e.paths)??fd(r)),n=Po(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&Yb(n))return[...t,n];return t}function qb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function gd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function Yb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Po(e,t){try{let n=fd(e);if(!Ub(n))return n;let r=Hb(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=ud(i,o[s]??"");if(t.entryKind(a)==="missing")return ud(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Io(e,t){let n=Ao(e),r=Ao(t);if(n===r)return!0;let o=r.endsWith(dd)?r:`${r}${dd}`;return n.startsWith(o)}function Ao(e){return process.platform==="win32"?e.toLowerCase():e}var Jb=process.platform==="win32",hd=64,Qb=16384;function ir(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return b(o.id,o.reason)}function sr(e){let t=au(e,hd,hd,Qb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:eS(e)}}function eS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>tS(e.raw,n.span.start-e.span.start))}function tS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Gt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??ye();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:aS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&cS(e))return{kind:"outside_anchored_cwd"};let o=!r&&bd(e,t.posixShell);if(at(e))return{kind:"outside_anchored_cwd"};if(ea(e,r))return{kind:"root_or_home_target"};if(rS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(oS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(lS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&fS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>pS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(gS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(nS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function nS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(ko(r)||r.startsWith("~"))return!1;if(ta(r))return!1;if(Sd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return mn(Wt(t.resolvedCwd,r),t.environment)}function Cd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(sS(i))return!1;if(To(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Sd(r??i,s,t.environment.paths,t.budget))}function ea(e,t=!1){let n=e.trim(),r=yd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function rS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=ko(o)?o:t.resolvedCwd?Wt(t.resolvedCwd,o):null;if(!i)return!1;let s=ge(F(i,t.environment.paths,t.budget));if(s===Xb(s).root)return!0;return s===ge(F(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function ge(e){let t=Zb(e);if(Jb){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function oS(e,t,n,r,o,i,s,a){let l=e.trim();if(ta(l))return!1;if(!r&&mn(l,a))return!0;return(t||i&&s)&&n&&!o&&iS(l,n)}function iS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!bd(e.slice(n.length+1),t)})}function sS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return yd.normalize(`/${t[1]??""}`)==="/"}function ta(e){return e.split(/[\\/]+/).includes("..")}function aS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Fn(o.trim(),t);if(!ko(i))return[];try{let s=F(i,n,r);if(zn(s,F(t,n,r)))return[];return[ge(s)]}catch{return[]}})}function lS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(ta(r))return!1;let o=n?r:Fn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=ko(o)?o:i?Wt(i,o):null;if(!s)return!1;try{let a=ge(F(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Qs)?l:`${l}${Qs}`))}catch{return!1}}function cS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function bd(e,t=!1){return e.includes("$")||e.includes("`")||uS(e)||t&&dS(e)}function uS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function dS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&mS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function mS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function fS(e,t,n,r){try{return ge(F(e,n,r))===ge(F(t,n,r))}catch{try{return ge(e)===ge(t)}catch{return!1}}}function pS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return ge(F(Wt(t,e),n,r))===ge(F(o,n,r))}catch{try{return ge(Wt(t,e))===ge(o)}catch{return!1}}}function gS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Js(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Js(Wt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Js(Wt(a,e),t,i,s)}catch{return!1}}function Js(e,t,n,r){try{return vd(F(e,n,r),F(t,n,r))}catch{return!1}}function Sd(e,t,n,r){if(!t)return!1;try{return vd(F(t,n,r),F(e,n,r))}catch{return!0}}function vd(e,t){let n=ge(e),r=ge(t);return n.startsWith(`${r}${Qs}`)||n===r}var hS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Ed="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",yS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",xd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Rd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",CS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",bS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",SS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Rd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Ae},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:xd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:CS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Ed},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:yS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Ed}};function _d(e,t,n,r=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return vS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function vS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=xS(o),s=o[i];if(!s||!hS.has(OS(s.text)))return null;let a=ES(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",bS);for(let l of a.targets)if(!at(l.text)&&ea(ra(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Rd);for(let l of a.targets)if(n.resolvedCwd&&Dt(ra(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return b("powershell.remove-item-git-metadata",Ae);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",xd);for(let l of a.targets){let c=ir(Ge(ra(l.text),n),n,r,SS);if(c)return c}return null}function ES(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(RS(l))continue;if(s){t.push(na(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=wS(l.text);if(!c){t.push(na(l)),i=i||l.dynamic;continue}if(PS(c.name)){let u=c.value?_S(c.value,l):e[++a];if(u?.kind==="word"){t.push(na(u)),i=i||u.dynamic;continue}i=!0;continue}if(AS(c.name)){n=!0;continue}if(TS(c.name)){r=!0;continue}if(IS(c.name))o=kS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function xS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function na(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function RS(e){return e.kind==="word"&&e.text===","}function ra(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function _S(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function wS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function PS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function AS(e){return"recurse".startsWith(e)}function TS(e){return e.length>=2&&"force".startsWith(e)}function IS(e){return e==="wi"||"whatif".startsWith(e)}function kS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function OS(e){return e.toLowerCase()}var fn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Oo="Unsupported heredoc syntax",wd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var MS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),NS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),DS=new Set(["-o","--output","--query","--subscription"]),LS=new Set;function Pd(e){if(e==="aws")return MS;if(e==="gcloud")return NS;if(e==="az")return DS;return LS}var WS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),GS=new Set;function Ad(e){if(e==="git")return be;if(e==="docker")return WS;return GS}function Je(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=de(e);for(let o of t){if(!BS(n,o.command))continue;if(o.match){if(FS(n,e,o.match))return Td(o);continue}if(!$S(n,e,o.subcommand))continue;if(HS(e,new Set(o.block_args),r))return Td(o)}return null}function Td(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function FS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return zS(r,n.command_path,Pd(e))}function zS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function BS(e,t){return e===M(t)}function $S(e,t,n){if(!n)return!0;return Id(t,1,n,Ad(e))}function Id(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&US(e,i,n,r))return!0;continue}return s===n}return!1}function US(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Id(e,t+2,n,r)}function HS(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var jS=new Set(["-e","--source"]),VS=new Set(["-F","-v","--assign","--field-separator"]),kd=new Set(["-f","--file"]),KS=new Set(["print","printf","return"]),Od=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],qS="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Md(e,t,n){let r=!1;for(let o of YS(e)){let i=ZS(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",qS):null}function ia(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&jS.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(VS.has(a)||kd.has(a))){let l=e[s+1];if(i&&=l!==void 0,kd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function lr(e){return ia(e).sources}function YS(e){return lr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function ZS(e,t){Ee(t,e);let n=e.includes("system")?sa(e,t):null,r=XS(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function sa(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=No(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Nd(e,i+1);continue}if(s==="/"&&Dd(e,i)){i=Ld(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,ar(e[a-1])||ar(e[i]))continue;let l=Mo(e,i);if(e[l]!=="(")continue;l=Mo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=No(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Mo(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function XS(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=No(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=Nd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Dd(e,i)){let f=Ld(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(oa(e,i,"print")||oa(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=Mo(e,m);if(oa(e,d,"getline")){o=!0;let f=ev(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(nv(s,a)){o=!0;let f=QS(e,d);if(!f){r=!0,c=m,i=m;continue}if(!JS(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function ar(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Mo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function JS(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function No(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=tv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function QS(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return No(e,t,n)}function ev(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function tv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function oa(e,t,n){return e.startsWith(n,t)&&!ar(e[t-1])&&!ar(e[t+n.length])}function nv(e,t){return t!==null&&t>=e}function Nd(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Dd(e,t){let n=rv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(ar(e[r-1]))r--;return KS.has(e.slice(r,n+1))}function rv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Ld(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var ov=new Set(["sudo","env","command","builtin"]);function Do(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=iv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function iv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&sv(a,r);if(l)i.push(s);if(!l&&Lr.has(M(a)))break;if(o)break}return i}function sv(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||Xi.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Oe(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return ov.has(e.toLowerCase())}function zt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Fe(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Lo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Lo(e,t,n,r,o,i,s,a,l){let c=bo(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=Co(c.envSplitValues,u);if(!f)throw new N("derivedCommandShape");aa(a),yield*Lo(f,t,m,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new N("wrapperPeelIterations");let d=Do(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])aa(a),yield*Lo(f===d.childIndex?d.tokens:[...u.slice(f)],t,m,r,new Map(o),new Map(i),s,a,!0);return}if(lv(u)){aa(a),yield*Lo([...u.slice(1)],t,m,r,o,i,s,a,l);return}yield av(u,m,r,o,i,l)}function av(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function aa(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function lv(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function la(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function ze(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||ca(r,"recursive")){t=!0;continue}if(r==="-f"||ca(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Wd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>ca(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function ca(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var cv="find -delete permanently removes files. Use -print first to preview.",uv="find -exec rm -rf is dangerous. Use explicit file list instead.",dv=new Set(["-exec","-execdir","-ok","-okdir"]),mv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Gd(e,t){let n=e.map(w),r=fv(e,n,t);if(r)return r;if(Go(n,1)&&!gv(e,n,t)){let s=A(b("find.delete",cv),t.policy);if(s)return s}let o=t.budget??ye(),i=0;while(i<n.length){let s=n[i],a=ht(s??"");if(a>0){i+=a+1;continue}if(!Qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=cr(n,i);i=l.nextIndex;let c=yv(l.tokens,t.environment);if(c){let f=A(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=m?.id.startsWith("custom.")?m:A(m,t.policy);if(d)return d}return null}function fv(e,t,n){if(!Go(t,1)&&!ua(t,n.environment))return null;let o=Wo(e)??K(["."]),i=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=sr(s);for(let l of a.expandedTargets??[w(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Ae)}}if(pv(t)&&i.resolvedCwd&&ld(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return b("find.delete-git-metadata",Ae);return null}function ua(e,t){let n=0;while(n<e.length){if(!Qe(e[n])){n++;continue}let r=cr(e,n),o=Mt([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function pv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function gv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Wo(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Xs(o,n.environment),s=n.trustedTmpdirValue??Lt(o,n.environment),a=n.allowTmpdirVar??!or(o,n.environment),l=Gt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??gt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=sr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((m)=>Cd(m,l,{containmentTarget:hv(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function hv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Wo(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function yv(e,t){let n=ft([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&ze(n))return b("find.exec-rm-recursive-force",uv);return null}function cr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Go(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Qe(r)){n=cr(e,n).nextIndex;continue}let o=ht(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ht(e){return mv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Qe(e){return e!==void 0&&dv.has(e)}import{resolve as UE}from"node:path";function ur(e){let t=Me(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Cv=5,da="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function zd(e,t,n){let r=Fo(e,t,n),o=bv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Cv;a++){let{subcommand:l,rest:c}=xe(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=Rv(m);if(d===null||d.length===0)return{blockedReason:da,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:da,expanded:!0,tokens:i}}function Bd(e,t,n){return Fo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function xe(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=be.has(o)?2:1}return{subcommand:null,rest:[]}}function bv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Fo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=vv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Sv(e,t,n)]}}function Sv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=ma(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=ma(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Fd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Fd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(be.has(i)){o+=2;continue}o++}return r}function vv(e,t){let n=Ev(e,t),r=xv(e,t);return{blockedReason:n===null||r===null?da:null,entries:[...n??[],...r??[]]}}function Ev(e,t){let n=Ze("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=ur(n);if(!o)return null;for(let i of o){let s=ma(i);if(!s)return null;r.push(s)}return r}function xv(e,t){let n=Lu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ze(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ze(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function ma(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Fd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ze(e.slice(r+1),t,n)}}function Rv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return ur(t)}var _v="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",wv="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",Pv="git checkout --force discards uncommitted changes. Use 'git stash' first.",Av="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Tv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Iv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",kv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Ov="git switch --force discards uncommitted changes. Use 'git stash' first.",Mv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Nv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Dv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Lv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Wv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Gv="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Fv="git push --force destroys remote history. Use --force-with-lease for safer force push.",zv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",Bv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",$v="git branch -D force-deletes without merge check. Use -d for safe delete.",Uv="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",Hv="git merge --abort discards merge conflict resolutions. Use 'git status' first.",jv="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Vv="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Kv="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",qv="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Yv="git worktree remove --force can delete uncommitted changes. Remove --force flag.",Zv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Xv=new Set(["--recurse-submodules","--track","-t"]),fa=new Set(["-b","-B","-U"]),pa=new Set(["-c","-C"]),Jv=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var pn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Ud(e,t){let{subcommand:n,rest:r}=xe(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return yt(Qv(r,t));case"switch":return yt(tE(r));case"restore":return yt(rE(r));case"reset":return iE(r);case"clean":return yt(aE(r));case"rm":return yt(lE(r));case"push":return Bt(cE(r));case"branch":return Bt(mE(r));case"stash":return Bt(yE(r));case"worktree":return Bt(CE(r));case"rebase":return yt(fE(r));case"merge":return yt(pE(r));case"tag":return Bt(gE(r));case"reflog":return Bt(hE(r));default:return null}}function yt(e){return e?{...e,localDiscard:!0}:null}function Bt(e){return e?{...e,localDiscard:!1}:null}function Qv(e,t){let{index:n,before:r}=ie(e),o=de(r,{shortOptsWithValue:fa});if(r.some((a)=>O(a,"--force"))||o.has("-f"))return b("git.checkout-force",Pv);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(O(a,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",Tv)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return b("git.checkout-ref-path",Av);return b("git.checkout-double-dash",_v)}let i=nE(e);if(i.length>=2)return b("git.checkout-ambiguous",Iv);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>O(a,"--detach")||O(a,"--track")))return null;if(eE(s)||t(s))return b("git.checkout-double-dash",wv);return null}function eE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function tE(e){let{before:t}=ie(e);if(t.some((r)=>O(r,"--discard-changes")))return b("git.switch-discard-changes",kv);let n=de(t,{shortOptsWithValue:pa});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return b("git.switch-force",Ov);return null}function nE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(Zv.has(r)){n+=2;continue}if(Xv.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function rE(e){let t=oE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",Nv):b("git.restore-unstaged",Mv)}function oE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(Jv.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function iE(e){let t=null;for(let n of e){if(O(n,"--hard")){t=b("git.reset-hard",Dv);break}if(O(n,"--merge")){t=b("git.reset-merge",Lv);break}}if(!t)return null;return sE(e)?Bt(t):yt(t)}function sE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function aE(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return b("git.clean-force",Wv);return null}function lE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",Gv):null}function cE(e){let{before:t,after:n}=ie(e),r=de(t);if(t.some((s)=>O(s,"--mirror")))return b("git.push-mirror",Bv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||$d(t,n).some(uE))return b("git.push-force",Fv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||$d(t,n).some(dE))return b("git.push-delete",zv);return null}function $d(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function uE(e){return e.startsWith("+")||e.includes(":+")}function dE(e){return e.length>1&&e.startsWith(":")}function mE(e){let{before:t}=ie(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return b("git.branch-force-delete",$v);return null}function fE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.rebase-abort",Uv):null}function pE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.merge-abort",Hv):null}function gE(e){let{before:t}=ie(e);return de(t).has("-d")||t.some((r)=>O(r,"--delete"))?b("git.tag-delete",jv):null}function hE(e){return e[0]==="delete"?b("git.reflog-delete",Vv):null}function yE(e){for(let t of e){if(t==="drop")return b("git.stash-drop",Kv);if(t==="clear")return b("git.stash-clear",qv)}return null}function CE(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",Yv);return null}import{dirname as GE,isAbsolute as FE,join as om,resolve as zE}from"node:path";var ha="TMPDIR",ya="IFS",jd=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Vd=/^[A-Za-z_][A-Za-z0-9_]*$/,Kd=new Set(["export","typeset","declare","readonly"]),bE=new Set(["builtin","command","time"]),qd=new Set(["do","then","else"]),SE=new Set(["do","then","case"]),Hd=new Set(["done","fi","esac"]),vE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Yd(e,t){return e.map((n)=>n.provenance==="variable"&&tm(n.text)?dr(n.text,t.shellAssignments):w(n))}function dr(e,t){return e.replace(vE,(n,r,o)=>t.get(r??o??"")??n)}function Zd(e,t){return{env:e,effectiveEnvAssignments:_E(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Xd(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ca(e,t){let n=Qd(e,t),r=e[0]??"";if(SE.has(r))t.bodyDepth+=1;if(r==="elif"||Hd.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(Hd.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);ba(t,a)});let o=n.commandIndex;if(o!==-1&&Kd.has(e[o]??""))e.filter((a)=>Vd.test(a)&&ga(a)).forEach((a)=>{wE(t,a)});let i=o===-1?-1:em(e,o);if(i===-1||e[i]!=="unset")return;let s=AE(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(qd.has(r)){t.shellAssignments.set(a,"");return}PE(t,a)})}function Jd(e,t){let n=Qd(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Qd(e,t){let n=qd.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!tm(a)),o=r!==-1&&Kd.has(e[em(e,r)]??""),i=RE(t);return{assignments:e.flatMap((a,l)=>{let c=EE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!go(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function em(e,t){let n=t;while(bE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function tm(e){return Pe(e)!==null||jd.test(e)}function EE(e,t,n){return Pe(e)??xE(e,t,n)}function xE(e,t,n){let r=ho(e,n,t);if(r)return r;let o=e.match(jd)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function ga(e){return e===ha||e===ya||Us(e)}function RE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function _E(e,t){let n=[ha,ya].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ba(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function wE(e,t){ba(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function PE(e,t){if(!ga(t)&&!Vd.test(t))return;if(e.shellAssignments.set(t,""),go(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!ga(t)||t===ha||t===ya||Nn(t)){ba(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function AE(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as TE}from"node:path";function zo(e,t){return $s.some((n)=>t?.has(n)||e.has(n))}function gn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(TE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=nm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=nm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=be.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function nm(e,t,n){try{let r=mt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function rm(e,t,n){if(!t.localDiscard||!n.worktreeMode||zo(n.environment.env,n.envAssignments))return null;let r=gn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Sa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Sa(e,t,n){let{subcommand:r,rest:o}=xe(e),i=r?.toLowerCase();if(t.dynamicArguments||IE(o)||DE(e,t.environment.env,t.envAssignments,n)||ME(o)||kE(i,o))return!0;return i==="clean"&&NE(o)>1}function IE(e){return e.some((t)=>/[$*?[]/.test(t))}function kE(e,t){if(e==="checkout"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:fa}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:pa}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||OE(s))||r.has("-C");return o&&i}return!1}function OE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function ME(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function NE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function DE(e,t,n,r){if(Ze("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Fo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>WE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||LE(s.value);if(Gu(n))return!0;return r.recursiveSubmodules}function LE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function WE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function im(e,t,n){let r=e.map(w),o=n.environment.paths,i=gn(r,n.cwd,o),s=n.originalCwd?o.realpath(zE(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||zo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?$E(e,n.shellAssignments,o):sm(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!BE(a,r,t,n)||!mn(a,n.environment)||To(a,n.environment)||Io(s,a)||Io(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function BE(e,t,n,r){let o=r.environment.paths,i=om(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!Sa(t,r,s)}function $E(e,t,n){let r=xe(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?dr(a,t??new Map):a;if(!FE(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function sm(e,t){if(t.entryKind(om(e,".git"))!=="missing")return e;let n=GE(e);return n===e?null:sm(n,t)}var HE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",jE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Bo(e,t){return am(e,t)}function am(e,t,n){let r=e.map(w),o=zd(r,t.environment.env,t.envAssignments),i=o.blockedReason?A(b("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Wu(t.envAssignments)||Bd(r,t.environment.env,t.envAssignments))&&VE(s))return b("git.ssh-env",HE);let a=Ud(s,(c)=>{let u=gn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(UE(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=rm(r,a,t)??im(e,a,t);if(!l)return a;return n?.(l),null}function lm(e,t){let n=null;return{match:am(e,t,(o)=>{n=o}),relaxation:n}}function VE(e){let{subcommand:t,rest:n}=xe(e),r=t?.toLowerCase();if(!r)return!1;if(jE.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&KE(n)}function KE(e){return e.find((t)=>!qE(t))?.toLowerCase()==="update"}function qE(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as Tx}from"node:path";function cm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function $o(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var um="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",YE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ZE="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",mm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",XE="rm -rf in home directory is dangerous. Change to a project directory first.",dm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:mm},git_metadata_target:{id:"rm.git-metadata",reason:Ae},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:ZE},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:XE},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:um},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:YE},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:um}};function Uo(e,t){let n=Gt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=ze(r),i=Wd(r),s=QE(e);for(let a of s){let l=sr(a.word);if(o&&l.unsafeBraceExpansion){let c=A(ir({kind:"outside_anchored_cwd"},n,t.policy,dm),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=Ce(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return b("rm.git-metadata",Ae);if(i&&!o){let d=Ge(u,n,m);if(d.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",mm);if(d.kind==="git_metadata_target")return b("rm.git-metadata",Ae);continue}if(!o)continue;for(let d of JE(u,n,m)){let f=ir(d,n,t.policy,dm),p=A(f,t.policy);if(p)return p}}}return null}function JE(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function QE(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},$t={kind:"dynamic"},ex=new Set(["<","<<","<<-","<<<","<&","<>"]),pm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,tx=/^(?:[0-9]+|[@*])$/,nx=dt.maxWords,rx=dt.maxInputLength;function gm(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`?a+2:a+1,f=ws(e,u,n,s.splice(0));if(!f.terminated)return-1;a=f.next-1;continue}let c=du(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=Gy(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",f=a+(u?3:2);while(f<n&&/[ \t]/.test(e[f]??""))f++;let d=_s(e,f,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Gy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=du(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function du(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!oC(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function io(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Fy(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function so(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function fu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function zy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=By(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function By(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return no(e,t+1,n,16,2,t+1);if(r==="u")return no(e,t+1,n,16,4,t+1);if(r==="U")return no(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return no(e,t,n,8,3,t+1);return{text:r,next:t+1}}function no(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function ao(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function mu(e,t,n,r,o){let i=fu(e,t,n);return{text:r+e.slice(t,i),provenance:Un(o,"variable"),next:i}}function $y(e,t,n){let r=to(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,f=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||f||d){let m=c?3:d?1:2,p=c?"))":d?"`":")",g=Is(e,a+m,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let m=fu(e,a,n);if(m>a+1){r.push(o,a,"literal"),r.push(a,m,"variable"),a=m,o=m;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Un(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function Uy(e,t,n){return t+1>=n||so(e[t+1]??"")||io(e,t+1)!==null}var Hy=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),jy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Vy(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Ky(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Ky(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return qy(e,t);if(n==="env")return Yy(e,t);if(n==="sudo")return Zy(e,t);return}function qy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Yy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Hy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function Zy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(jy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function pu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=gu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>hu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function Xy(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=gu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>hu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>rn(e,t.span.start,t.span.end,a,"literal",!1))}}function gu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((m)=>su(m,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=su(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let f=u.start+c.length-u.end,d=u.alternatives.reduce((m,p)=>m+f+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...Jy(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function su(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&eC(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:Qy(e,r)}}function Jy(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function Qy(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function eC(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function hu(e,t){let n=`x${e}`,r=Ts(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function tC(e,t,n,r){return me({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function on(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ro(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function As(e){return e.used++,e.used<=e.max}function nC(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Hn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Hn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Hn(t.body.nodes)})}function rC(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function yu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function au(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!lu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Ps(e,t){if(!yu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function oC(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var bu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),iC=new Set(["gc","cat","type","cp","mv","rm"]),Su=["-rec","-for","-path","-literalpath","-whatif"],sC=/^\$env:\w/i,aC=/^(?:\$\{?\w+\}?|~)\\./;function vu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...bu].some((o)=>n.includes(o))&&!(n.includes("rm")&&Su.some((o)=>n.includes(o)))&&!n.includes("<#")&&!lC(n))return!1;let r=Ns(e,t);if(Eu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ms(r).some(cC)}function Eu(e){return e.nodes.some((t)=>{if(t.kind==="group")return Eu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function lC(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function cC(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&bu.has(n))return!0;let r=e.slice(t+1);if(n&&iC.has(n)&&r.some(uC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Su.some((s)=>i.startsWith(s))})}function uC(e){return sC.test(e)||aC.test(e)}function Ns(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ds(e,0,e.length,t,0);return me({kind:"program",dialect:"powershell",source:e,span:n,status:gC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ds(e,t,n,r,o,i=!1){let s=[],a=[],l=Qr(),c=0,u=!1,f=()=>{if(l.words.length===0&&l.redirections.length===0)return;let m={start:l.start,end:l.end};eo(s,l,{kind:"command",dialect:"powershell",source:e.slice(m.start,m.end),span:m,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let m=e[d];if(!m)break;if(i&&m==="}")return f(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=pC(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return f(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(m)){if(m==="\r"||m===`
+`){f();let y=m==="\r"&&e[d+1]===`
+`?d+2:d+1;s.push(ks(e,d,y)),d=y;continue}d++;continue}let g=_u(e,d);if(g){f(),s.push(ks(e,d,d+g.length)),d+=g.length;continue}if(m==="{"){if(f(),o>=r.maxDepth)return a.push(Ru(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ds(e,d+1,n,r,o+1,!0),S=y.closed?y.next-1:y.next,E=me({kind:"program",dialect:"powershell",source:e.slice(d+1,S),span:{start:d+1,end:S},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(m==="}"){f(),s.push(ks(e,d,d+1)),d++;continue}if(m===">"||m==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===m?d+2:d+1,S=y;while(/[ \t]/.test(e[S]??""))S++;let E=S<n?Cu(e,S,n,r,o):void 0,v=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:v}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=v,d=v;continue}if(m===","){l.start=l.start===-1?d:l.start,l.words.push(Rs({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=Cu(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),f(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return f(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function Cu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,f=!1,d=(p)=>{let g=dC(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),u+=Os(g.program),f||=g.program.status==="limited",s="command-substitution",g.next},m=t;while(m<n){let p=e[m];if(!p||/\s/.test(p)||_u(e,m)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[m+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),m++;break}i+=g,m+=2;continue}if(e.startsWith("$(",m)){m=d(m);continue}if(p==="'"){a=!0,m++;let g=!1;while(m<e.length){if(e[m]==="'"&&e[m+1]==="'"){i+="'",m+=2;continue}if(e[m]==="'"){g=!0,m++;break}i+=e[m]??"",m++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,m++;let g=!1;while(m<n){let h=e[m];if(h==="`"&&e[m+1]){i+=e[m+1],m+=2;continue}if(h==='"'){g=!0,m++;break}if(e.startsWith("$(",m)){m=d(m);continue}if(h==="$")s=e[m+1]==="("?"command-substitution":"variable";i+=h??"",m++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[m+1]==="("?"command-substitution":"variable";if(p==="@"&&m===t)s="variable";i+=p,m++}return{word:rn(e,t,m,i,s,a,s==="literal"?void 0:fC(e,t,m)),next:m,issues:l,nested:c,words:u,limited:f}}function dC(e,t,n,r,o){let i=xu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Ru(r.maxDepth)],nodes:[]}),next:a};let l=Ds(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function xu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Os(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Os(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Os(r)}}return t}function fC(e,t,n){let r=to(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=xu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=mC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function mC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Ru(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ms(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ms(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ms)]})}function _u(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function pC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function gC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ks(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Ne(e,t="auto",n=ft){if(t==="powershell"||t==="auto"&&vu(e.slice(0,n.maxInputLength),n))return Ns(e,n);return cu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function sn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function co(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Ls(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function jn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function xe(e,t){jn(e,t)}function kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Ws(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Y(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function Ze(e,t,n){return!kt(C(e,t-1))&&j(e,t,n)&&!kt(C(e,t+n.length))}function Xe(e,t){return kt(C(e,t-1))!==kt(C(e,t))}function oe(e){return e===`
+`||e===";"||e==="&"||e==="|"}function an(e){return e==="|"||e===";"}function uo(e,t,n){let r=Ls(e,n);if(t==="rm")return hC(r);if(t==="dd")return CC(r);return ku(r,!0)}function fo(e,t,n){let r=Ls(e,n);if(t==="rm")return bC(r);if(t==="reset-hard")return Tu(r,"--ha","rd");if(t==="reset-merge")return Tu(r,"--me","rge");if(t==="clean")return xC(r);if(t==="checkout")return _C(r);if(t==="push-force")return wC(r);if(t==="push-refspec")return AC(r);if(t==="push-delete")return PC(r);if(t==="branch")return TC(r);if(t==="tag")return OC(r);if(t==="restore")return MC(r);return ku(r,!1)}function hC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Ze(e,i,"rm")&&H(l)&&l!==`
+`)t=!0,i++;continue}let a=yC(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=wu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=wu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function yC(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function wu(e,t,n){if(Au(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Au(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Au(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function CC(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(C(e,n))){t=!1;continue}if(Ze(e,n,"dd")){t=!0,n++;continue}if(!t||!Ze(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function bC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=C(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=vC(e,o);if(s>=0){if(SC(e,s))return!0;let a=s,l=!1;while(H(C(e,a)))l||=C(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(C(e,o-1)))&&(!C(e,o+2)||H(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&Xe(e,o+11)||Gs(e,o,"recursive"),r||=j(e,o,"--force")&&Xe(e,o+7)||Gs(e,o,"force"),n&&r)return!0;o++}return!1}function Gs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&Xe(e,t+r+2)}function SC(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(C(e,n)))n++;let i=n;while(n<Y(e)&&!H(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=Pu(e,i,"recursive"),a=Pu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=EC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Pu(e,t,n){return j(e,t,`--${n}`)&&Xe(e,t+n.length+2)||Gs(e,t,n)}function vC(e,t){if(t>0&&kt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!H(C(e,n+1)))return-1;return n+1}function EC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=C(e,c)??"",f=(u==="r"||u==="f")&&Xe(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&f,s||=u==="f"&&f,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&f,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Tu(e,t,n){return Kn(e,"reset",an,!0,(r)=>C(e,r)==="-"&&ln(e,r,t,n)?!0:r)}function xC(e){return Kn(e,"clean",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(ln(e,t,"--fo","rce"))return!0;let n=Vn(e,t,an);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function mo(e,t,n){if(!Ze(e,t,"git"))return null;let r=t+3;if(!H(C(e,r)))return{commandEnd:-1,next:r};while(H(C(e,r)))r++;while(r<Y(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=Vn(e,r,oe);if(Ze(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=RC(e,r,o);r=o;while(H(C(e,r)))r++;if(i)return{commandEnd:Ze(e,r,n)?r+n.length:-1,next:Vn(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=Vn(e,r,oe);while(H(C(e,r)))r++}return{commandEnd:-1,next:r}}function RC(e,t,n){for(let r of Se)if(n-t===r.length&&j(e,t,r))return!0;return!1}function _C(e){return Iu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function wC(e){return Kn(e,"push",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!kt(C(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Ou(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function AC(e){return Kn(e,"push",oe,!1,(t)=>{if(H(C(e,t))&&C(e,t+1)==="+"&&t+2<Y(e)&&!oe(C(e,t+2))&&!H(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function PC(e){return Kn(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&ln(e,t,"--de","lete"))return!0;if(H(C(e,t))&&C(e,t+1)===":"&&t+2<Y(e)&&!H(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function TC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=mo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=Vn(e,o,oe),s=IC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function IC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(ln(e,i,"--de","lete"))r=!0;if(ln(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&kC(C(e,s))){let u=C(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!Xe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function kC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function OC(e){return Iu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Iu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=mo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(ln(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Xe(e,r+1))return!0;if(an(o))i.outerActive=!1}return!1}function Kn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=mo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(C(e,u)))i=!1;s=c}if(l)i=!1}return!1}function MC(e){let t=!1;for(let n=0;n<Y(e);n++){if(Ws(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=mo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function ku(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=C(e,r),i=t?Ws(o):oe(o);if(n&&H(o)&&C(e,r+1)==="-"&&Ze(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Ze(e,r,"find"))n=!0,r+=3}return!1}function Vn(e,t,n){let r=t;while(r<Y(e)&&!H(C(e,r))&&!n(C(e,r)))r++;return r}function Ou(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return Xe(e,o)?o:-1}function ln(e,t,n,r){return Ou(e,t,n,r)>=0}function Ae(e,t){jn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)xe(t,a);if((s.regex?.test(a)??!1)||s.scan&&fo(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var NC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Nu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;jn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Du(t.nodes,r,i)}function Du(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Du(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return DC(r,t,n)})}function DC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!NC.test(o.text));return e.words.every((o,i)=>o===t||Mu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Mu(o.target.raw,n.anchored,!0)))}function Mu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as LC,resolve as Lu}from"node:path";function qn(e,t,n,r){let o=LC(e)?Lu(e):t?Lu(t,e):void 0;if(!o)return;try{return F(o,n,r)}catch{return o}}function Wu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var cn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Yn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",zs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),WC=new Set(["-p","--print"]),GC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),FC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),zC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),BC=new Map([["python",new Set(["m"])]]),$C=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),UC=new Set(["always","default","never"]),HC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),jC=/\\\r?\n/g,VC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Gu(e){return go(e).code}function po(e){return go(e).sources}function Fu(e){return VC.get($s(e))??[]}function go(e){let t=$s(e[0]??"");if(!zs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return De(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return De(t,n,r,o,i,s);if(t==="node"&&WC.has(s)){let f=e[i+1];if(f===void 0)return De(t,n,r,o);if(f.startsWith("-"))continue;n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),i++;continue}if(qC(t,s)){let f=e[i+1];if(f===void 0)return De(t,n,r,o);if(n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),t==="python")return De(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(YC(t)&&a){let f=a[1]??"";n.push({tokenIndex:i,value:f}),r.push({tokenIndex:i,kind:"inline-code",value:f});continue}if(t==="node"){let f=KC(s);if(f){if(f.attached){if(o&&=f.value!=="",f.value!=="")r.push({tokenIndex:i,kind:"module-file",value:f.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,De(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return De(t,n,r,o);if($C.get(t)?.has(s)){let f=e[i+1];if(f===void 0||f.startsWith("-")&&!(t==="ruby"&&HC.has(s))||t==="python"&&!UC.has(f))return De(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let f=1;f<s.length;f++){let d=s[f];if(d===void 0)break;if(BC.get(t)?.has(d)){let m=s.slice(f+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return De(t,n,r,o)}if(GC.get(t)?.has(d)){l=s.slice(f+1)||e[i+1],c=f+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&d==="r"){let m=s.slice(f+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let m=s.slice(f+1);if(!m){if(o=!1,f+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(FC.get(t)?.has(d)){if(f+1===s.length)i++;break}if(zC.get(t)?.has(d)&&f+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return De(t,n,r,o);if(c)i++}return De(t,n,r,o,void 0,void 0,!0)}function De(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function KC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Bs(e,t){return $s(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function $s(e){let t=k(e).toLowerCase();return Lr.test(t)?"python":t}function qC(e,t){return zs.get(e)?.has(t)??!1}function YC(e){return zs.get(e)?.has("--eval")??!1}function Zn(e,t,n=!1){let r=JC(e,t);if(!Fs(r,t))return!1;xe(t,r);let o=XC(r);if(Fs(o,t))return!0;if(xe(t,o),!zu.test(o))return!1;return!n||ZC(r,t)}function ZC(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let n=e.split(""),r=[];for(let s=0;s<e.length;s++){let a=e[s];if(a!=="'"&&a!=='"')continue;let l=e.startsWith(a.repeat(3),s)?a.repeat(3):a,c=s+l.length,u=c;while(u<e.length&&!e.startsWith(l,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;r.push({start:c,text:e.slice(c,u)}),n.fill(" ",s,u+l.length),s=u+l.length-1}let o=n.join(""),i=Array.from(o.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((s)=>zu.test(s[1]??"")).map((s)=>{let a=s.index+s[0].length;return{start:a,end:Us(o,a)}});if(i.some((s)=>Hs(o,s.start)))return!0;return r.some((s)=>(/\b(?:system|exec|spawn|popen)\s*$/.test(o.slice(0,s.start))||i.some((a)=>s.start>=a.start&&s.start<a.end))&&Fs(s.text,t))}function Us(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Hs(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var zu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function XC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Fs(e,t){if(uo(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(xe(t,e),r.test(e))return!0;if(uo(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(xe(t,e),r.test(e))return!0;if(uo(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(xe(t,e),n.some((o)=>fo(o,r))))}function JC(e,t){return xe(t,e),e.replace(jC,"")}import{isAbsolute as fd,relative as md}from"node:path";import{isAbsolute as Ku,parse as lb}from"node:path";import{dirname as QC,isAbsolute as eb,parse as tb,sep as nb}from"node:path";function mt(e,t,n){if(lt(t))throw Error("Unsupported Windows namespace path");let r=eb(t)?tb(t).root:"",o=r||e;for(let i of ob(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=QC(o);continue}let s=rb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function rb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${nb}${t}`}function ob(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var js=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],ib=new Set(js),sb=1024,Bu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),$u=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),ab=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function ho(e){return ib.has(e)}function Vs(e){return ho(e)||Bu.has(e)||$u.has(e)||Nn(e)}function Je(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Uu(e,t){let n=Je("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=sb?{state:"valid",count:r}:{state:"invalid"}}function yo(e,t,n){let o=e.match(ab)?.[1];if(!o||!Vs(o))return null;let i=e.indexOf("=");return{name:o,value:`${Je(o,t,n)??""}${e.slice(i+1)}`}}function Hu(e){return Vu(e,$u)}function ju(e){return Vu(e,Bu)}function Vu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Yu=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!Yu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Co(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Zu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Ot(e,t,n,r){if(!Zu(un(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let f=0;f<V.wrapperPeelIterations.cap;f++){let d=qu(i),m=Co(i);for(let[g,h]of m.envAssignments)s.set(g,h),a.set(g,h);if(i=m.words,i.length===0)break;while(i.length>0&&un(i).includes("=")&&!ub(i)){let g=db(un(i),a,t.env)??yo(un(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=un(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=mb(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=hb(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=yb(i);if(p==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(qu(i)===d)break}let u=Co(i);for(let[f,d]of u.envAssignments)s.set(f,d),a.set(f,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:cb(u.words,o)}}function cb(e,t){return e.some((n)=>!t.has(n))}function qu(e){return e.map(w).join(" ")}function un(e){let t=e[0];return t?w(t):""}function Le(e,t){let n=e[t];return n?w(n):void 0}function ub(e){return Yu.test(un(e))}function db(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var fb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function mb(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?Xn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Xn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Xn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(fb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var pb=new Set(["-i","-0","--null"]),gb=new Set(["-u","--unset","-C","--chdir","-P"]);function hb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let f of n.keys())o.set(f,"");o.set("TMPDIR",""),a++;continue}if(pb.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let f=Le(e,a+1);if(f!==void 0)o.set(f,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(gb.has(c)){if(c==="-C"||c==="--chdir"){let f=Le(e,a+1);s=f?Xn(s,f,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let f=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Xn(s,f,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let f=Pe(Le(e,a)??"");if(!f)break;o.set(f.name,f.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function Xn(e,t,n){if(t==="")return null;if(!e&&!Ku(t))return null;let r=Ku(t)?lb(t).root:n.realpath(e??"/");if(r===null)return null;try{return mt(r,t,n)}catch{return null}}function yb(e){if(Le(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var Cb=/['"\\$`{}#]/;function bo(e,t){if(e.some((r)=>Cb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function pt(e,t,n){return So(e,t,n).tokens}function bb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Mt(e,t,n,r=0){let o=So(e,t,n),i=(o.envSplitValues??[]).flatMap(bb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Mt(s,t,n,r+1)}function So(e,t,n,r){if(!Zu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Ot(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Zs=Symbol("adopt-as-operand"),Sb=new Set(["env","sudo","command","builtin"]),vb=new Set(["&&","||","|&","|","&",";"]),Eb=new Set(["<<","<<<",">|"]),xb=new Set(["|","|&"]),Rb=/[*@#?$!_-]/,_b=/^\w+(?::\w+)*/,wb=Object.freeze([]),Jn=Object.freeze({kind:"scope",edge:"enter"}),Qn=Object.freeze({kind:"scope",edge:"exit"}),Ab=Object.freeze([]),Pb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),er=new Set(["bash","sh","zsh","dash","ksh"]),Tb=256,td=new WeakMap;function nd(e,t){let n=t.status==="complete"?new Set(Ys(t)):new Set,r=Ob(e,n);if(Gr(r))return vo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Nt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return vo("structural-limit",r,t);if(o.invalid)return vo("invalid",r,t);let s=vo("complete",r,t,o.assignmentFallbacks);return td.set(s,Object.freeze(i)),s}function xo(e,t,n,r,o){let i=o.word??((f)=>f),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let f of rd(e)){if(f.kind==="scope"){if(f.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let m=u.pop();if(m===void 0)throw Error("scope exit without a matching enter");s=m.state,a=m.segment,l=m.shellWords,c=m.pipeProducer;continue}if(f.kind==="operator"){if(!f.boundary)continue;let d=o.segment(a,s,c,f.operator,l);if(d)return d;s=Ib(a,s,n,r),c=a.length>0&&xb.has(f.operator)?a:null,a=[],l=new Set;continue}if(f.kind==="redirection"){if(f.fd!==void 0)l.add(a.length-1);if(f.target===void 0)continue;let d=o.redirection({operator:f.operator,role:f.role,targetOrder:f.targetOrder,target:f.target,...f.body===void 0?{}:{body:f.body,consumer:f.consumer}},s);if(d===Zs){l.add(a.length),a.push(i(f.target));continue}if(d)return d;continue}a.push(i(f.text))}return o.segment(a,s,c,null,l)}function Ro(e){return rd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function Ib(e,t,n,r){let o=tr(e)?new Map([...t.variables,...kb(e,t.variables)]):t.variables,i=pt([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function kb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function rd(e){return td.get(e)??wb}function Ob(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function vo(e,t,n,r=Ab){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Nt(e,t){return e.nodes.flatMap((n,r)=>Mb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function Mb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(Gb(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[Eo("{"),...Nt(e.body,a),...s?[Eo("}")]:[]]:[Jn,We("("),...Nt(e.body,a),...s?[We(")")]:[],Qn]}]}let o=$b(e,r.functions);if(o){if(r.depth>=ft.maxDepth||++r.flags.expansions>Tb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Xu(e,r),Eo(";"),...Nt(o,{...r,depth:r.depth+1}),Eo(";")]},...Ju(e,t,n,r)]}return[{start:e.span.start,events:Xu(e,r)},...Ju(e,t,n,r)]}function Xu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:id(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:Nb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function Nb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?id(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[Xs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:Fb(r),targetOrder:Eb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:ad(t)}:{}}),...s===void 0?o:o.slice(1)]}function Ju(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[Xs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...od(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?Db(t,n,r):[]]}function Db(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:od(n.source.slice(r.span.end,e.span.end),n)}]}function od(e,t){if(t.depth>=ft.maxDepth)return t.flags.limited=!0,[];let n=Ne(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Nt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function id(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?Xs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of Ks(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(We(m));continue}s+=m.text,a||=m.glob}continue}let u=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=Ks(m,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=u?Nt(u,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(Jn,...p,Qn);continue}let f=u?Nt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Jn,...f,Qn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Jn,...f,...c.raw.endsWith(")")?[We(")")]:[],Qn);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>We("(")),...d===1?[Jn]:[],...f,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>We(")")):[],...d===1?[Qn]:[])}return l(),o}function Ks(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Qu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Qu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Qu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=Wb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return Lb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&Rb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?_b:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function Lb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Ks(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function Wb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Gb(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:vb.has(e)})}function Eo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function Xs(e){return Object.freeze({kind:"word",text:e})}function Fb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function nr(e){return Pb.has(e)||/^python\d/.test(e)}var zb=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function sd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=zb.get(e)?.has(n)??!1;return sd(e,t.slice(r?2:1))}function qs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return qs(e.slice(1));if(!Sb.has(t))return[...e];return qs(sd(t,e.slice(1)))}function ad(e){let t=$n(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return qs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function Bb(e){let t=ad(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return nr(n)&&!er.has(n)}function Ys(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Ys(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Ys(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(Bb(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!Hb(t))return r;return[...r,...o]})}function $b(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function gt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function Ub(e){if(gt(e.words[0],"git"))return gt(e.words[1],"commit");if(!gt(e.words[0],"gh")||!gt(e.words[2],"create"))return!1;return gt(e.words[1],"pr")||gt(e.words[1],"issue")}function Hb(e){return(gt(e.words[0],"cat")||gt(e.words[0],"tee")||Ub(e))&&!e.words.some(ed)&&!e.redirections.some((n)=>ed(n.target))}function ed(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var ld=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),cd=new Set([...ld,"glob"]),jb=new Set([...cd,"pattern"]);class Ge extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function rr(e){let t=Vb(),n=Tn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:Kb(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Qe(e,t){if(!e.includes("$"))return e;return Ei(e,t)}function Vb(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Ne(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let f={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,f),f}let l=e.get(i);if(l)return l;let c=nd(i,a);return e.set(i,c),c},getCommandProgram:r}}function Kb(e){let t=e.route.kind==="grep"?cd:e.route.kind==="glob"?jb:ld;return[...Tl(e.input,t),...e.route.kind==="patch"?Ol(e.input):[]]}var qb=new Set(["-S","--suffix"]);function dn(e,t,n,r,o){if(e.status==="structural-limit")throw new Ge;if(e.status!=="complete")return o.findMalformedTarget(e.source);return xo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function _o(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&qb.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function pd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Pr(e.invocation.toolName))return null;let a=e.paths.find((l)=>ud(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=dn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>Jb(a,l,t,n,r),isRedirectionTarget:(a,l)=>ud(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Ao(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Js(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(f)=>c?wo(f,l):Yb(f,l);if(n.markerFiles.some(u))return!0;return r&&dd(n).some(u)}if(Js(a,n))return!0;return r&&dd(n).some((c)=>wo(c,a))}function Yb(e,t){let n=md(t,e);if(n===""||n.startsWith("..")||fd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function Zb(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function Xb(e,t,n,r,o){if(!n)return!1;return Js(Ao(se(e,t,r,o)),n)}function ud(e,t,n,r,o,i){let s=Ao(se(e,t,r,o));return i.includes(s)||hd(s,n)}function gd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>wo(i,Ao(se(s,t,r,o)))))}function Js(e,t){return t.entries.includes(e)||t.directories.includes(e)||hd(e,t)}function hd(e,t){return t.hooksDirectories.some((n)=>wo(e,n))}function dd(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function wo(e,t){let n=md(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!fd(n)}function Ao(e){return process.platform==="win32"?e.toLowerCase():e}function Jb(e,t,n,r,o){if(tr(e))return null;let i=Mt([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=_o(i.slice(1)),a=s.sources.find((l)=>Zb(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&Xb(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Oo,normalize as sS,parse as aS,posix as Rd,resolve as Wt,sep as na}from"node:path";import{isAbsolute as Qb,join as yd,normalize as Sd,parse as eS,sep as Cd}from"node:path";var tS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],nS=` 	
+`;function or(e,t){if(ht(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Qs(e.get("TMPDIR")??"",t)}function Lt(e,t){if(e.has("TMPDIR"))return Qs(e.get("TMPDIR")??"",t);let n=ea(e,t);if(n===void 0)return!0;return Qs(n,t)}function ea(e,t){return Ed(e,t,"TMPDIR")}function Qs(e,t){if(!e)return!1;if(oS(e))return!1;return fn(e,t)}function ht(e,t){let n=Ed(e,t,"IFS");return n!==void 0&&n!==""&&n!==nS}function fn(e,t){let n=Po(e,t.paths);if(n===null)return!1;return vd(t).some((r)=>ko(n,r))}function Io(e,t){let n=Po(e,t.paths);if(n===null)return!1;return vd(t).some((r)=>To(r)===To(n))}var bd=new WeakMap;function vd(e){let t=bd.get(e);if(t)return t;let n=rS(e);return bd.set(e,n),n}function rS(e){let t=tS.map((r)=>Po(r,e.paths)??Sd(r)),n=Po(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&iS(n))return[...t,n];return t}function oS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Ed(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function iS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Po(e,t){try{let n=Sd(e);if(!Qb(n))return n;let r=eS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=yd(i,o[s]??"");if(t.entryKind(a)==="missing")return yd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function ko(e,t){let n=To(e),r=To(t);if(n===r)return!0;let o=r.endsWith(Cd)?r:`${r}${Cd}`;return n.startsWith(o)}function To(e){return process.platform==="win32"?e.toLowerCase():e}var lS=process.platform==="win32",xd=64,cS=16384;function ir(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return b(o.id,o.reason)}function sr(e){let t=pu(e,xd,xd,cS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:uS(e)}}function uS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>dS(e.raw,n.span.start-e.span.start))}function dS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Gt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Ce();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:yS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Fe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&bS(e))return{kind:"outside_anchored_cwd"};let o=!r&&wd(e,t.posixShell);if(lt(e))return{kind:"outside_anchored_cwd"};if(ra(e,r))return{kind:"root_or_home_target"};if(mS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(pS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(CS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&xS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>RS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(_S(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(fS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function fS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Oo(r)||r.startsWith("~"))return!1;if(oa(r))return!1;if(Ad(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return fn(Wt(t.resolvedCwd,r),t.environment)}function _d(e,t,n={}){let{containmentTarget:r,...o}=n;if(Fe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(hS(i))return!1;if(Io(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Ad(r??i,s,t.environment.paths,t.budget))}function ra(e,t=!1){let n=e.trim(),r=Rd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function mS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Oo(o)?o:t.resolvedCwd?Wt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(F(i,t.environment.paths,t.budget));if(s===aS(s).root)return!0;return s===he(F(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=sS(e);if(lS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function pS(e,t,n,r,o,i,s,a){let l=e.trim();if(oa(l))return!1;if(!r&&fn(l,a))return!0;return(t||i&&s)&&n&&!o&&gS(l,n)}function gS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!wd(e.slice(n.length+1),t)})}function hS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Rd.normalize(`/${t[1]??""}`)==="/"}function oa(e){return e.split(/[\\/]+/).includes("..")}function yS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Fn(o.trim(),t);if(!Oo(i))return[];try{let s=F(i,n,r);if(zn(s,F(t,n,r)))return[];return[he(s)]}catch{return[]}})}function CS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(oa(r))return!1;let o=n?r:Fn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Oo(o)?o:i?Wt(i,o):null;if(!s)return!1;try{let a=he(F(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(na)?l:`${l}${na}`))}catch{return!1}}function bS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function wd(e,t=!1){return e.includes("$")||e.includes("`")||SS(e)||t&&vS(e)}function SS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function vS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&ES(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function ES(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function xS(e,t,n,r){try{return he(F(e,n,r))===he(F(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function RS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(F(Wt(t,e),n,r))===he(F(o,n,r))}catch{try{return he(Wt(t,e))===he(o)}catch{return!1}}}function _S(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ta(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ta(Wt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ta(Wt(a,e),t,i,s)}catch{return!1}}function ta(e,t,n,r){try{return Pd(F(e,n,r),F(t,n,r))}catch{return!1}}function Ad(e,t,n,r){if(!t)return!1;try{return Pd(F(t,n,r),F(e,n,r))}catch{return!0}}function Pd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${na}`)||n===r}var wS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Td="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",AS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Id="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",kd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",PS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",TS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",IS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:kd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Te},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Id},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:PS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Td},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:AS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Td}};function Od(e,t,n,r=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return kS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function kS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=MS(o),s=o[i];if(!s||!wS.has($S(s.text)))return null;let a=OS(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",TS);for(let l of a.targets)if(!lt(l.text)&&ra(sa(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",kd);for(let l of a.targets)if(n.resolvedCwd&&Dt(sa(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return b("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",Id);for(let l of a.targets){let c=ir(Fe(sa(l.text),n),n,r,IS);if(c)return c}return null}function OS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(NS(l))continue;if(s){t.push(ia(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=LS(l.text);if(!c){t.push(ia(l)),i=i||l.dynamic;continue}if(WS(c.name)){let u=c.value?DS(c.value,l):e[++a];if(u?.kind==="word"){t.push(ia(u)),i=i||u.dynamic;continue}i=!0;continue}if(GS(c.name)){n=!0;continue}if(FS(c.name)){r=!0;continue}if(zS(c.name))o=BS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function MS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function ia(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function NS(e){return e.kind==="word"&&e.text===","}function sa(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function DS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function LS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function WS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function GS(e){return"recurse".startsWith(e)}function FS(e){return e.length>=2&&"force".startsWith(e)}function zS(e){return e==="wi"||"whatif".startsWith(e)}function BS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function $S(e){return e.toLowerCase()}var mn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Mo="Unsupported heredoc syntax",ar="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Md="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var US=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),HS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),jS=new Set(["-o","--output","--query","--subscription"]),VS=new Set;function Nd(e){if(e==="aws")return US;if(e==="gcloud")return HS;if(e==="az")return jS;return VS}var KS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),qS=new Set;function Dd(e){if(e==="git")return Se;if(e==="docker")return KS;return qS}function et(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=fe(e);for(let o of t){if(!XS(n,o.command))continue;if(o.match){if(YS(n,e,o.match))return Ld(o);continue}if(!JS(n,e,o.subcommand))continue;if(ev(e,new Set(o.block_args),r))return Ld(o)}return null}function Ld(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function YS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return ZS(r,n.command_path,Nd(e))}function ZS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function XS(e,t){return e===M(t)}function JS(e,t,n){if(!n)return!0;return Wd(t,1,n,Dd(e))}function Wd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&QS(e,i,n,r))return!0;continue}return s===n}return!1}function QS(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Wd(e,t+2,n,r)}function ev(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var tv=new Set(["-e","--source"]),nv=new Set(["-F","-v","--assign","--field-separator"]),Gd=new Set(["-f","--file"]),rv=new Set(["print","printf","return"]),Fd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],ov="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function zd(e,t,n){let r=!1;for(let o of iv(e)){let i=sv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",ov):null}function la(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&tv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(nv.has(a)||Gd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Gd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function cr(e){return la(e).sources}function iv(e){return cr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function sv(e,t){xe(t,e);let n=e.includes("system")?ca(e,t):null,r=av(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ca(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Do(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Bd(e,i+1);continue}if(s==="/"&&$d(e,i)){i=Ud(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,lr(e[a-1])||lr(e[i]))continue;let l=No(e,i);if(e[l]!=="(")continue;l=No(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Do(e,l,c);if(!u){r=!0,o=!0;continue}if(l=No(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function av(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let m=Do(e,i,u);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(u==="#"){i=Bd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&$d(e,i)){let m=Ud(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
+{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(aa(e,i,"print")||aa(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let f=e[i+1]==="&"?i+2:i+1,d=No(e,f);if(aa(e,d,"getline")){o=!0;let m=uv(s,l,c);if(r||=m===null,m!==null)n.push(m);c=f,i=f;continue}if(fv(s,a)){o=!0;let m=cv(e,d);if(!m){r=!0,c=f,i=f;continue}if(!lv(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=f,i++}if(!o)return null;return{dynamic:r,commands:n}}function lr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function No(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function lv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Do(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=dv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function cv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Do(e,t,n)}function uv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function dv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function aa(e,t,n){return e.startsWith(n,t)&&!lr(e[t-1])&&!lr(e[t+n.length])}function fv(e,t){return t!==null&&t>=e}function Bd(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function $d(e,t){let n=mv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(lr(e[r-1]))r--;return rv.has(e.slice(r,n+1))}function mv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Ud(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var pv=new Set(["sudo","env","command","builtin"]);function Lo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=gv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function gv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&hv(a,r);if(l)i.push(s);if(!l&&Wr.has(M(a)))break;if(o)break}return i}function hv(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||Xi.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return pv.has(e.toLowerCase())}function zt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function ze(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Wo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Wo(e,t,n,r,o,i,s,a,l){let c=So(e,t,n,i);for(let[m,p]of c.envAssignments)i.set(m,p),o.set(m,p);let{tokens:u,cwd:f}=c;if(c.envSplitValues){let m=bo(c.envSplitValues,u);if(!m)throw new N("derivedCommandShape");ua(a),yield*Wo(m,t,f,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new N("wrapperPeelIterations");let d=Lo(u,s);if(d){for(let m of[d.childIndex,...d.alternativeChildIndices])ua(a),yield*Wo(m===d.childIndex?d.tokens:u.slice(m),t,f,r,new Map(o),new Map(i),s,a,!0);return}if(Cv(u)){ua(a),yield*Wo(u.slice(1),t,f,r,o,i,s,a,l);return}yield yv(u,f,r,o,i,l)}function yv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function ua(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function Cv(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function da(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Be(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||fa(r,"recursive")){t=!0;continue}if(r==="-f"||fa(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Hd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>fa(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function fa(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var bv="find -delete permanently removes files. Use -print first to preview.",Sv="find -exec rm -rf is dangerous. Use explicit file list instead.",vv=new Set(["-exec","-execdir","-ok","-okdir"]),Ev=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function jd(e,t){let n=e.map(w),r=xv(e,n,t);if(r)return r;if(Fo(n,1)&&!_v(e,n,t)){let s=P(b("find.delete",bv),t.policy);if(s)return s}let o=t.budget??Ce(),i=0;while(i<n.length){let s=n[i],a=yt(s??"");if(a>0){i+=a+1;continue}if(!tt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=ur(n,i);i=l.nextIndex;let c=Av(l.tokens,t.environment);if(c){let m=P(c,t.policy);if(m)return m}let u=s==="-execdir"||s==="-okdir",f=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=f?.id.startsWith("custom.")?f:P(f,t.policy);if(d)return d}return null}function xv(e,t,n){if(!Fo(t,1)&&!ma(t,n.environment))return null;let o=Go(e)??K(["."]),i=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=sr(s);for(let l of a.expandedTargets??[w(s)]){let c=Fe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Te)}}if(Rv(t)&&i.resolvedCwd&&gd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return b("find.delete-git-metadata",Te);return null}function ma(e,t){let n=0;while(n<e.length){if(!tt(e[n])){n++;continue}let r=ur(e,n),o=Mt([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function Rv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function _v(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Go(e);if(!r)return!1;let o=n.envAssignments??new Map,i=ea(o,n.environment),s=n.trustedTmpdirValue??Lt(o,n.environment),a=n.allowTmpdirVar??!or(o,n.environment),l=Gt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??ht(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=sr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((f)=>_d(f,l,{containmentTarget:wv(f,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function wv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Go(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function Av(e,t){let n=pt([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&Be(n))return b("find.exec-rm-recursive-force",Sv);return null}function ur(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Fo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(tt(r)){n=ur(e,n).nextIndex;continue}let o=yt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function yt(e){return Ev.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function tt(e){return e!==void 0&&vv.has(e)}import{resolve as QE}from"node:path";function dr(e){let t=Ne(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Pv=5,pa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Kd(e,t,n){let r=zo(e,t,n),o=Tv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Pv;a++){let{subcommand:l,rest:c}=Re(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let f=o.get(u),d=Nv(f);if(d===null||d.length===0)return{blockedReason:pa,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:pa,expanded:!0,tokens:i}}function qd(e,t,n){return zo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Re(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Se.has(o)?2:1}return{subcommand:null,rest:[]}}function Tv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function zo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=kv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Iv(e,t,n)]}}function Iv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=ga(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=ga(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Vd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Vd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Se.has(i)){o+=2;continue}o++}return r}function kv(e,t){let n=Ov(e,t),r=Mv(e,t);return{blockedReason:n===null||r===null?pa:null,entries:[...n??[],...r??[]]}}function Ov(e,t){let n=Je("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=dr(n);if(!o)return null;for(let i of o){let s=ga(i);if(!s)return null;r.push(s)}return r}function Mv(e,t){let n=Uu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Je(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Je(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function ga(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Vd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Je(e.slice(r+1),t,n)}}function Nv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return dr(t)}var Dv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",Lv="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",Wv="git checkout --force discards uncommitted changes. Use 'git stash' first.",Gv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Fv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",zv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",Bv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",$v="git switch --force discards uncommitted changes. Use 'git stash' first.",Uv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Hv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",jv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Vv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Kv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",qv="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Yv="git push --force destroys remote history. Use --force-with-lease for safer force push.",Zv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",Xv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Jv="git branch -D force-deletes without merge check. Use -d for safe delete.",Qv="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",eE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",tE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",nE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",rE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",oE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",iE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",sE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),aE=new Set(["--recurse-submodules","--track","-t"]),ha=new Set(["-b","-B","-U"]),ya=new Set(["-c","-C"]),lE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var pn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Zd(e,t){let{subcommand:n,rest:r}=Re(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return Ct(cE(r,t));case"switch":return Ct(dE(r));case"restore":return Ct(mE(r));case"reset":return gE(r);case"clean":return Ct(yE(r));case"rm":return Ct(CE(r));case"push":return Bt(bE(r));case"branch":return Bt(EE(r));case"stash":return Bt(AE(r));case"worktree":return Bt(PE(r));case"rebase":return Ct(xE(r));case"merge":return Ct(RE(r));case"tag":return Bt(_E(r));case"reflog":return Bt(wE(r));default:return null}}function Ct(e){return e?{...e,localDiscard:!0}:null}function Bt(e){return e?{...e,localDiscard:!1}:null}function cE(e,t){let{index:n,before:r}=ie(e),o=fe(r,{shortOptsWithValue:ha});if(r.some((a)=>O(a,"--force"))||o.has("-f"))return b("git.checkout-force",Wv);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(O(a,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",Fv)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return b("git.checkout-ref-path",Gv);return b("git.checkout-double-dash",Dv)}let i=fE(e);if(i.length>=2)return b("git.checkout-ambiguous",zv);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>O(a,"--detach")||O(a,"--track")))return null;if(uE(s)||t(s))return b("git.checkout-double-dash",Lv);return null}function uE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function dE(e){let{before:t}=ie(e);if(t.some((r)=>O(r,"--discard-changes")))return b("git.switch-discard-changes",Bv);let n=fe(t,{shortOptsWithValue:ya});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return b("git.switch-force",$v);return null}function fE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(sE.has(r)){n+=2;continue}if(aE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function mE(e){let t=pE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",Hv):b("git.restore-unstaged",Uv)}function pE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(lE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function gE(e){let t=null;for(let n of e){if(O(n,"--hard")){t=b("git.reset-hard",jv);break}if(O(n,"--merge")){t=b("git.reset-merge",Vv);break}}if(!t)return null;return hE(e)?Bt(t):Ct(t)}function hE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function yE(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=fe(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return b("git.clean-force",Kv);return null}function CE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=fe([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",qv):null}function bE(e){let{before:t,after:n}=ie(e),r=fe(t);if(t.some((s)=>O(s,"--mirror")))return b("git.push-mirror",Xv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||Yd(t,n).some(SE))return b("git.push-force",Yv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||Yd(t,n).some(vE))return b("git.push-delete",Zv);return null}function Yd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function SE(e){return e.startsWith("+")||e.includes(":+")}function vE(e){return e.length>1&&e.startsWith(":")}function EE(e){let{before:t}=ie(e),n=fe(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return b("git.branch-force-delete",Jv);return null}function xE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.rebase-abort",Qv):null}function RE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.merge-abort",eE):null}function _E(e){let{before:t}=ie(e);return fe(t).has("-d")||t.some((r)=>O(r,"--delete"))?b("git.tag-delete",tE):null}function wE(e){return e[0]==="delete"?b("git.reflog-delete",nE):null}function AE(e){for(let t of e){if(t==="drop")return b("git.stash-drop",rE);if(t==="clear")return b("git.stash-clear",oE)}return null}function PE(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=fe(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",iE);return null}import{dirname as qE,isAbsolute as YE,join as ff,resolve as ZE}from"node:path";var ba="TMPDIR",Sa="IFS",Jd=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Qd=/^[A-Za-z_][A-Za-z0-9_]*$/,ef=new Set(["export","typeset","declare","readonly"]),TE=new Set(["builtin","command","time"]),tf=new Set(["do","then","else"]),IE=new Set(["do","then","case"]),Xd=new Set(["done","fi","esac"]),kE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function nf(e,t){return e.map((n)=>n.provenance==="variable"&&cf(n.text)?fr(n.text,t.shellAssignments):w(n))}function fr(e,t){return e.replace(kE,(n,r,o)=>t.get(r??o??"")??n)}function rf(e,t){return{env:e,effectiveEnvAssignments:DE(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function of(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function va(e,t){let n=af(e,t),r=e[0]??"";if(IE.has(r))t.bodyDepth+=1;if(r==="elif"||Xd.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(Xd.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);Ea(t,a)});let o=n.commandIndex;if(o!==-1&&ef.has(e[o]??""))e.filter((a)=>Qd.test(a)&&Ca(a)).forEach((a)=>{LE(t,a)});let i=o===-1?-1:lf(e,o);if(i===-1||e[i]!=="unset")return;let s=GE(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(tf.has(r)){t.shellAssignments.set(a,"");return}WE(t,a)})}function sf(e,t){let n=af(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function af(e,t){let n=tf.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!cf(a)),o=r!==-1&&ef.has(e[lf(e,r)]??""),i=NE(t);return{assignments:e.flatMap((a,l)=>{let c=OE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!ho(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function lf(e,t){let n=t;while(TE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function cf(e){return Pe(e)!==null||Jd.test(e)}function OE(e,t,n){return Pe(e)??ME(e,t,n)}function ME(e,t,n){let r=yo(e,n,t);if(r)return r;let o=e.match(Jd)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Ca(e){return e===ba||e===Sa||Vs(e)}function NE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function DE(e,t){let n=[ba,Sa].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Ea(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function LE(e,t){Ea(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function WE(e,t){if(!Ca(t)&&!Qd.test(t))return;if(e.shellAssignments.set(t,""),ho(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Ca(t)||t===ba||t===Sa||Nn(t)){Ea(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function GE(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as FE}from"node:path";function Bo(e,t){return js.some((n)=>t?.has(n)||e.has(n))}function gn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(FE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=uf(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=uf(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Se.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function uf(e,t,n){try{let r=mt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function df(e,t,n){if(!t.localDiscard||!n.worktreeMode||Bo(n.environment.env,n.envAssignments))return null;let r=gn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(xa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function xa(e,t,n){let{subcommand:r,rest:o}=Re(e),i=r?.toLowerCase();if(t.dynamicArguments||zE(o)||jE(e,t.environment.env,t.envAssignments,n)||UE(o)||BE(i,o))return!0;return i==="clean"&&HE(o)>1}function zE(e){return e.some((t)=>/[$*?[]/.test(t))}function BE(e,t){if(e==="checkout"){let{before:n}=ie(t),r=fe(n,{shortOptsWithValue:ha}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=fe(n,{shortOptsWithValue:ya}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||$E(s))||r.has("-C");return o&&i}return!1}function $E(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function UE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function HE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function jE(e,t,n,r){if(Je("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=zo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>KE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||VE(s.value);if(ju(n))return!0;return r.recursiveSubmodules}function VE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function KE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function mf(e,t,n){let r=e.map(w),o=n.environment.paths,i=gn(r,n.cwd,o),s=n.originalCwd?o.realpath(ZE(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Bo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?JE(e,n.shellAssignments,o):pf(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!XE(a,r,t,n)||!fn(a,n.environment)||Io(a,n.environment)||ko(s,a)||ko(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function XE(e,t,n,r){let o=r.environment.paths,i=ff(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!xa(t,r,s)}function JE(e,t,n){let r=Re(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?fr(a,t??new Map):a;if(!YE(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function pf(e,t){if(t.entryKind(ff(e,".git"))!=="missing")return e;let n=qE(e);return n===e?null:pf(n,t)}var ex="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",tx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function $o(e,t){return gf(e,t)}function gf(e,t,n){let r=e.map(w),o=Kd(r,t.environment.env,t.envAssignments),i=o.blockedReason?P(b("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Hu(t.envAssignments)||qd(r,t.environment.env,t.envAssignments))&&nx(s))return b("git.ssh-env",ex);let a=Zd(s,(c)=>{let u=gn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(QE(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=df(r,a,t)??mf(e,a,t);if(!l)return a;return n?.(l),null}function hf(e,t){let n=null;return{match:gf(e,t,(o)=>{n=o}),relaxation:n}}function nx(e){let{subcommand:t,rest:n}=Re(e),r=t?.toLowerCase();if(!r)return!1;if(tx.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&rx(n)}function rx(e){return e.find((t)=>!ox(t))?.toLowerCase()==="update"}function ox(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as Fx}from"node:path";function yf(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Uo(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Cf="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ix="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",sx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Sf="rm -rf targeting root or home directory is extremely dangerous and always blocked.",ax="rm -rf in home directory is dangerous. Change to a project directory first.",bf={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Sf},git_metadata_target:{id:"rm.git-metadata",reason:Te},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:sx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:ax},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Cf},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:ix},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Cf}};function Ho(e,t){let n=Gt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Be(r),i=Hd(r),s=cx(e);for(let a of s){let l=sr(a.word);if(o&&l.unsafeBraceExpansion){let c=P(ir({kind:"outside_anchored_cwd"},n,t.policy,bf),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=be(c),f={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return b("rm.git-metadata",Te);if(i&&!o){let d=Fe(u,n,f);if(d.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",Sf);if(d.kind==="git_metadata_target")return b("rm.git-metadata",Te);continue}if(!o)continue;for(let d of lx(u,n,f)){let m=ir(d,n,t.policy,bf),p=P(m,t.policy);if(p)return p}}}return null}function lx(e,t,n){let r=Fe(e,t,n);if(r.kind==="cwd_self_target")return[r,Fe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Fe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Fe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function cx(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var bt={kind:"none"},$t={kind:"dynamic"},ux=new Set(["<","<<","<<-","<<<","<&","<>"]),Ef=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,dx=/^(?:[0-9]+|[@*])$/,fx=ft.maxWords,mx=ft.maxInputLength;function xf(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Ho(e){let t=mr(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(Vo))return $t;return{kind:"literal",source:n.map(w).join(" ")}}function hm(e){let t=mr(e[1])==="--"?2:1,n=e[t],r=mr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!Vo(n))return $t;return{kind:"literal",source:r}}function jo(e,t){let n=ix(e);if(n===-1)return Ct;let r=sx(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=lx(s,e,n,r.ifs);if(!a)return $t;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>nx||i>rx)return $t;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(ux)].filter((s)=>s!==null).join(" ")}}function ym(e,t,n,r){if(!Se(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&ex.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return $t;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?$t:{kind:"literal",source:r}}function et(e){let t=Se(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=mr(n);return lo(n,r)?{kind:"literal",source:r}:$t}var ox=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Ra(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=k(M(s));return!ox.has(a)&&!J.has(a)&&!Ft(a)}function ix(e){return Se(e.map(w)).commandIndex??-1}function sx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(ax);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function ax(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function lx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?va(o):cx(o,r);if(e.parameter==="*"){let a=va(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Ea(l,r)}let i=t[n+1+e.parameter];if(i&&!Vo(i))return;let s=mr(i);return e.quoted?[s]:Ea(s,r)}function va(e){return e.every(Vo)?e.map(w):void 0}function cx(e,t){let n=va(e);if(!n)return;let r=n.map((o)=>Ea(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ea(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function jo(e){let t=mr(e[1])==="--"?2:1;if(e.length<=t)return bt;let n=e.slice(t);if(!n.every(Ko))return $t;return{kind:"literal",source:n.map(w).join(" ")}}function Rf(e){let t=mr(e[1])==="--"?2:1,n=e[t],r=mr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return bt;if(!Ko(n))return $t;return{kind:"literal",source:r}}function Vo(e,t){let n=gx(e);if(n===-1)return bt;let r=hx(t);if(!r)return bt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Cx(s,e,n,r.ifs);if(!a)return $t;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>fx||i>mx)return $t;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(Sx)].filter((s)=>s!==null).join(" ")}}function _f(e,t,n,r){if(!ve(e.map(w)).readsStdinAsCommands)return bt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&ux.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return bt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return $t;return{kind:"literal",source:o.target.text}}if(!n)return bt;return r===void 0?$t:{kind:"literal",source:r}}function nt(e){let t=ve(e.map(w)).scriptIndex;if(t===null)return bt;let n=e[t],r=mr(n);return co(n,r)?{kind:"literal",source:r}:$t}var px=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Aa(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=k(M(s));return!px.has(a)&&!J.has(a)&&!Ft(a)}function gx(e){return ve(e.map(w)).commandIndex??-1}function hx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(yx);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function yx(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Cx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ra(o):bx(o,r);if(e.parameter==="*"){let a=Ra(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:_a(l,r)}let i=t[n+1+e.parameter];if(i&&!Ko(i))return;let s=mr(i);return e.quoted?[s]:_a(s,r)}function Ra(e){return e.every(Ko)?e.map(w):void 0}function bx(e,t){let n=Ra(e);if(!n)return;let r=n.map((o)=>_a(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function _a(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Vo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function mr(e){return e?w(e):""}function ux(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function _a(e,t){return xa(Me(e,"posix"),t)}function pr(e){return _a(e,new Set(Array.from(e.matchAll(pm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function xa(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(xa(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>xa(o,n))||Cm(r.words,n))return!0;gx(r,n)}return!1}function Cm(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(fr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return fm(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Se(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&fm(s[l],t)}let i=dx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Cm(e.slice(i),t)}function dx(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return mx(e,t+1);if(r==="exec")return fx(e,t+1);if(r==="env")return px(e,t+1,n);return null}function mx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function fx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function px(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return fr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return fr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function gx(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(fr(n,t))t.add(r.name)}}function fr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(pm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(tx.test(o)||t.has(o))}))}function fm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||fr(e,t))}var hx=["--init-file","--rcfile"],yx=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function tt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return bm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=bm(e,t,!1);if(r!==null)return r}}return null}function nt(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Se(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function bm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Sm(e){let t=k(e[0]??"").toLowerCase(),n=Cx(e,t),r=yx.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Cx(e,t){let n=Se(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?hx.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Yi.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Zi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var wa="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Pa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",bx="__CC_SAFETY_NET_XARGS_INPUT__",Ko="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",qo="rm",Sx=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,vx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Ex=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,xx=/^(?:[0-9]+|[@*])$/;function xm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Ut(n),i=n.slice(r),s=b("xargs.shell-dynamic",Pa);if(_x(i,o,t)&&A(s,t.policy))return A(s,t.policy);for(let a of Fe(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?A(s,t.policy):null;if(c)return c;let u=Am(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&wm(l,o),d=t.analyzeChild(l,{...zt(a,t),dynamicInput:u,dynamicSourceInput:m||_m(l,a.head,o,a.wrapperEnvAssignments,u,t.environment),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",wa)});if(d)return d;let f=Rx(l,o,t.policy?.rules??[],A(s,t.policy));if(f)return f;if(a.head==="git"){let h=o===null?[...l,bx]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...zt(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=Je(l,t.policy?.rules??[]);if(p)return p}return null}function Rx(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Rm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=cm(e,r,t.length,n);return o===null?[]:[o]}function _m(e,t,n,r,o,i){if(J.has(t)){if(nt(e))return!1;if(n!==null&&wx(e,n))return!0;let s=tt(e);if(!s){let a=et(K(e));if(a.kind==="literal")return n!==null&&a.source.includes(n);return a.kind==="none"&&o}if(n!==null&&s.includes(n))return!0;if(Ye(s))return!0;return Px(s,n,r)}if(Oe(t))return vm(e,n,po,Mu(t));if(we.has(t))return vm(e,n,ia,Od);if(t==="eval"){let s=Ho(K(e));if(s.kind==="dynamic")return!0;if(n!==null)return s.kind==="literal"&&s.source.includes(n);return o}if(t==="find")return Ax(e,n,i);if(t==="git"){let s=xe(e);return n===null?s.subcommand===null:(s.subcommand?.includes(n)??!1)||s.subcommand!==null&&pn.has(s.subcommand.toLowerCase())&&Pm(s.rest,n).some((a)=>a.includes(n))}return!1}function vm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Ko]).sources.some((a)=>a.value===Ko);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Ko}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Ko}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Rm(l,t,a))));return $o(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function _x(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Fe(e,n),(i)=>i.head)),o=t===null?[...e,qo]:e.map((i,s)=>s===0?i:i.replaceAll(t,qo));return Array.from(Fe(o,n)).some((i)=>i.head===qo&&!r.has(qo))}function wm(e,t){return Pm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Pm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Am(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function wx(e,t){let n=Se(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return Rm(i,t,o).some((l)=>{let c=e.map((m,d)=>d===s?m.replaceAll(t,l):m),u=Se(c);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(n.commandIndex===null&&u.commandIndex!==null)return!0;if(n.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(c[u.commandIndex]??"").includes(l))return!0;return u.scriptIndex!==null&&(c[u.scriptIndex]??"").includes(l)})}))}function Px(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Sx))if(Em(o,r))return!0;for(let o of e.matchAll(vx))for(let i of(o[1]??"").matchAll(Ex))if(Em(i,r))return!0;return _a(e,r)}function Em(e,t){let n=e[1]??e[2];return n!==void 0&&(xx.test(n)||t.has(n))}function Ax(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Qe(s)){let l=cr(e,i);i=l.nextIndex-1;for(let c of Fe(l.tokens,{environment:n,cwd:void 0})){let u=Am(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&wm(c.tokens,t)||_m(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=ht(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Ut(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var gr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",hr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Ix="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",kx="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Zo=/\{[^{}\s]*\}/g,Tm=/\{\}|\{-?\d+\}/g,Ox=["e","f","source","file","-e","-f","--source","--file"],Mx=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Nx=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Dx=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Im=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Lx=new Set(["--workdir","--wd"]),km="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Te(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Lm(e){return Te([...e],(t)=>Ye(t))}function Wm(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=hn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Vm(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=hn(t);if(p)return p;let h=Lm(t.envAssignments?.values()??[]);if(h)return h}if(l){let p=$x(t);if(p)return p}if(u!==void 0&&a){let p=hn(t);if(p)return p}let d=Ux(u,t.cwd,t.environment.paths);if(d===null){let p=hn(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...Fe(i,f)].flatMap((h)=>[...h.envAssignments.values()]).some(Ia)){let h=hn(t);if(h)return h}return null}if(i.length===0){let p=s.map((g)=>g[0]??"");t.budget.charge("derivedTokens",p.length);let h=Bm(f.envAssignments,f.cwd,a);return Te(p,(g)=>t.analyzeNested(g,h))}return Te(Fe(i,f),(p)=>Wx(p,o,t,f))}function Wx(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(Hm)){let g=hn(n);if(g)return g}let u=Lm(c);if(u)return u;let m=c.some(G),d=i||m,f=a&&d,p=Bm(e.envAssignments,e.wrapperCwd,s||f);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Te(o,(E)=>n.analyzeChild(Yo(l,E,n.budget),zt(e,r)))};if(nt(l))return g();let y=tt(l);if(y){if(jm(y)){let x=bt(n);if(x)return x;if(o.length===0)return null;return Te(o,(P)=>n.analyzeNested(Nm(y,P,n.budget),p))}if(G(y)){if(o.length>0)return Te(o,(q)=>n.analyzeNested(Nm(y,q,n.budget),p));let x=ur(y);if(x?.[0]&&M(x[0])==="rm"&&ze(x)){let q=Mm(n);if(q)return q}let P=x?n.analyzeChild(x,{...zt(e,r),dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",hr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",gr)}):null;if(P)return P;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>jo(K(x===void 0?l:i?l.map((P)=>$m(P,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=bt(n);if(x)return x}let S=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(S.length>0)return n.budget.charge("derivedTokens",S.length),Te(S,(x)=>n.analyzeNested(x,p));if(pr(y)){let x=bt(n);if(x)return x}let T=n.analyzeNested(y,p);if(T)return T;if(d)return bt(n);return null}let v=et(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&G(v.source))return bt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=bt(n);if(E)return E;let S=g();if(S)return S;if(i)return null;let T=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",T.length),Te(T,(x)=>n.analyzeNested(x,p))}if(d||a)return bt(n)??g();return null}if(e.head==="rm"&&ze(l)){if(i&&o.length>0)return Te(o,(y)=>Aa(Yo(l,y,n.budget,Tm),e.cwd,r));if(o.length>0)return Te(o,(y)=>Aa(Dm(l,y,n.budget),e.cwd,r));let g=Aa(l.flatMap((y,v)=>{if(v===0||!G(y))return[y];return y.startsWith("-")?[y.replace(Tm,"")]:[]}),e.cwd,r);if(g)return g;return Mm(n)}let h=o.length>0?o:[void 0];return Te(h,(g)=>{let y=g===void 0?l:i?Yo(l,g,n.budget):Dm(l,g,n.budget),v=b("parallel.shell-dynamic",hr),E=a&&e.head==="find"?Bx(y,r):null,S=Fm(y,a,n)??E?.customResult??null,T=M(e.head),x=a&&(T==="rm"&&Ta(y)||T==="xargs"&&zm(y)||E?.rmOptions===!0),P=a&&(x||E?.executedSource===!0||E===null&&Gm(y,T)),q=n.analyzeChild(y,{...zt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:x,dynamicSourceInput:S!==null||P,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",gr)});if(P){let Z=A(v,n.policy);if(Z)return Z}return q??S??Je(y,n.policy?.rules??[])})}function Gm(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return zx(e);if(t==="git")return Gx(e);if(t==="find")return!0;if(we.has(t))return Om(e,Ox,lr);if(Oe(t))return Om(e,Mx,fo);return!1}function Ta(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||jm(o)))}function Gx(e){if(Fx(e))return!0;let t=xe(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!pn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function Fx(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function zx(e){if(nt(e))return!1;let t=tt(e);if(t!==null)return G(t);let n=et(K(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function Om(e,t,n){let r=n(e);if(r.some((o)=>G(o.value)))return!0;if(!e.some(G))return n([...e,km]).some((o)=>o.value===km);return $o(r,t,(o)=>n(e.map((i)=>$m(i,[o]))))}function Fm(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(G))return bt(n);return Te(o,(i)=>Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function Bx(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of Fe(i,t))n.executedSource||=Gm(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ta(a.tokens)||a.head==="xargs"&&zm(a.tokens),n.customResult??=Fm(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Qe(a)){i=[],n.executedSource||=G(a);continue}let l=ht(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function zm(e){let t=e.slice(Ut(e).childStart);return M(t[0]??"")==="rm"&&Ta(t)}function Xo(e,t){return(n)=>A(b(e,t),n.policy)}var bt=Xo("parallel.shell-dynamic",hr),$x=Xo("parallel.command-stream-dynamic",Ix),hn=Xo("parallel.command-stream-dynamic",kx),Mm=Xo("parallel.rm-recursive-force-dynamic",gr);function Aa(e,t,n){return A(Uo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Lt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Bm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function $m(e,t){return e.replace(Zo,(n)=>Um(n,t))}function Yo(e,t,n,r=Zo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Um(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Nm(e,t,n){return Yo([e],t,n)[0]??""}function Dm(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Um(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function G(e){return e.search(Zo)!==-1}function Hm(e){if(Ia(e))return!0;for(let t of e.matchAll(Zo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Ia(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function jm(e){return/^\{[^{}\s]*\}$/.test(e)}function Ux(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Tx(e))return null;try{return mt(t??e,e,n)}catch{return null}}function Vm(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=la(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=la(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||Dx.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(Im.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=Im.has(p)?2:1;continue}if(Lx.has(y)){c=!0;let E=v??h;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(Nx.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Ia:Hm);let u=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){u.push(p),p=[];continue}if(g!==void 0)p.push(g)}u.push(p)}c||=u.length>1;let m=Hx(u),d=n.some(G),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function Hx(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function Km(e){return Vm(e).childStart}var jx="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Jo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Oa(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function ka(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Ym(e,t,n,r,o=!1,i){let a=(Bn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",jx):null;return A(a,i)??Zm(e,t,n,o,i)}function Zm(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Oa(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=sn(e,t),l=Kx(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return A(b("shell.dynamic-structure",Jo),o);if(A(Bo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&pn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return A(b("shell.dynamic-structure",Jo),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&qx(t)?A(b("shell.dynamic-structure",Jo),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=ze(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?A(b("shell.dynamic-structure",Jo),o):null}if(s==="xargs")return qm(e,t.slice(Ut(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return qm(e,t.slice(Km(t.map(w))),"parallel",n,r,o);return null}function qm(e,t,n,r,o,i){if(t.length===0)return null;let s=Vx(t,r);if(Bn(e,s)){let l=A(b(`${n}.shell-dynamic`,n==="xargs"?Pa:hr),i);if(l)return l}let a=Zm(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Oa(l)&&ka(l)))return A(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?wa:gr),i);return null}function Vx(e,t){let n=Ot(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function Kx(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(be.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function qx(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Oa(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||ka(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||ka(s)))return!0;continue}if(t=!0,a)return!0;let l=ht(s.text);if(l>0){n=l;continue}if(Qe(s.text))o=!0,r=!0}return!1}function Ma(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!lo(t[n.tokenIndex],n.value)})}var Yx="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",Zx="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",Xx="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Xm(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",Yx);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",Zx);if(e==="shred"&&n.length>0)return b("shred.target",Xx);return null}var Qm=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Uo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Bo(e.words,Na(e))},{heads:new Set(["find"]),analyze:(e)=>Gd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>xm(e.words,{...Jm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Wm(e.words,{...Jm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})}];function Jm(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ht(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Na(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var rf="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function of(e){return Qm.find((t)=>t.heads.has(e))?.analyze}function Cn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=yo(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=Ot(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let R=[...p,...i(f.words)].join(" "),I=Ye(R);if(I)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:I.reason}),ue(I);if(n.strict)return he(r);let L=Co(p,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(te)return te}}let h=f.rewritten?K(i(f.words)):sn(o,f.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>h.length){let R=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),E=g[0];if(!E)return null;if(Ft(E))throw new N("wrapperPeelIterations");let S=M(E),T=f.cwd===null?void 0:f.cwd??u,x=f.cwd===null?void 0:m,P=f.cwd===void 0?n.effectiveCwd:f.cwd,q=s?s.allowTmpdirVar:!or(v,n.environment),Z=Ym(o,f.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),ue(Z);let ee=Do(g,n.policy);if(ee){for(let R of[ee.childIndex,...ee.alternativeChildIndices]){ef(y.wrapperNormalizationBudget);let I=h.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=Cn(I,t,{...y,effectiveCwd:P,envAssignments:v});if(L)return L}return null}let X=l?void 0:S==="eval"?Ho(h):S==="trap"&&!a?hm(h):void 0;if(a&&s&&S==="eval"){if(X?.kind==="dynamic")return yn(s,n.policy);if(X?.kind==="literal"){let R=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v});if(R)return R}return bn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!Ra(n.commandView)))return he(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:S==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let R=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?J.has(S):af(E,S)){if(nt(g))return null;if(a&&s){let R=tt(g);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=yn(s,n.policy);if(L)return L}if(pr(R)){let L=yn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:P,envAssignments:v})}let I=et(h);if(I.kind==="dynamic")return yn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?yn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?yn(s,n.policy):null}if(l){let R=tt(g),I=R?n.analyzeNested(R,{effectiveCwd:P,envAssignments:v}):et(h).kind==="dynamic"?he(r):null;if(I)return I}if(s===void 0){let R=tR(g,v,P,n,r,t);if(R)return R;let I=tt(g);if(I){let qt=jo(h,I);if(qt.kind==="dynamic")return he(r);let hi=qt.kind==="literal"?qt.source:I,il=nR(hi);r?.recordSegment({type:"shell-wrapper",wrapper:S,innerCommand:il}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:il,depth:t+1});let sl=n.analyzeNested(hi,{effectiveCwd:P,envAssignments:v});if(sl)return sl;return pr(hi)?he(r):null}let L=et(h);if(L.kind==="dynamic")return he(r);if(L.kind==="literal")return Qo(L.source,P,v,n,r,t);let te=ym(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return he(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:P,envAssignments:v})}}if(!s&&(S==="source"||S===".")){let R=g[1]==="-p"?2:null;if(R!==null){let qt=n.commandView?h[R]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return he(r)}let I=R===null?1:3,L=g[I]==="--"?I+1:I,te=n.commandView?h[L]:void 0;if(!te)return null;if(te.provenance==="literal")return Qo(te.text,P,v,n,r,t);if(n.strict||!n.commandView||!Ra(n.commandView))return he(r)}if(we.has(S)&&!l){if(!s&&n.strict&&Ma(lr(g),h))return he(r);let R=Md(g,(L)=>Ht(n.analyzeNested(L,{effectiveCwd:P,envAssignments:v}))),I=A(R,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),ue(I)}if(Oe(S)&&!l){if(!s&&n.strict&&Ma(fo(g),h))return he(r);let R=Ou(g);if(a&&s)return Qx(S,R,P,v,n,s);if(R){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:S,codeArg:R,paranoidBlocked:I}),I){let te=A(b("interpreter.one-liner-paranoid",Yn),n.policy);if(te)return ue(te)}if(zs(S,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:P,envAssignments:v});if(L&&!sf(L,R))return L;if(Zn(R)){let te=A(b("interpreter.dangerous-command",cn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:cn}),ue(te)}r=void 0}}if(S==="busybox"&&g.length>1)return ef(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),Cn(h.slice(1),t,{...y,effectiveCwd:P,envAssignments:v});let D=s?null:A(Xm(S,g),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),ue(D);let ce=r===y.trace?y:{...y,trace:r},_e={words:h,head:S,cwd:T,originalCwd:x,envAssignments:v,allowTmpdirVar:q,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:P,options:ce,analyzeChildTokens:(R,I)=>a&&s?Da(R,t,ce,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ht(Cn(K(R),t+1,{...ce,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:v}))??Je(R,ce.policy.rules),analyzeChild:(R,I)=>Da(R,t,ce,I)},je=s&&(S==="xargs"||S==="parallel")?void 0:of(S);if(S==="rm"||S==="xargs"||S==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let Ie=r&&S==="git"?lm(_e.words,Na(_e)):void 0,pi=tf(Ie?Ie.match:je?.(_e)??null,n.policy);if(r)rR(_e,pi,Ie?.relaxation??null);if(pi)return ue(pi);if(a&&s&&(S==="rm"||S==="rmdir")){if(!(S==="rm"&&(ze(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?bn(s,n.policy):null)??eR(s,n.policy)}let rl=je!==void 0,ol=!s&&!rl&&!Lr.has(S),gi=r&&ol?[]:void 0;if(ol)for(let R=1;R<g.length;R++){let I=g[R];if(!I)continue;gi?.push(I);let L=tf(Jx(g,R,t,ce,T,x,P,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[],embeddedCommandFound:M(I)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&rl)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let Rr=Je(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Rr,reason:Rr?.reason}),Rr)return ue(Rr);return a&&s?bn(s,n.policy):null}function Da(e,t,n,r){return Ht(Cn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function Jx(e,t,n,r,o,i,s,a){for(let l of Fe(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=M(c);if(af(c,u)||of(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=Da(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!or(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function Qx(e,t,n,r,o,i){if(!t)return bn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=A(b("interpreter.one-liner-paranoid",Yn),o.policy);if(a)return ue(a)}if(zs(e,t))return bn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!sf(s,t))return s;if(Zn(t)){let a=A(b("interpreter.dangerous-command",cn),o.policy);if(a)return ue(a)}return bn(i,o.policy)}function sf(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Oo)||e.reason===fn)&&!Wr(t)}function yn(e,t){let n=e.shellDynamicMatch?A(e.shellDynamicMatch,t):null;return n?ue(n):null}function bn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?A(e.dynamicSourceMatch,t):null;return n?ue(n):null}function eR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?A(e.rmDynamicMatch,t):null;return n?ue(n):null}function tR(e,t,n,r,o,i){let s=Sm(e);if(s.argvSource?.kind==="absent")return he(o);if(s.argvSourceApplies&&s.argvSource){let l=Qo(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Qo(a,n,t,r,o,i,!0)}function Qo(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return he(o);let a=qn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?he(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function nR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function rR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function ef(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function he(e){return e?.recordSegment({type:"error",message:rf}),ue(oR())}function oR(){return{id:"",reason:rf,intent:"stop_and_explain"}}function af(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function tf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:A(e,t)}var iR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,sR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function aR(e,t){let n=uf(e,t);if(n.length===0)return!1;let r=n[cf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return iR.test(e.join(" "))}function lf(e,t,n,r,o){if(e.dialect==="powershell"){let g=cR(e.words,o);if(g.kind==="none")return;if(!t||g.kind==="unknown")return null;return nf(fR(g.target),t,n.paths)}let i=e.words.map(w),s=i.some((g)=>/^CDPATH\+?=/.test(g));if(!aR(i,n))return s?null:void 0;if(!t)return null;let a=uf(i,n,t),l=cf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((g)=>g.length<=1||!g.startsWith("-")||g==="--");if((u===-1?c:c.slice(0,u)).some((g)=>!/^-[LP]+$/.test(g)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length!==1)return null;let p=f[0]??"",h=e.words.some((g)=>g.provenance==="variable"&&g.text===p)?lR(p,r):p;if(h===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(h)&&(s||n.env.has("CDPATH")))return null;return nf(h,t,n.paths)}function lR(e,t){let n=dr(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function nf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return mt(t,e,n)}catch{return null}}function cR(e,t){let n=uR(e[0])?1:0,r=e[n];if(!dR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!sR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return mR(e.slice(n+1),t)}function uR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function dR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function mR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function fR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function cf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function uf(e,t,n){let r=pR(e);return ft([...r],t,n)}function pR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var gR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",jt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function za(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Me(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Fa(e,n);let u=`${Oo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return hf(e,n),{reason:fn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return hf(e,n),{reason:fn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Fa(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Zd(n.environment.env,n.envAssignments);return ni(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ni(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,d=hR(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=f||vn(m);if(c.kind==="function"){let Z=h.flatMap((X)=>{let U=En(X);return U.functionDefinitions.set(c.name,c.body),La(X,[U],d,m==="&",vn(m))}),ee=Wa(Z,[],g,y,a,m);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of h){let D=ni(c.body,t,n,r,[En(U)]);if(D.result)return D;if(Z.push(...La(U,D.states,d,m==="&",vn(m))),v)ee.push(U,...d?D.states.map((ce)=>ei(U,ce)):D.states)}let X=Wa(Z,ee,g,y,a,m);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),S=e.nodes[l-2],T=ri(a)&&S?.kind==="command"?gm(S)??CR(S):void 0,x=[],P=[];for(let Z of h){let ee=bR(c,t,n,r,[En(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ei(Z,U));for(let U of X){let D=En(U),ce=ER(c,t,n.trace?{...n,trace:yf(n.trace,E)}:n,r,D,ri(a),T);if(ce)return{result:ce,states:i};let _e=GR(c,D.functionDefinitions);if(_e)n.budget.charge("derivedTokens",oi(_e));let je=_e?t+1>=V.recursionDepth.cap?Ga(c.displayText,n,[D]):ni(_e,t+1,n,r,[D]):{result:null,states:LR(c,D)};if(je.result)return je;if(x.push(...La(Z,je.states,d,m==="&",vn(m))),v)P.push(Z),P.push(...je.states.map((Ie)=>d?ei(Z,Ie):Ie))}}let q=Wa(x,P,g,y,a,m);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function hR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ri(r)||ri(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&yR(e,t)}function La(e,t,n,r,o){let i=n?t.map((a)=>ei(e,a)):[...t],s=o?i.flatMap((a)=>Sn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ei(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function yR(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(SR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ri(e){return e==="|"||e==="|&"}function CR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function vn(e){return e==="&&"||e==="||"}function Wa(e,t,n,r,o,i){let s={success:ti([...n,...e]),failure:ti([...r,...t])},a=vn(i)?s:void 0;return{states:vn(o)||a?ti([...s.success,...s.failure]):s.success,conditionalStates:a}}function yf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function bR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=vR(e);if(s){if(t+1>=V.recursionDepth.cap)return Ga(s,n,o);let a=Me(s,"powershell");if(a.status==="limited")return Ga(s,n,o);if(a.status!=="complete")return df(i,n,r,o);n.budget.charge("derivedTokens",oi(a)),i.push({program:a,depth:t+1})}}return df(i,n,r,o)}function SR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function df(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ni(i.program,i.depth,t,n,[En(a)]);if(l.result)return l;s.push(...l.states)}o=ti(s)}return{result:null,states:o}}function vR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function oi(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+oi(o),0):n.kind==="group"||n.kind==="function"?oi(n.body):0),0)}function Ga(e,t,n){return t.trace?.recordSegment({type:"error",message:$e}),{result:{reason:$e,segment:e,intent:"stop_and_explain"},states:[...n]}}function ER(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=TR(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Cf(e,o,"before-consumer",a.environment.paths,a.budget);let c=sn(e.dialect,e.words),u=c.map(w),m=e.displayText,d=Yd(c,o.shellGitContextState),f=Jd(d,o.shellGitContextState);if(e.dialect==="powershell"){let g=A(_d(e,i,zR(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!g,reason:g?.reason}),g)return FR(m,g)}if(u.length===1&&u[0]?.includes(" ")&&!Bn(e.dialect,e.words)){let g=A(Ye(u[0]),a.policy),y=g!==null&&!a.strict&&Pu(e,a.rootProgram);if(g&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:g.reason}),{reason:g.reason,segment:m,ruleId:g.id,intent:g.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let v=mf(e,l,o,f,s,a);if(v)return v;return Ca(d,o.shellGitContextState),null}let p=Cn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(g,y)=>{let v=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=za(g,t+1,{...a,effectiveCwd:v,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?yf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:m};let h=mf(e,l,o,f,s,a);if(h)return h;return Ca(d,o.shellGitContextState),null}function mf(e,t,n,r,o,i){let s=IR(e,t,n,r??new Map,i);if(s)return s;return Cf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),_R(e,t,n,i.environment.paths,i.budget),MR(e,n,o,i.environment,i.trace),null}var xR=new Set([">>","<>"]);function Cf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?RR(s):xR.has(s.operator)))continue;ff(s.target,t,r,o)}if(n!=="before-consumer"||!Re(e.words[0],"tee"))return;let i=bf(e.words.slice(1));if(!i)return;for(let s of i.operands)ff(s,t,r,o)}function RR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function ff(e,t,n,r){let o=e?.provenance==="literal"?qn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function _R(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!ii(i))return;for(let s of wR(e)){let a=qn(s.text,n.effectiveCwd,r,o);if(!a||!Iu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function wR(e){let t=AR(e.redirections)?.target,n=pf(t)?[t]:[];if(Re(e.words[0],"cat"))return PR(e.words)?n:[];if(!Re(e.words[0],"tee"))return[];let r=bf(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(pf))return[];return[...r.operands,...n]}function PR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function AR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function bf(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&Re(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function pf(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function Re(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function ii(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function TR(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return jt;let n=t[0];if(!n?.heredoc)return jt;if(!ii(n.heredoc))return gR;if(n.fd!==void 0&&n.fd!==0)return jt;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return jt;let r=e.redirections.some((s)=>s!==n&&gf(s.target));if(Re(e.words[0],"cat"))return r?jt:void 0;if(Re(e.words[0],"tee"))return r||e.words.slice(1).some(gf)?jt:void 0;let o=e.words[0],i=e.words[1];if(Re(o,"git")&&(Re(i,"apply")||Re(i,"commit")))return;if(Re(o,"gh")&&(Re(i,"pr")||Re(i,"issue"))&&Re(e.words[2],"create"))return;return jt}function gf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function IR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(OR(e,i,n,r,o))return null;let a=kR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Fa(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function kR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!ii(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Oe(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=A(b("interpreter.one-liner-paranoid",Yn),n.policy);if(c)return c}if(!Zn(s))return null;let l=A(b("interpreter.dangerous-command",cn),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function OR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!ii(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Ot(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return nt(a)}function MR(e,t,n,r,o){let i=lf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var NR=/^[A-Za-z_][A-Za-z0-9_]*$/,DR=8;function LR(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!NR.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=DR&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=En(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function En(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Xd(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ti(e){let t=[];for(let n of e){if(!t.some((r)=>WR(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function WR(e,t){return e.effectiveCwd===t.effectiveCwd&&Sn(e.shellGitContextState.env,t.shellGitContextState.env)&&Sn(e.literalHeredocFiles,t.literalHeredocFiles)&&Sn(e.functionDefinitions,t.functionDefinitions)&&Sn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Sn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function Sn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function GR(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function FR(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function zR(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Fa(e,t){let n=A(Ye(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function hf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:fn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var BR=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Sf(e,t,n,r){let o=za(e,0,{...t,...Yc(t),budget:t.budget??ye(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function vf(e,t,n){try{return{decision:e()}}catch(r){let o=$R(r,t,n);if(!o)throw r;return o}}function $R(e,t,n){if(!(e instanceof N)||!BR.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var UR=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),$a=new Set(["cc-safety-net","ccsn"]),HR=new Set(["bunx","npx","pnpx"]),jR=new Set(["pnpm","yarn"]),VR=new Set(["npm","pnpm","yarn"]),KR=new Set(["bun","node"]);function ai(e,t,n={}){if($a.has(e))return 0;if(HR.has(e)){if(n.broad)return Ba(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return si(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&VR.has(e)&&n.broad&&t[r]==="exec"){let o=Ba(t.slice(r+1));return o===null?null:r+1+o}if(jR.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&si(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ba(t.slice(r+1));return o===null?null:r+1+o}if(KR.has(e)){let o=n.broad&&r!==-1?r:0;if(Ef(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Ef(t[o+1]))return o+2}return null}function Ba(e){let t=e.findIndex((r)=>si(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!si(r))break;n++}return n}function si(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return $a.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return $a.has(e.slice(0,t))}function Ef(e){let t=e?.replaceAll("\\","/");return[...UR].some((n)=>t===n||t?.endsWith(`/${n}`))}var xf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Rf(e,t,n){let r=pe(e,"input-candidate");if(!r)return null;let o=dn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>qR(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function qR(e,t){let n=ft([...e],t),r=n.slice(1),o=ai(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as li}from"node:path";var Af="This path contains the protected policy config and you must not modify or delete it.",YR=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Tf(e,t,n){let r=t_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return _f(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=pe(e,"input-candidate");if(e.invocation.route.kind==="command")return o?wf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=wf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return _f(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Pr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function _f(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>yr(a,n,r,o,i));return s?{target:s}:null}function wf(e,t,n,r,o){let i=dn(e,t,r,o,{findSegmentTarget:(s,a)=>ZR(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>yr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>e_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function ZR(e,t,n,r,o){if(tr(e))return null;let i=Mt([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&XR(a)){let l=JR(a).find((c)=>Pf(fe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Go(i,1)||ua(i,r)){let c=(Wo(K(i))??K(["."])).find((u)=>{let m=fe(u.text,t.variables);return yr(m,t.cwd,n,r,o)||Pf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Ro(a).sources.find((c)=>n_(fe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(QR(i,s))return null;for(let l of[...e,...i])for(let c of If(l))if(yr(fe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function XR(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function JR(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function QR(e,t){if(!YR.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function e_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of If(i))if(yr(s,t,n,r,o))return{target:s};return null}function If(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function t_(e,t,n){let r=(a)=>Cr(se(a,e.executionCwd,t,n)),o=r(Qt(t)),i=[r(Ln(e.executionCwd)),r(Ln(e.configCwd))],s=new Set(i.map((a)=>li(a)));for(let a=li(o);;a=li(a))if(s.add(a),li(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function yr(e,t,n,r,o){let i=gl(e,t,r,o,(s)=>Cr(s)===Nr);return i!==null&&n.files.has(Cr(i))}function Pf(e,t,n,r,o){return n.directoriesAndAncestors.has(Cr(se(e,t,r,o)))}function n_(e,t,n,r,o){let i=Cr(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Cr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ci,posix as r_,resolve as di,win32 as o_}from"node:path";import{fileURLToPath as i_}from"node:url";var zf="Access to a sensitive path is not allowed.",Bf=new Set(["echo","printf"]),s_=new Set(["find"]),a_=new Set(["-exec","-execdir"]),l_=new Set([";","+"]),c_=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),u_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),$f=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),d_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),m_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Uf=new Set(["-c","-e","-r","-E","--eval","--exec"]),f_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),p_=new Set(["grep","rg"]),kf=new Set(["jq","gojq","jaq"]),Of="f",Mf="file",g_="files",h_=new Set(["e","f"]),y_=new Set(["regexp","file"]),C_=new Set(["e","f","A","B","C","m"]),b_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Ua="__CC_SAFETY_NET_PIPE_INPUT__",ja=/[\w./~@+-]*[./~][\w./~@+-]*/g,S_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,v_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,E_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,x_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,R_=/\b(?:system|exec)\s*$/,__=/\b(?:eval|exec)\s*\(/g,w_=/\b(?:eval|exec)\s*$/,P_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Nf(e,t,n,r,o,i){for(let s of e){let a=s.target;if(_w(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=xw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&ww(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Hf(e,t,n,r,o={}){let i=Df(e,n,r),s=Nf(i,t,e.invocation.context.configCwd,n,r);if(s===null)return null;let a=s.ruleId!=="secret.deny-path"&&o.strict===!1?Df(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:Nf(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&A_(e,n))return null;return l}function A_(e,t){let n=pe(e,"input-candidate")??pe(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of xo(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(Xe(a.text,t))}let o=St(r);if(o.length===0)return!1;let i=it(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>c_.has(a))}function Df(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=pe(e,"input-candidate");return[...s?xn(s.shell,e.store,r,t,o,n,T_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function T_(e){return e.program.dialect==="powershell"}function xn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new We;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...iw(Xe(e.source,r),t,n,r,o,i)],l=(c)=>Xe(z_(c,s),r);return Eo(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...mi(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...k_(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...jf(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>O_(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return Ks;return a.push({target:l(c.target),cwd:u.cwd}),null}}),a}function Va(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new We;return s.status==="complete"?xn(s,t,n,r,o,i):null}function mi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(kf.has(it(St(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...mi(p,t,n,r,o,i)]}let l=F_(e).map(a),c=St(e);if(c.length===0)return l;let u=c[0]??"",m=it(u).toLowerCase(),d=c.slice(1),f=I_(u,m,d);if(f)return[...l,...f.map(a)];if(Bf.has(m))return n.capturedOutput===!0?[...l,...Vf(e).map(a)]:l;if(m==="eval")return[...l,...Va(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:ot(m,p)).map(a)];if(m==="git")return[...l,...$_(d).map(a)];if(kf.has(m))return[...l,...B_(d).map(a)];if(p_.has(m))return[...l,...fw(d).map(a)];if(s_.has(m))return[...l,...V_(d,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...d.flatMap((p)=>ot("awk",p)).map(a),...d.flatMap((p)=>q_(p,t,n,r,o,i)),...d.flatMap(Y_).map(a)];if(m==="curl")return[...l,...d.flatMap((p)=>ot(m,p)).map(a),...U_(d).map(a)];if(nr(m)){let p=er.has(m)?Se([m,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new We;if(h.status==="complete")return[...l,...xn(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...K_(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>ot(m,p)).map(a)]}function I_(e,t,n){let r=ai(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function k_(e,t,n,r,o,i,s){if(L_(t,n,r,o,i,s))return Vf(e).map((a)=>({target:a,cwd:i}));return jf(t,M_(e),n,r,o,i,s,()=>[])}function O_(e,t,n,r,o,i,s){let a=St(e);if(!nr(it(a[0]??"").toLowerCase()))return[];return Va(t,n,r,o,i,s)??[{target:t,cwd:i}]}function jf(e,t,n,r,o,i,s,a){let l=W_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>er.has(l)?xn(n.getShellSyntax(c),n,r,o,i,s):ui(l,c,n,r,o,i,s))}function Vf(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase();if(!Bf.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Ka(r.replaceAll("%%","%"))];return t.slice(1)}function M_(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return N_(r);return[]}function N_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ka(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>D_(t,r.slice(i*n,(i+1)*n)))}function D_(e,t){let n=0;return Ka(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ka(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function L_(e,t,n,r,o,i){let s=St(e);if(s.length===0||it(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Ut(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Ua]:l.map((m)=>m.split(c).join(Ua));return mi(u,t,n,r,o,i).some((m)=>m.target.includes(Ua))}function W_(e){let t=St(e);if(t.length===0)return null;let n=it(t[0]??"").toLowerCase();if(!nr(n))return null;return G_(n,t.slice(1))?n:null}function G_(e,t){let n=qa(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Uf.has(o)||Kf(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(P_.get(n)?.has(o))r++;continue}return!1}return!0}function qa(e){return/^python\d/.test(e)?"python":e}function F_(e){let t=[];for(let n of e){if(Yf(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Lf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function z_(e,t){if(!t||!Lf.test(e))return e;return`~${e.replace(Lf,"").replace(/\\/g,"/")}`}function ot(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function B_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>ot("jq",i))}return e.flatMap((r,o)=>o===t?[]:ot("jq",r))}function $_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>ot("git",i))];if(t.push(...ot("git",r)),!be.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:ot("git",o)),n++}return t}function U_(e){return e.flatMap((t,n)=>{let r=j_(t);if(r!==null)return Wf(r.flag,r.value);let o=H_(e[n-1]);return o===null?[]:Wf(o,t)})}function Wf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ha(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ha(t.slice(n+1))}return t.startsWith("@")?Ha(t.slice(1)):[]}function H_(e){if(e===void 0)return null;if($f.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function j_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return $f.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ha(e){return e===""||e==="-"?[]:[e]}function V_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!a_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>l_.has(f)),m=u===-1?c:c.slice(0,u),d=mi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,h)=>{if(!u_.has(f))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function K_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Uf.has(c)||Kf(e,c)){let m=t[l+1];if(m!==void 0)a.push(...ui(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...ui(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Kf(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return f_.get(t[t.length-1]??"")?.has(qa(e))??!1}function q_(e,t,n,r,o,i){if(!e.includes("system"))return[];return sa(e)?.commands.flatMap((s)=>xn(t.getShellSyntax(s),t,n,r,o,i))??[]}function Y_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function Z_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Ya),...e.match(ja)??[]]}function ui(e,t,n,r,o,i,s){let a=(f)=>({target:f,cwd:i}),l=J_(t,X_(e));if(l===null)return Z_(t).map(a);let c=l.masked.match(x_)!==null||l.literals.some((f)=>R_.test(l.masked.slice(0,f.start))),u=l.masked.match(__)!==null||l.literals.some((f)=>w_.test(l.masked.slice(0,f.start))),m=r.refineInlineData===!0&&!er.has(e),d=m&&!(nw(l.masked)||c||u)?[]:l.literals;return[...d.map((f)=>f.text).filter((f)=>f!=="").map(a),...d.flatMap((f)=>Ya(f.text)).map(a),...m?[]:l.literals.flatMap((f)=>f.text.match(ja)??[]).map(a),...c?l.literals.flatMap((f)=>Va(f.text,n,r,o,i,s)??[a(f.text)]):[],...u?l.literals.flatMap((f)=>ui(e,f.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
-`:h),n,r,o,i,s)):[],...(l.masked.match(ja)??[]).map(a)]}function X_(e){let t=qa(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function J_(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(v_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&tw(e,o))return null;let a=t==="python"?Q_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=ew(e,c,l);if(u===null)return null;let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&E_.test(m))return null;r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function Q_(e,t){return S_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function ew(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function tw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function nw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(d_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>m_.has(i)))continue;if(o.length>1)return!0;if(rw(e,r)===".")return!0;if(ow(e,r+n.length)==="(")return!0}return!1}function rw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function ow(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function iw(e,t,n,r,o,i){return uw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...xn(a,t,{...n,capturedOutput:!0},r,o,i),...sw(a,r)?aw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function sw(e,t){let n=xo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||it(Xe(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Xe(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function aw(e,t){return xo(e).flatMap((n)=>n.kind==="word"?[Xe(n.text,t)]:n.kind==="redirection"&&n.target?[Xe(n.target,t)]:[]).flatMap(Ya)}function Ya(e){let t=cw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||lw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function lw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function cw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function uw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Wn(o,n))continue;if(qf(e,r,n)){let i=dw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=mw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function dw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Wn(i,n))continue;if(qf(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function mw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function qf(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function fw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===g_)o=!0;if(y_.has(m))r=!0;if(d!==void 0){if(m===Mf)t.push(d);continue}if(b_.has(m)){let f=e[l+1];if(m===Mf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let h=0;h<m.length;h++){let g=m[h]??"";if(h_.has(g))r=!0;if(C_.has(g)){d=g,f=m.slice(h+1);break}}if(d==="")continue;if(f.length>0){if(d===Of)t.push(f);continue}let p=e[l+1];if(d===Of&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function St(e){let t=e.findIndex((n)=>!Yf(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Yf(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var pw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),gw=".env.",hw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),yw=[".env.example.",".env.sample."];function Cw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function bw(e){return e.length>0&&!/\s/.test(e)}function Sw(e,t,n,r){try{let o=vr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof N)throw o;return!1}}var vw=new Set(["node_modules","__pycache__"]),Ew=[["vendor","bundle"],["vendor","cache"]];function xw(e,t,n,r,o){if(Cw(e))return null;let i=He(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>bw(s)||Sw(e,t,r,o);if(hw.has(s)||yw.some((d)=>s.startsWith(d)))return null;let c=B(Tw(e,t,r,o));for(let d of is){let f=`~/${d.suffixParts.join("/")}`;if((Ff(a,f)||Ff(c,f))&&rt(d.id,n))return d.id}let u=Rw(i,t,n,r,o);if(u)return u;if(pw.has(s))return null;for(let d of os)if(s===d.basename&&rt(d.id,n))return d.id;if(s.startsWith(gw)&&rt(Br.id,n)&&l())return Br.id;for(let d of ss)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&rt(d.id,n)&&l())return d.id}for(let d of as)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&rt(d.id,n))return d.id}if(Pw(a))return null;if(!s.includes(".")&&Gn.pattern.test(s)&&rt(Gn.id,n))return Gn.id;let m=Aw(s,n);if(m)return m;return null}function Rw(e,t,n,r,o){return $r.find((i)=>{if(!rt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Sr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,He("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||br(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Sr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,He(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||br(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||br(e,s,["credentials"])||br(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>Sr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?z(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?Sr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,He(u,t,r,o),l))}case"secret.cli.pi":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=He("~",t,r,o);return[le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),le(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||br(e,le(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),le(He("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Sr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=le(z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,He("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&Vt(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,He("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Gf=new WeakMap;function z(e,t,n,r,o){let i=Gf.get(o)??new Map;Gf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=He(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>Zf(e,le(t,r)))}function br(e,t,n){return n.some((r)=>Vt(B(e),B(le(t,r))))}function Sr(e,t,n,r,o){return Zf(e,He(t,n,r,o))}function Zf(e,t){return B(e)===B(t)}function le(e,...t){return Be([e,...t].filter(Boolean).join("/"))}function _w(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(vr(e,t,o,i));return n.some((a)=>Vt(s,B(vr(a,r,o,i))))}function ww(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(vr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Be(F(Ce(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=B(u?Be(F(di(Ce(u)),o.paths,i)):l&&Be(F(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Vt(s,m))return!1;return n.some((d)=>{let f=B(vr(d,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return Vt(s,f)})}function Pw(e){let t=e.split("/");return t.some((n)=>vw.has(n))||Ew.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Aw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ls)if(r===o.extension&&rt(o.id,t))return o.id;for(let o of cs)if(o.pattern.test(r)&&rt(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function rt(e,t){return!t?.disabledRules?.includes(e)}function He(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i)return"";if(!o)return i;let s=Xa(i,o),a=ci(s)?s:Be(di(t,s)),l=Be(F(a,n.paths,r));if(!Vt(l,o)){if(ci(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Ff(e,t){return e===t||e.startsWith(`${t}/`)}function Tw(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i||!o)return"";let s=Xa(i,o),a=r_.normalize(ci(s)?s:Be(di(t,s))),l=Be(Ce(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Vt(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function vr(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i)return"";let s=o?Xa(i,o):i;return Be(F(ci(s)?s:di(t,s),n.paths,r))}function Za(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Be(F(Ce(r),t.paths,n)):"",i=Be(Ce(Iw(Xe(e,t))));return{home:o,normalized:i}}function Iw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return i_(e)}catch{return e}}function Xa(e,t){if(e==="~")return t;if(e.startsWith("~/"))return le(t,e.slice(2));return e}function kw(e){if(process.platform==="win32")return!0;return o_.parse(e).root.length>1}function Be(e){let t=e.trim(),n=(t.includes("\\")&&kw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Vt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function it(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Kt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Ow={findPolicyMutation:Tf,findGitMetadataMutation:ad,resolveGitMetadata:Mw,loadPolicySnapshot:qc,findSensitiveTarget:Hf,analyzeCommand:Sf,getModes:Mi};function Xf(e,t){let n={...Ow,...t.dependencies},r=Lw(e),o=Er(e)?e.command:r,i=vt("policy-protection",o,()=>rr(e)),s=pe(i,"input-candidate"),a=pe(i,"declared-command");if(Er(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:$e,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:wd,intent:"stop_and_explain"}};let l=ye(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Af,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=vt("policy-protection",o,()=>Rf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:xf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ae,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let f=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...Nw(f)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:Er(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:zf,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!Er(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Ja("command-validation",o),...g};let v=vt("command-analysis",o,()=>vf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Dw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function Mw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Nw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Dw(e){return pe(e,"declared-command")?.program}function Lw(e){try{return Tn(e.input)}catch(t){let n=Er(e)?e.command:void 0;throw new Kt("policy-protection",Ja("policy-protection",t instanceof Ve?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Kt(e,Ja(e,r instanceof Ve?void 0:t,r),r)}}function Ja(e,t,n){let r=n instanceof N||n instanceof We;return{stage:e,decision:{kind:"deny",reason:r?Ci:_n,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Er(e){return e.route.kind==="command"}import{appendFileSync as Yw,mkdirSync as Zw}from"node:fs";import{isAbsolute as Xw,join as tl}from"node:path";import{lstatSync as Qf,readdirSync as Ww,readFileSync as Gw,rmdirSync as Fw,statSync as ep,unlinkSync as zw,utimesSync as Bw,writeFileSync as $w}from"node:fs";import{join as xr}from"node:path";function Jf(e,t={}){return Zr(Qt(e,t),e.home).policy.audit.retention_days}var el=86400000,Uw=".last-prune",Hw=/^\d{4}-\d{2}$/,jw=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,tp=(e)=>Math.floor(e/el);function rp(e,t,n=()=>new Date){try{let r=n().getTime();if(!ep(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=xr(t,Uw),i=ep(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&tp(i)===tp(r))return;let s=r-Jf(e)*el,a=new Date(r).toISOString().slice(0,7);for(let l of Qa(t)){if(l.isDirectory()){Vw(xr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))Kw(xr(t,l.name),s)}$w(o,"",{mode:384}),Bw(o,r/1000,r/1000)}catch{}}function Vw(e,t,n){for(let r of Qa(e)){if(!r.isDirectory()||!Hw.test(r.name))continue;let o=xr(e,r.name);for(let i of Qa(o)){if(!i.isFile())continue;let s=jw.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+el;if(!Number.isFinite(a)||a>=t)continue;op(xr(o,i.name))}if(r.name!==n)np(o)}np(e)}function Kw(e,t){try{let n=Qf(e);if(n.mtimeMs>=t)return;let r=Gw(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(qw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Qf(e).mtimeMs!==n.mtimeMs)return;op(e)}catch{}}function qw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Qa(e){try{return Ww(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function op(e){try{zw(e)}catch{}}function np(e){try{Fw(e)}catch{}}var Jw="2.4.5",Qw=1e4,eP=2000,tP=256,nP=32768;function rP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function oP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function nl(e,t,n,r,o,i,s={}){let a=rP(t);if(!a)return;let l=sP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=fi(st(n),s.failureStage?Number.POSITIVE_INFINITY:Qw),m=fi(st(r),eP),d=s.toolName?fi(st(s.toolName),tP):void 0,f=i===null?void 0:fi(st(i),nP),p=tl(l,oP(f?.value??null),c.slice(0,7));Zw(p,{recursive:!0,mode:448});let h=tl(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Di)(),v:Jw,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Yw(h,`${JSON.stringify(g)}
-`,{encoding:"utf-8",mode:384}),rp(e,l,s.now)}catch{}}function fi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function iP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&Xw(n)?n:null}function sP(e){let t=iP(e);return t?tl(t,".cc-safety-net","logs"):null}function sp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=ip(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?ip(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function ip(e){return"command"in e?e.command??"":""}function ap(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;nl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function lp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;nl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function up(e,t,n){try{let r=Xf(t,{environment:e,...n.guard});return cp(e,t,r,n),r}catch(r){if(!(r instanceof Kt))throw r;throw cp(e,t,r.evaluation,n,!(r.cause instanceof Ve),{stage:r.stage,errorCode:aP(r.cause)}),r}}function cp(e,t,n,r,o=!0,i){ap(e,sp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function aP(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Ve)return"tool-input-limit";if(e instanceof We)return"structural-shell-syntax-limit";return"unexpected-error"}function Et(e,t={}){return{malformed:!0,denial:wn(t),cwd:e}}function dp(e,t={}){return(n,r)=>{try{return lP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(wn())}}}function lP(e,t,n,r){let o=Fl();if(n.cancelled?.(t))return n.block(wn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return lp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=ll(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=up(o,i,{guard:{auditAllowed:zl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Kt))throw l;if(Rt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${ul(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var mp="exec",cP=new Set(["auto","gateway"]);function fp(e){e.on("before_tool_call",uP(e),{matcher:[mp],priority:50})}function uP(e,t={}){return dp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>dP(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>pP(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function dP(e,t,n,r){if(!e||typeof e!=="object")return Et(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Et(null);if(o!==mp)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Et(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Et(null,{toolName:o});if(s.host!==void 0&&!cP.has(s.host))return Et(null,{command:a,toolName:o});let l=mP(n,t.agentId,r);if(!l)return Et(null,{command:a,toolName:o});let c=fP(l,s,r);if(!c)return Et(l,{command:a,segment:typeof s.workdir==="string"?s.workdir:void 0,toolName:o});return In(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function mP(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return wi(".",[r],n)}catch{return}}function fP(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return wi(r,[e],n)}function pP(e){return{block:!0,blockReason:cl(e)}}var EL={...al,register:fp};export{EL as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Ko(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function mr(e){return e?w(e):""}function Sx(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Pa(e,t){return wa(Ne(e,"posix"),t)}function gr(e){return Pa(e,new Set(Array.from(e.matchAll(Ef)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function wa(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(wa(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>wa(o,n))||wf(r.words,n))return!0;_x(r,n)}return!1}function wf(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(pr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return vf(e[s],t)}if(J.has(o)){let s=e.slice(n),a=ve(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&vf(s[l],t)}let i=vx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return wf(e.slice(i),t)}function vx(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return Ex(e,t+1);if(r==="exec")return xx(e,t+1);if(r==="env")return Rx(e,t+1,n);return null}function Ex(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function xx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Rx(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return pr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return pr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function _x(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(pr(n,t))t.add(r.name)}}function pr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Ef)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(dx.test(o)||t.has(o))}))}function vf(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||pr(e,t))}var wx=["--init-file","--rcfile"],Ax=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function rt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Af(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Af(e,t,!1);if(r!==null)return r}}return null}function ot(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return ve(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Af(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Pf(e){let t=k(e[0]??"").toLowerCase(),n=Px(e,t),r=Ax.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Px(e,t){let n=ve(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?wx.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let f=l.split("=",1)[0]??l;if(t==="bash"&&Yi.has(f)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Zi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var Ta="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Ia="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Tx="__CC_SAFETY_NET_XARGS_INPUT__",qo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Yo="rm",Ix=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,kx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Ox=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Mx=/^(?:[0-9]+|[@*])$/;function kf(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Ut(n),i=n.slice(r),s=b("xargs.shell-dynamic",Ia);if(Dx(i,o,t)&&P(s,t.policy))return P(s,t.policy);for(let a of ze(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?P(s,t.policy):null;if(c)return c;let u=Wf(l,o,a.wrapperEnvAssignments),f=a.head==="rm"&&o!==null&&Df(l,o),d=t.analyzeChild(l,{...zt(a,t),dynamicInput:u,dynamicSourceInput:f||Mf(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:f,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",Ta)});if(d)return d;let m=Nx(l,o,t.policy?.rules??[],P(s,t.policy));if(m)return m;if(a.head==="git"){let g=o===null?[...l,Tx]:l,h=o!==null&&(l.some((S)=>S.includes(o))||Array.from(a.envAssignments.values()).some((S)=>S.includes(o))),y=t.analyzeChild(g,{...zt(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=et(l,t.policy?.rules??[]);if(p)return p}return null}function Nx(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=et([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Of(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=yf(e,r,t.length,n);return o===null?[]:[o]}function Mf(e,t,n,r,o,i,s){if(J.has(t)){if(ot(e))return!1;if(n!==null&&Lx(e,n,s))return!0;let a=rt(e);if(!a){let l=nt(K(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Nf(a,n,s))return!0;if(Ae(a))return!0;return Wx(a,n,r)}if(Me(t))return Tf(e,n,go,Fu(t));if(we.has(t))return Tf(e,n,la,Fd);if(t==="eval"){let a=jo(K(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return Gx(e,n,i);if(t==="git"){let a=Re(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&pn.has(a.subcommand.toLowerCase())&&Lf(a.rest,n).some((l)=>l.includes(n))}return!1}function Nf(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Ae(i)===null&&n(i)===null}function Tf(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,qo]).sources.some((a)=>a.value===qo);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${qo}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${qo}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Of(l,t,a))));return Uo(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function Dx(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(ze(e,n),(i)=>i.head)),o=t===null?[...e,Yo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Yo));return Array.from(ze(o,n)).some((i)=>i.head===Yo&&!r.has(Yo))}function Df(e,t){return Lf(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Lf(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Wf(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function Lx(e,t,n){let r=ve(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Nf(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Of(a,t,s).some((u)=>{let f=e.map((m,p)=>p===l?m.replaceAll(t,u):m),d=ve(f);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(f[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(f[d.scriptIndex]??"").includes(u)})}))}function Wx(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Ix))if(If(o,r))return!0;for(let o of e.matchAll(kx))for(let i of(o[1]??"").matchAll(Ox))if(If(i,r))return!0;return Pa(e,r)}function If(e,t){let n=e[1]??e[2];return n!==void 0&&(Mx.test(n)||t.has(n))}function Gx(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(tt(s)){let l=ur(e,i);i=l.nextIndex-1;for(let c of ze(l.tokens,{environment:n,cwd:void 0})){let u=Wf(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Df(c.tokens,t)||Mf(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=yt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Ut(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var hr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",yr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",zx="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Bx="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Xo=/\{[^{}\s]*\}/g,Gf=/\{\}|\{-?\d+\}/g,$x=["e","f","source","file","-e","-f","--source","--file"],Ux=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Hx=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),jx=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Ff=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Vx=new Set(["--workdir","--wd"]),zf="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ie(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function jf(e){return Ie([...e],(t)=>Ae(t))}function Vf(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=hn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=tm(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:f}=o;if(c){let p=hn(t);if(p)return p;let g=jf(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=Jx(t);if(p)return p}if(u!==void 0&&a){let p=hn(t);if(p)return p}let d=Qx(u,t.cwd,t.environment.paths);if(d===null){let p=hn(t);if(p)return p}let m=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(f){if([...ze(i,m)].flatMap((g)=>[...g.envAssignments.values()]).some(Ma)){let g=hn(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=Zf(m.envAssignments,m.cwd,a);return Ie(p,(h)=>t.analyzeNested(h,g))}return Ie(ze(i,m),(p)=>Kx(p,o,t,m))}function Kx(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(Qf)){let h=hn(n);if(h)return h}let u=jf(c);if(u)return u;let f=c.some(G),d=i||f,m=a&&d,p=Zf(e.envAssignments,e.wrapperCwd,s||m);if(J.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ie(o,(E)=>n.analyzeChild(Zo(l,E,n.budget),zt(e,r)))};if(ot(l))return h();let y=rt(l);if(y){if(em(y)){let x=St(n);if(x)return x;if(o.length===0)return null;return Ie(o,(A)=>n.analyzeNested(Uf(y,A,n.budget),p))}if(G(y)){if(o.length>0)return Ie(o,(q)=>n.analyzeNested(Uf(y,q,n.budget),p));let x=dr(y);if(x?.[0]&&M(x[0])==="rm"&&Be(x)){let q=$f(n);if(q)return q}let A=x?n.analyzeChild(x,{...zt(e,r),dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",yr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",hr)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!f&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>Vo(K(x===void 0?l:i?l.map((A)=>Xf(A,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=St(n);if(x)return x}let v=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(v.length>0)return n.budget.charge("derivedTokens",v.length),Ie(v,(x)=>n.analyzeNested(x,p));if(gr(y)){let x=St(n);if(x)return x}let T=n.analyzeNested(y,p);if(T)return T;if(d)return St(n);return null}let S=nt(K(l));if(S.kind==="dynamic"||S.kind==="literal"&&G(S.source))return St(n)??h();if(S.kind==="literal")return h();if(o.length>0){let E=St(n);if(E)return E;let v=h();if(v)return v;if(i)return null;let T=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",T.length),Ie(T,(x)=>n.analyzeNested(x,p))}if(d||a)return St(n)??h();return null}if(e.head==="rm"&&Be(l)){if(i&&o.length>0)return Ie(o,(y)=>ka(Zo(l,y,n.budget,Gf),e.cwd,r));if(o.length>0)return Ie(o,(y)=>ka(Hf(l,y,n.budget),e.cwd,r));let h=ka(l.flatMap((y,S)=>{if(S===0||!G(y))return[y];return y.startsWith("-")?[y.replace(Gf,"")]:[]}),e.cwd,r);if(h)return h;return $f(n)}let g=o.length>0?o:[void 0];return Ie(g,(h)=>{let y=h===void 0?l:i?Zo(l,h,n.budget):Hf(l,h,n.budget),S=b("parallel.shell-dynamic",yr),E=a&&e.head==="find"?Xx(y,r):null,v=qf(y,a,n)??E?.customResult??null,T=M(e.head),x=a&&(T==="rm"&&Oa(y)||T==="xargs"&&Yf(y)||E?.rmOptions===!0),A=a&&(x||E?.executedSource===!0||E===null&&Kf(y,T)),q=n.analyzeChild(y,{...zt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:x,dynamicSourceInput:v!==null||A,shellDynamicMatch:S,dynamicSourceMatch:S,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",hr)});if(A){let Z=P(S,n.policy);if(Z)return Z}return q??v??et(y,n.policy?.rules??[])})}function Kf(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return Zx(e);if(t==="git")return qx(e);if(t==="find")return!0;if(we.has(t))return Bf(e,$x,cr);if(Me(t))return Bf(e,Ux,po);return!1}function Oa(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||em(o)))}function qx(e){if(Yx(e))return!0;let t=Re(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!pn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function Yx(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function Zx(e){if(ot(e))return!1;let t=rt(e);if(t!==null)return G(t);let n=nt(K(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function Bf(e,t,n){let r=n(e);if(r.some((o)=>G(o.value)))return!0;if(!e.some(G))return n([...e,zf]).some((o)=>o.value===zf);return Uo(r,t,(o)=>n(e.map((i)=>Xf(i,[o]))))}function qf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(G))return St(n);return Ie(o,(i)=>et([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function Xx(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of ze(i,t))n.executedSource||=Kf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Oa(a.tokens)||a.head==="xargs"&&Yf(a.tokens),n.customResult??=qf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(tt(a)){i=[],n.executedSource||=G(a);continue}let l=yt(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function Yf(e){let t=e.slice(Ut(e).childStart);return M(t[0]??"")==="rm"&&Oa(t)}function Jo(e,t){return(n)=>P(b(e,t),n.policy)}var St=Jo("parallel.shell-dynamic",yr),Jx=Jo("parallel.command-stream-dynamic",zx),hn=Jo("parallel.command-stream-dynamic",Bx),$f=Jo("parallel.rm-recursive-force-dynamic",hr);function ka(e,t,n){return P(Ho(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Lt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Zf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Xf(e,t){return e.replace(Xo,(n)=>Jf(n,t))}function Zo(e,t,n,r=Xo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Jf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Uf(e,t,n){return Zo([e],t,n)[0]??""}function Hf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Jf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function G(e){return e.search(Xo)!==-1}function Qf(e){if(Ma(e))return!0;for(let t of e.matchAll(Xo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Ma(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function em(e){return/^\{[^{}\s]*\}$/.test(e)}function Qx(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Fx(e))return null;try{return mt(t??e,e,n)}catch{return null}}function tm(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=da(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=da(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let g=e[t+1],h=p.indexOf("="),y=h===-1?p:p.slice(0,h),S=h===-1?void 0:p.slice(h+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?S:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||jx.has(y)){c=!0,t+=S===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=S===void 0?2:1;continue}if(Ff.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=Ff.has(p)?2:1;continue}if(Vx.has(y)){c=!0;let E=S??g;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=S===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&S!==void 0){t++;continue}if(Hx.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Ma:Qf);let u=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let h=e[g];if(h===":::"){u.push(p),p=[];continue}if(h!==void 0)p.push(h)}u.push(p)}c||=u.length>1;let f=eR(u),d=n.some(G),m=n.length===0&&o===-1;return{template:n,jobs:f,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:m,unsupported:c,workdir:a,dryRun:l}}function eR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function nm(e){return tm(e).childStart}var tR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Qo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Da(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Na(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function om(e,t,n,r,o=!1,i){let a=(Bn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",tR):null;return P(a,i)??im(e,t,n,o,i)}function im(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Da(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=sn(e,t),l=rR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((f)=>f<=l))return P(b("shell.dynamic-structure",Qo),o);if(P($o(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((f,d)=>d>l&&w(f)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&pn.has(c)&&i.some((f)=>f>l&&(u===-1||f<u)))return P(b("shell.dynamic-structure",Qo),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&oR(t)?P(b("shell.dynamic-structure",Qo),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=Be(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?P(b("shell.dynamic-structure",Qo),o):null}if(s==="xargs")return rm(e,t.slice(Ut(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return rm(e,t.slice(nm(t.map(w))),"parallel",n,r,o);return null}function rm(e,t,n,r,o,i){if(t.length===0)return null;let s=nR(t,r);if(Bn(e,s)){let l=P(b(`${n}.shell-dynamic`,n==="xargs"?Ia:yr),i);if(l)return l}let a=im(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Da(l)&&Na(l)))return P(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ta:hr),i);return null}function nR(e,t){let n=Ot(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function rR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(Se.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function oR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Da(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Na(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Na(s)))return!0;continue}if(t=!0,a)return!0;let l=yt(s.text);if(l>0){n=l;continue}if(tt(s.text))o=!0,r=!0}return!1}function La(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!co(t[n.tokenIndex],n.value)})}var iR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",sR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",aR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function sm(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",iR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",sR);if(e==="shred"&&n.length>0)return b("shred.target",aR);return null}var lm=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Ho(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>$o(e.words,Wa(e))},{heads:new Set(["find"]),analyze:(e)=>jd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>kf(e.words,{...am(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Vf(e.words,{...am(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})}];function am(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ht(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Wa(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function fm(e){return lm.find((t)=>t.heads.has(e))?.analyze}function Cn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,f=s?s.originalCwd:c?void 0:n.cwd,d=Co(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let m=Ot(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=m.envSplitValues??[];if(p.length>0){let R=[...p,...i(m.words)].join(" "),I=Ae(R);if(I)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:I.reason}),de(I);if(n.strict)return ye(r);let L=bo(p,i(m.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:m.cwd===void 0?n.effectiveCwd:m.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...m.envAssignments])});if(te)return te}}let g=m.rewritten?K(i(m.words)):sn(o,m.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>g.length){let R=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-g.length),output:h})}let S=new Map([...n.envAssignments??[],...d.envAssignments,...m.envAssignments]),E=h[0];if(!E)return null;if(Ft(E))throw new N("wrapperPeelIterations");let v=M(E),T=m.cwd===null?void 0:m.cwd??u,x=m.cwd===null?void 0:f,A=m.cwd===void 0?n.effectiveCwd:m.cwd,q=s?s.allowTmpdirVar:!or(S,n.environment),Z=om(o,m.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),de(Z);let ee=Lo(h,n.policy);if(ee){for(let R of[ee.childIndex,...ee.alternativeChildIndices]){cm(y.wrapperNormalizationBudget);let I=g.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=Cn(I,t,{...y,effectiveCwd:A,envAssignments:S});if(L)return L}return null}let X=l?void 0:v==="eval"?jo(g):v==="trap"&&!a?Rf(g):void 0;if(a&&s&&v==="eval"){if(X?.kind==="dynamic")return yn(s,n.policy);if(X?.kind==="literal"){let R=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:S});if(R)return R}return bn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!Aa(n.commandView)))return ye(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:v==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let R=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:S,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?J.has(v):pm(E,v)){if(ot(h))return null;if(a&&s){let R=rt(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=yn(s,n.policy);if(L)return L}if(gr(R)){let L=yn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:A,envAssignments:S})}let I=nt(g);if(I.kind==="dynamic")return yn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?yn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?yn(s,n.policy):null}if(l){let R=rt(h),I=R?n.analyzeNested(R,{effectiveCwd:A,envAssignments:S}):nt(g).kind==="dynamic"?ye(r):null;if(I)return I}if(s===void 0){let R=dR(h,S,A,n,r,t);if(R)return R;let I=rt(h);if(I){let qt=Vo(g,I);if(qt.kind==="dynamic")return ye(r);let hi=qt.kind==="literal"?qt.source:I,fl=fR(hi);r?.recordSegment({type:"shell-wrapper",wrapper:v,innerCommand:fl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:fl,depth:t+1});let ml=n.analyzeNested(hi,{effectiveCwd:A,envAssignments:S});if(ml)return ml;return gr(hi)?ye(r):null}let L=nt(g);if(L.kind==="dynamic")return ye(r);if(L.kind==="literal")return ei(L.source,A,S,n,r,t);let te=_f(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:A,envAssignments:S})}}if(!s&&(v==="source"||v===".")){let R=h[1]==="-p"?2:null;if(R!==null){let qt=n.commandView?g[R]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return ye(r)}let I=R===null?1:3,L=h[I]==="--"?I+1:I,te=n.commandView?g[L]:void 0;if(!te)return null;if(te.provenance==="literal")return ei(te.text,A,S,n,r,t);if(n.strict||!n.commandView||!Aa(n.commandView))return ye(r)}if(we.has(v)&&!l){if(!s&&n.strict&&La(cr(h),g))return ye(r);let R=zd(h,(L)=>Ht(n.analyzeNested(L,{effectiveCwd:A,envAssignments:S}))),I=P(R,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),de(I)}if(Me(v)&&!l){if(!s&&n.strict&&La(po(h),g))return ye(r);let R=Gu(h);if(a&&s)return cR(v,R,A,S,n,s);if(R){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:v,codeArg:R,paranoidBlocked:I}),I){let te=P(b("interpreter.one-liner-paranoid",Yn),n.policy);if(te)return de(te)}if(Bs(v,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:A,envAssignments:S});if(L&&!mm(L,R))return L;if(Zn(R,void 0,!n.strict)){let te=P(b("interpreter.dangerous-command",cn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:cn}),de(te)}r=void 0}}if(v==="busybox"&&h.length>1)return cm(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),Cn(g.slice(1),t,{...y,effectiveCwd:A,envAssignments:S});let D=s?null:P(sm(v,h),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),de(D);let ue=r===y.trace?y:{...y,trace:r},_e={words:g,head:v,cwd:T,originalCwd:x,envAssignments:S,allowTmpdirVar:q,dynamicArguments:m.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:ue,analyzeChildTokens:(R,I)=>a&&s?Ga(R,t,ue,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ht(Cn(K(R),t+1,{...ue,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:S}))??et(R,ue.policy.rules),analyzeChild:(R,I)=>Ga(R,t,ue,I)},qe=s&&(v==="xargs"||v==="parallel")?void 0:fm(v);if(v==="rm"||v==="xargs"||v==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:S.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let ke=r&&v==="git"?hf(_e.words,Wa(_e)):void 0,pi=um(ke?ke.match:qe?.(_e)??null,n.policy);if(r)mR(_e,pi,ke?.relaxation??null);if(pi)return de(pi);if(a&&s&&(v==="rm"||v==="rmdir")){if(!(v==="rm"&&(Be(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?bn(s,n.policy):null)??uR(s,n.policy)}let ul=qe!==void 0,dl=!s&&!ul&&!Wr.has(v),gi=r&&dl?[]:void 0;if(dl)for(let R=1;R<h.length;R++){let I=h[R];if(!I)continue;gi?.push(I);let L=um(lR(h,R,t,ue,T,x,A,S),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[],embeddedCommandFound:M(I)}),de(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&ul)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let _r=et(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!_r,reason:_r?.reason}),_r)return de(_r);return a&&s?bn(s,n.policy):null}function Ga(e,t,n,r){return Ht(Cn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function lR(e,t,n,r,o,i,s,a){for(let l of ze(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=M(c);if(pm(c,u)||fm(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=Ga(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!or(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function cR(e,t,n,r,o,i){if(!t)return bn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=P(b("interpreter.one-liner-paranoid",Yn),o.policy);if(a)return de(a)}if(Bs(e,t))return bn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!mm(s,t))return s;if(Zn(t,void 0,!o.strict)){let a=P(b("interpreter.dangerous-command",cn),o.policy);if(a)return de(a)}return bn(i,o.policy)}function mm(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Mo)||e.reason===mn)&&!Gr(t)}function yn(e,t){let n=e.shellDynamicMatch?P(e.shellDynamicMatch,t):null;return n?de(n):null}function bn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?P(e.dynamicSourceMatch,t):null;return n?de(n):null}function uR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?P(e.rmDynamicMatch,t):null;return n?de(n):null}function dR(e,t,n,r,o,i){let s=Pf(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ei(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ei(a,n,t,r,o,i,!0)}function ei(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=qn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function fR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function mR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function cm(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function de(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:ar}),de(pR())}function pR(){return{id:"",reason:ar,intent:"stop_and_explain"}}function pm(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function um(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:P(e,t)}var gR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,hR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function yR(e,t){let n=ym(e,t);if(n.length===0)return!1;let r=n[hm(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return gR.test(e.join(" "))}function gm(e,t,n,r,o){if(e.dialect==="powershell"){let h=bR(e.words,o);if(h.kind==="none")return;if(!t||h.kind==="unknown")return null;return dm(xR(h.target),t,n.paths)}let i=e.words.map(w),s=i.some((h)=>/^CDPATH\+?=/.test(h));if(!yR(i,n))return s?null:void 0;if(!t)return null;let a=ym(i,n,t),l=hm(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((h)=>h.length<=1||!h.startsWith("-")||h==="--");if((u===-1?c:c.slice(0,u)).some((h)=>!/^-[LP]+$/.test(h)))return null;let d=u===-1?[]:c.slice(u),m=d[0]==="--"?d.slice(1):d;if(m.length!==1)return null;let p=m[0]??"",g=e.words.some((h)=>h.provenance==="variable"&&h.text===p)?CR(p,r):p;if(g===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(g)&&(s||n.env.has("CDPATH")))return null;return dm(g,t,n.paths)}function CR(e,t){let n=fr(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function dm(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return mt(t,e,n)}catch{return null}}function bR(e,t){let n=SR(e[0])?1:0,r=e[n];if(!vR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!hR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return ER(e.slice(n+1),t)}function SR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function vR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function ER(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function xR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function hm(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function ym(e,t,n){let r=RR(e);return pt([...r],t,n)}function RR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var _R="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",jt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Ua(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Ne(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return $a(e,n);let u=`${Mo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return xm(e,n),{reason:mn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return xm(e,n),{reason:mn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return $a(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=rf(n.environment.env,n.envAssignments);return ri(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ri(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],f=u?.kind==="connector"?u.operator:void 0,d=wR(e,l,c,a,f),m=a==="&&"||a==="||",p=m?s:void 0,g=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,h=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],S=m||vn(f);if(c.kind==="function"){let Z=g.flatMap((X)=>{let U=En(X);return U.functionDefinitions.set(c.name,c.body),Fa(X,[U],d,f==="&",vn(f))}),ee=za(Z,[],h,y,a,f);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of g){let D=ri(c.body,t,n,r,[En(U)]);if(D.result)return D;if(Z.push(...Fa(U,D.states,d,f==="&",vn(f))),S)ee.push(U,...d?D.states.map((ue)=>ti(U,ue)):D.states)}let X=za(Z,ee,h,y,a,f);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),v=e.nodes[l-2],T=oi(a)&&v?.kind==="command"?xf(v)??PR(v):void 0,x=[],A=[];for(let Z of g){let ee=TR(c,t,n,r,[En(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ti(Z,U));for(let U of X){let D=En(U),ue=OR(c,t,n.trace?{...n,trace:Rm(n.trace,E)}:n,r,D,oi(a),T);if(ue)return{result:ue,states:i};let _e=qR(c,D.functionDefinitions);if(_e)n.budget.charge("derivedTokens",ii(_e));let qe=_e?t+1>=V.recursionDepth.cap?Ba(c.displayText,n,[D]):ri(_e,t+1,n,r,[D]):{result:null,states:VR(c,D)};if(qe.result)return qe;if(x.push(...Fa(Z,qe.states,d,f==="&",vn(f))),S)A.push(Z),A.push(...qe.states.map((ke)=>d?ti(Z,ke):ke))}}let q=za(x,A,h,y,a,f);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function wR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(oi(r)||oi(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&AR(e,t)}function Fa(e,t,n,r,o){let i=n?t.map((a)=>ti(e,a)):[...t],s=o?i.flatMap((a)=>Sn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ti(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function AR(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(IR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function oi(e){return e==="|"||e==="|&"}function PR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function vn(e){return e==="&&"||e==="||"}function za(e,t,n,r,o,i){let s={success:ni([...n,...e]),failure:ni([...r,...t])},a=vn(i)?s:void 0;return{states:vn(o)||a?ni([...s.success,...s.failure]):s.success,conditionalStates:a}}function Rm(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function TR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=kR(e);if(s){if(t+1>=V.recursionDepth.cap)return Ba(s,n,o);let a=Ne(s,"powershell");if(a.status==="limited")return Ba(s,n,o);if(a.status!=="complete")return Cm(i,n,r,o);n.budget.charge("derivedTokens",ii(a)),i.push({program:a,depth:t+1})}}return Cm(i,n,r,o)}function IR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Cm(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ri(i.program,i.depth,t,n,[En(a)]);if(l.result)return l;s.push(...l.states)}o=ni(s)}return{result:null,states:o}}function kR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function ii(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+ii(o),0):n.kind==="group"||n.kind==="function"?ii(n.body):0),0)}function Ba(e,t,n){return t.trace?.recordSegment({type:"error",message:He}),{result:{reason:He,segment:e,intent:"stop_and_explain"},states:[...n]}}function OR(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=FR(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};_m(e,o,"before-consumer",a.environment.paths,a.budget);let c=sn(e.dialect,e.words),u=c.map(w),f=e.displayText,d=nf(c,o.shellGitContextState),m=sf(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=P(Od(e,i,ZR(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return YR(f,h)}if(u.length===1&&u[0]?.includes(" ")&&!Bn(e.dialect,e.words)){let h=P(Ae(u[0]),a.policy),y=h!==null&&!a.strict&&Nu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:f,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let S=bm(e,l,o,m,s,a);if(S)return S;return va(d,o.shellGitContextState),null}let p=Cn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:m,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let S=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=Ua(h,t+1,{...a,effectiveCwd:S,envAssignments:y?.envAssignments??m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?Rm(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:f};let g=bm(e,l,o,m,s,a);if(g)return g;return va(d,o.shellGitContextState),null}function bm(e,t,n,r,o,i){let s=zR(e,t,n,r??new Map,i);if(s)return s;return _m(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),DR(e,t,n,i.environment.paths,i.budget),UR(e,n,o,i.environment,i.trace),null}var MR=new Set([">>","<>"]);function _m(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?NR(s):MR.has(s.operator)))continue;Sm(s.target,t,r,o)}if(n!=="before-consumer"||!le(e.words[0],"tee"))return;let i=wm(e.words.slice(1));if(!i)return;for(let s of i.operands)Sm(s,t,r,o)}function NR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Sm(e,t,n,r){let o=e?.provenance==="literal"?qn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function DR(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of LR(e)){let a=qn(s.text,n.effectiveCwd,r,o);if(!a||!Wu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function LR(e){let t=GR(e.redirections)?.target,n=vm(t)?[t]:[];if(le(e.words[0],"cat"))return WR(e.words)?n:[];if(!le(e.words[0],"tee"))return[];let r=wm(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(vm))return[];return[...r.operands,...n]}function WR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function GR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function wm(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&le(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=Array.from(i.text.slice(1)).some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function vm(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function le(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Ha(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function FR(e,t){let n=e.redirections.filter((a)=>a.operator==="<<"||a.operator==="<<-");if(n.length===0)return;if(n.length!==1)return jt;let r=n[0];if(!r?.heredoc)return jt;if(!Ha(r.heredoc)&&!(t&&!/\$\(|`/.test(r.heredoc.body)))return _R;if(r.fd!==void 0&&r.fd!==0)return jt;if(e.redirections.some((a)=>a!==r&&["<","<<","<<-","<<<","<&","<>"].includes(a.operator)))return jt;let o=e.redirections.some((a)=>a!==r&&Em(a.target));if(le(e.words[0],"cat"))return o?jt:void 0;if(le(e.words[0],"tee"))return o||e.words.slice(1).some(Em)?jt:void 0;let i=e.words[0],s=e.words[1];if(le(i,"git")&&(le(s,"apply")||le(s,"commit")))return;if(le(i,"gh")&&(le(s,"pr")||le(s,"issue"))&&le(e.words[2],"create"))return;return jt}function Em(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function zR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if($R(e,i,n,r,o))return null;let a=BR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=$a(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function BR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Ha(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=le(e.words[0],"uv")&&le(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Me(i.text))return;let s=o.findIndex((f)=>le(f,"-"));if(!o.slice(1,s===-1?void 0:s).every((f)=>f.provenance==="literal"&&f.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let f=P(b("interpreter.one-liner-paranoid",Yn),n.policy);if(f)return f}if(!Zn(l,void 0,!n.strict))return null;let u=P(b("interpreter.dangerous-command",cn),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function $R(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Ha(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Ot(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return ot(a)}function UR(e,t,n,r,o){let i=gm(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var HR=/^[A-Za-z_][A-Za-z0-9_]*$/,jR=8;function VR(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!HR.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=jR&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=En(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function En(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:of(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ni(e){let t=[];for(let n of e){if(!t.some((r)=>KR(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function KR(e,t){return e.effectiveCwd===t.effectiveCwd&&Sn(e.shellGitContextState.env,t.shellGitContextState.env)&&Sn(e.literalHeredocFiles,t.literalHeredocFiles)&&Sn(e.functionDefinitions,t.functionDefinitions)&&Sn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Sn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function Sn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function qR(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function YR(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function ZR(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function $a(e,t){let n=P(Ae(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function xm(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:mn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var XR=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Am(e,t,n,r){let o=Ua(e,0,{...t,...nu(t),budget:t.budget??Ce(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function Pm(e,t,n){try{return{decision:e()}}catch(r){let o=JR(r,t,n);if(!o)throw r;return o}}function JR(e,t,n){if(!(e instanceof N)||!XR.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var QR=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Va=new Set(["cc-safety-net","ccsn"]),e_=new Set(["bunx","npx","pnpx"]),t_=new Set(["pnpm","yarn"]),n_=new Set(["npm","pnpm","yarn"]),r_=new Set(["bun","node"]);function ai(e,t,n={}){if(Va.has(e))return 0;if(e_.has(e)){if(n.broad)return ja(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return si(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&n_.has(e)&&n.broad&&t[r]==="exec"){let o=ja(t.slice(r+1));return o===null?null:r+1+o}if(t_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&si(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=ja(t.slice(r+1));return o===null?null:r+1+o}if(r_.has(e)){let o=n.broad&&r!==-1?r:0;if(Tm(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Tm(t[o+1]))return o+2}return null}function ja(e){let t=e.findIndex((r)=>si(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!si(r))break;n++}return n}function si(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return Va.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return Va.has(e.slice(0,t))}function Tm(e){let t=e?.replaceAll("\\","/");return[...QR].some((n)=>t===n||t?.endsWith(`/${n}`))}var Im="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function km(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=dn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>o_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function o_(e,t){let n=pt([...e],t),r=n.slice(1),o=ai(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as li}from"node:path";var Dm="This path contains the protected policy config and you must not modify or delete it.",i_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Lm(e,t,n){let r=d_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Om(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Mm(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Mm(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Om(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Pr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Om(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>Cr(a,n,r,o,i));return s?{target:s}:null}function Mm(e,t,n,r,o){let i=dn(e,t,r,o,{findSegmentTarget:(s,a)=>s_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>Cr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>u_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function s_(e,t,n,r,o){if(tr(e))return null;let i=Mt([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&a_(a)){let l=l_(a).find((c)=>Nm(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Fo(i,1)||ma(i,r)){let c=(Go(K(i))??K(["."])).find((u)=>{let f=pe(u.text,t.variables);return Cr(f,t.cwd,n,r,o)||Nm(f,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=_o(a).sources.find((c)=>f_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(c_(i,s))return null;for(let l of[...e,...i])for(let c of Wm(l))if(Cr(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function a_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function l_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function c_(e,t){if(!i_.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function u_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Wm(i))if(Cr(s,t,n,r,o))return{target:s};return null}function Wm(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function d_(e,t,n){let r=(a)=>br(se(a,e.executionCwd,t,n)),o=r(Qt(t)),i=[r(Ln(e.executionCwd)),r(Ln(e.configCwd))],s=new Set(i.map((a)=>li(a)));for(let a=li(o);;a=li(a))if(s.add(a),li(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function Cr(e,t,n,r,o){let i=El(e,t,r,o,(s)=>br(s)===Dr);return i!==null&&n.files.has(br(i))}function Nm(e,t,n,r,o){return n.directoriesAndAncestors.has(br(se(e,t,r,o)))}function f_(e,t,n,r,o){let i=br(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function br(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ci,posix as m_,resolve as di,win32 as p_}from"node:path";import{fileURLToPath as g_}from"node:url";var Ym="Access to a sensitive path is not allowed.",Zm=new Set(["echo","printf"]),h_=new Set(["find"]),y_=new Set(["!","do","elif","else","if","then","until","while"]),C_=new Set(["-exec","-execdir"]),b_=new Set([";","+"]),S_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),v_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Xm=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),E_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),x_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Jm=new Set(["-c","-e","-r","-E","--eval","--exec"]),R_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),__=new Set(["grep","rg"]),w_=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),A_=new Set(["commit","merge","notes","stash","tag"]),P_=new Set(["-m","--message"]),T_=new Set(["--grep"]),Gm=new Set(["jq","gojq","jaq"]),Fm="f",zm="file",I_="files",k_=new Set(["e","f"]),O_=new Set(["regexp","file"]),M_=new Set(["e","f","A","B","C","m"]),N_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Ka="__CC_SAFETY_NET_PIPE_INPUT__",Ya=/[\w./~@+-]*[./~][\w./~@+-]*/g,D_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,L_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,W_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Bm=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,$m=/\b(?:system|exec|spawn|popen)\s*$/,G_=/\b(?:eval|exec)\s*\(/g,F_=/\b(?:eval|exec)\s*$/,z_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Um(e,t,n,r,o,i){for(let s of e){let a=s.target;if(Ww(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=Dw(a,s.cwd,t,r,o);if(l){let c=!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(i&&(c&&r.paths.isDirectory(ip(a,s.cwd,r,o))||c&&s.written===!0&&!a.includes("$")&&!Xa(a,s.cwd,r,o)||c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!Xa(a,s.cwd,r,o)))continue;if(!l.startsWith("secret.cli.")&&Gw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Qm(e,t,n,r,o={}){let i=Hm(e,n,r),s=Um(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=Um(i,t,e.invocation.context.configCwd,n,r,new Set(Hm(e,n,r,{standard:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&B_(e,n)?null:a}function B_(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of Ro(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(Qe(s.text,t))}let o=st(r);if(o.length===0)return!1;let i=Ue(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return Ja(i,o.slice(1))}function Ja(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>S_.has(n))}function Hm(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?xn(s.shell,e.store,r,t,o,n,$_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function $_(e){return e.program.dialect==="powershell"}function xn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Ge;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...Cw(Qe(e.source,r),t,n,r,o,i)],l=(c)=>Qe(Q_(c,s),r);return xo(e,o,r,i,{word:l,segment:(c,u,f,d,m)=>{if(c.length===0)return null;if(a.push(...fi(c,t,n,r,u.cwd,i,m)),f!==null)a.push(...H_(f,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...ep(c.consumer,[c.body],t,n,r,u.cwd,i,(f)=>j_(c.consumer??[],f,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return Zs;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{written:!0}:{}}),null}}),a}function Qa(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Ge;return s.status==="complete"?xn(s,t,n,r,o,i):null}function fi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:o});if(s?.size){let g=e.filter((h,y)=>!s.has(y));if(Gm.has(Ue(st(g)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...fi(g,t,n,r,o,i)]}let l=J_(e).map(a),c=st(e);if(c.length===0)return l;let u=c[0]??"",f=Ue(u).toLowerCase(),d=c.slice(1),m=c.findIndex((g)=>!y_.has(g));if(n.standard===!0&&m!==-1&&Ja(Ue(c[m]??"").toLowerCase(),c.slice(m+1)))return l;let p=U_(u,f,d);if(p)return[...l,...p.map(a)];if(Zm.has(f))return n.capturedOutput===!0?[...l,...tp(e).map(a)]:l;if(f==="eval")return[...l,...Qa(d.join(" "),t,n,r,o,i)??d.map(a)];if(f==="export")return[...l,...d.flatMap((g)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(g)?[g.slice(g.indexOf("=")+1)]:Ke(f,g)).map(a)];if(f==="git")return[...l,...tw(d).map(a)];if(f==="gh")return[...l,...Za(f,d,w_).map(a)];if(Gm.has(f))return[...l,...ew(d).map(a)];if(__.has(f))return[...l,...ww(d).map(a)];if(h_.has(f))return[...l,...iw(d,t,n,r,o,i).map(a)];if(we.has(f))return[...l,...d.flatMap((g)=>Ke("awk",g)).map(a),...d.flatMap((g)=>aw(g,t,n,r,o,i)),...d.flatMap(lw).map(a)];if(f==="curl")return[...l,...d.flatMap((g)=>Ke(f,g)).map(a),...nw(d).map(a)];if(nr(f)){let g=er.has(f)?ve([f,...d]):null;if(g!==null&&g.command!==null&&g.commandIndex!==null){let h=t.getShellSyntax(g.command);if(h.status==="structural-limit")throw new Ge;if(h.status==="complete")return[...l,...xn(h,t,n,r,o,i),...d.slice(g.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...sw(f,d,t,n,r,o,i)]}return[...l,...d.flatMap((g)=>Ke(f,g)).map(a)]}function U_(e,t,n){let r=ai(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function H_(e,t,n,r,o,i,s){if(Y_(t,n,r,o,i,s)){let a=st(e),l=Ja(Ue(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...tp(e),...l].map((c)=>({target:c,cwd:i}))}return ep(t,V_(e),n,r,o,i,s,()=>[])}function j_(e,t,n,r,o,i,s){let a=st(e);if(!nr(Ue(a[0]??"").toLowerCase()))return[];return Qa(t,n,r,o,i,s)??[{target:t,cwd:i}]}function ep(e,t,n,r,o,i,s,a){let l=Z_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>er.has(l)?xn(n.getShellSyntax(c),n,r,o,i,s):ui(l,c,n,r,o,i,s))}function tp(e){let t=st(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase();if(!Zm.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[el(r.replaceAll("%%","%"))];return t.slice(1)}function V_(e){let t=st(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return K_(r);return[]}function K_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[el(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>q_(t,r.slice(i*n,(i+1)*n)))}function q_(e,t){let n=0;return el(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function el(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Y_(e,t,n,r,o,i){let s=st(e);if(s.length===0||Ue(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Ut(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Ka]:l.map((f)=>f.split(c).join(Ka));return fi(u,t,n,r,o,i).some((f)=>f.target.includes(Ka))}function Z_(e){let t=st(e);if(t.length===0)return null;let n=Ue(t[0]??"").toLowerCase();if(!nr(n))return null;return X_(n,t.slice(1))?n:null}function X_(e,t){let n=tl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Jm.has(o)||np(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(z_.get(n)?.has(o))r++;continue}return!1}return!0}function tl(e){return/^python\d/.test(e)?"python":e}function J_(e){let t=[];for(let n of e){if(op(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var jm=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function Q_(e,t){if(!t||!jm.test(e))return e;return`~${e.replace(jm,"").replace(/\\/g,"/")}`}function Ke(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function ew(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Ke("jq",i))}return e.flatMap((r,o)=>o===t?[]:Ke("jq",r))}function tw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...A_.has(r)?Za("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),P_):Za("git",e.slice(n),T_)];if(t.push(...Ke("git",r)),!Se.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Ke("git",o)),n++}return t}function Za(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Ke(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Ke(e,i))}return r}function nw(e){return e.flatMap((t,n)=>{let r=ow(t);if(r!==null)return Vm(r.flag,r.value);let o=rw(e[n-1]);return o===null?[]:Vm(o,t)})}function Vm(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return qa(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return qa(t.slice(n+1))}return t.startsWith("@")?qa(t.slice(1)):[]}function rw(e){if(e===void 0)return null;if(Xm.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function ow(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Xm.has(r)?{flag:r,value:e.slice(n+1)}:null}function qa(e){return e===""||e==="-"?[]:[e]}function iw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!C_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((m)=>b_.has(m)),f=u===-1?c:c.slice(0,u),d=fi(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...d.filter((m)=>m!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,g)=>{if(!v_.has(m))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function sw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Jm.has(c)||np(e,c)){let f=t[l+1];if(f!==void 0)a.push(...ui(e,f,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...ui(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function np(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return R_.get(t[t.length-1]??"")?.has(tl(e))??!1}function aw(e,t,n,r,o,i){if(!e.includes("system"))return[];return ca(e)?.commands.flatMap((s)=>xn(t.getShellSyntax(s),t,n,r,o,i))??[]}function lw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function cw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(nl),...e.match(Ya)??[]]}function ui(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=dw(t,uw(e));if(l===null)return cw(t).map(a);let c=l.masked.match(Bm)!==null||l.literals.some((g)=>$m.test(l.masked.slice(0,g.start))),u=l.masked.match(G_)!==null||l.literals.some((g)=>F_.test(l.masked.slice(0,g.start))),f=r.standard===!0&&!er.has(e),d=f&&!(gw(l.masked)||c||u)?[]:l.literals,m=f?Array.from(l.masked.matchAll(Bm),(g)=>{let h=g.index+g[0].length;return{start:h,end:Us(l.masked,h)}}):[],p=!f||m.some((g)=>Hs(l.masked,g.start))?l.literals:l.literals.filter((g)=>$m.test(l.masked.slice(0,g.start))||m.some((h)=>g.start>=h.start&&g.start<h.end));return[...d.map((g)=>g.text).filter((g)=>g!=="").map(a),...d.flatMap((g)=>nl(g.text)).map(a),...f?[]:l.literals.flatMap((g)=>g.text.match(Ya)??[]).map(a),...c?p.flatMap((g)=>Qa(g.text,n,r,o,i,s)??[a(g.text)]):[],...u?l.literals.flatMap((g)=>ui(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
+`:y),n,r,o,i,s)):[],...(l.masked.match(Ya)??[]).map(a)]}function uw(e){let t=tl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function dw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(L_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&pw(e,o))return null;let a=t==="python"?fw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=mw(e,c,l);if(u===null)return null;let f=e.slice(c,u);if(/[fF]/.test(a)&&f.includes("{"))return null;if(t==="simple"&&s==='"'&&W_.test(f))return null;r.push({start:c,text:f});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function fw(e,t){return D_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function mw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function pw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function gw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(E_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>x_.has(i)))continue;if(o.length>1)return!0;if(hw(e,r)===".")return!0;if(yw(e,r+n.length)==="(")return!0}return!1}function hw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function yw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Cw(e,t,n,r,o,i){return xw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...xn(a,t,{...n,capturedOutput:!0},r,o,i),...bw(a,r)?Sw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function bw(e,t){let n=Ro(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||Ue(Qe(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Qe(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Sw(e,t){return Ro(e).flatMap((n)=>n.kind==="word"?[Qe(n.text,t)]:n.kind==="redirection"&&n.target?[Qe(n.target,t)]:[]).flatMap(nl)}function nl(e){let t=Ew(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||vw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function vw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function Ew(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function xw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Wn(o,n))continue;if(rp(e,r,n)){let i=Rw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=_w(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Rw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Wn(i,n))continue;if(rp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function _w(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function rp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function ww(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let f=u[1]??"",d=u[2];if(f===I_)o=!0;if(O_.has(f))r=!0;if(d!==void 0){if(f===zm)t.push(d);continue}if(N_.has(f)){let m=e[l+1];if(f===zm&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),d="",m="";for(let g=0;g<f.length;g++){let h=f[g]??"";if(k_.has(h))r=!0;if(M_.has(h)){d=h,m=f.slice(g+1);break}}if(d==="")continue;if(m.length>0){if(d===Fm)t.push(m);continue}let p=e[l+1];if(d===Fm&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function st(e){let t=e.findIndex((n)=>!op(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function op(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var Aw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Pw=".env.",Tw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Iw=[".env.example.",".env.sample."];function kw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Ow(e){return e.length>0&&!/\s/.test(e)}function Xa(e,t,n,r){let o=ip(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function ip(e,t,n,r){try{return Er(e,t,n,r)}catch(o){if(o instanceof N)throw o;return""}}var Mw=new Set(["node_modules","__pycache__"]),Nw=[["vendor","bundle"],["vendor","cache"]];function Dw(e,t,n,r,o){if(kw(e))return null;let i=Ve(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>Ow(s)||Xa(e,t,r,o);if(Tw.has(s)||Iw.some((d)=>s.startsWith(d)))return null;let c=B(Bw(e,t,r,o));for(let d of is){let m=`~/${d.suffixParts.join("/")}`;if((qm(a,m)||qm(c,m))&&it(d.id,n))return d.id}let u=Lw(i,t,n,r,o);if(u)return u;if(Aw.has(s))return null;for(let d of os)if(s===d.basename&&it(d.id,n))return d.id;if(s.startsWith(Pw)&&it($r.id,n)&&l())return $r.id;for(let d of ss)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let m=s.slice(d.prefix.length)[0];if((m==="-"||m==="_")&&it(d.id,n)&&l())return d.id}for(let d of as)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&it(d.id,n))return d.id}if(Fw(a))return null;if(!s.includes(".")&&Gn.pattern.test(s)&&it(Gn.id,n))return Gn.id;let f=zw(s,n);if(f)return f;return null}function Lw(e,t,n,r,o){return Ur.find((i)=>{if(!it(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||vr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,Ve("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Sr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ce(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ce(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?vr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,Ve(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Sr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Sr(e,s,["credentials"])||Sr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>vr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?z(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ce(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?vr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,Ve(u,t,r,o),l))}case"secret.cli.pi":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ve("~",t,r,o);return[ce(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Sr(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(Ve("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?vr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,Ve("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&Vt(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,Ve("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Km=new WeakMap;function z(e,t,n,r,o){let i=Km.get(o)??new Map;Km.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ve(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>sp(e,ce(t,r)))}function Sr(e,t,n){return n.some((r)=>Vt(B(e),B(ce(t,r))))}function vr(e,t,n,r,o){return sp(e,Ve(t,n,r,o))}function sp(e,t){return B(e)===B(t)}function ce(e,...t){return $e([e,...t].filter(Boolean).join("/"))}function Ww(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Er(e,t,o,i));return n.some((a)=>Vt(s,B(Er(a,r,o,i))))}function Gw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Er(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?$e(F(be(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),f=B(u?$e(F(di(be(u)),o.paths,i)):l&&$e(F(`${l}/.cc-safety-net`,o.paths,i)));if(f&&Vt(s,f))return!1;return n.some((d)=>{let m=B(Er(d,r,o,i));if(!m)return!1;if(c&&(c===m||c.startsWith(m.endsWith("/")?m:`${m}/`)))return!1;return Vt(s,m)})}function Fw(e){let t=e.split("/");return t.some((n)=>Mw.has(n))||Nw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function zw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ls)if(r===o.extension&&it(o.id,t))return o.id;for(let o of cs)if(o.pattern.test(r)&&it(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function it(e,t){return!t?.disabledRules?.includes(e)}function Ve(e,t,n,r){let{home:o,normalized:i}=rl(e,n,r);if(!i)return"";if(!o)return i;let s=ol(i,o),a=ci(s)?s:$e(di(t,s)),l=$e(F(a,n.paths,r));if(!Vt(l,o)){if(ci(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function qm(e,t){return e===t||e.startsWith(`${t}/`)}function Bw(e,t,n,r){let{home:o,normalized:i}=rl(e,n,r);if(!i||!o)return"";let s=ol(i,o),a=m_.normalize(ci(s)?s:$e(di(t,s))),l=$e(be(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Vt(c(a),c(d)));if(u===void 0)return"";let f=a.slice(u.length);return f?`~${f}`:"~"}function Er(e,t,n,r){let{home:o,normalized:i}=rl(e,n,r);if(!i)return"";let s=o?ol(i,o):i;return $e(F(ci(s)?s:di(t,s),n.paths,r))}function rl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?$e(F(be(r),t.paths,n)):"",i=$e(be($w(Qe(e,t))));return{home:o,normalized:i}}function $w(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return g_(e)}catch{return e}}function ol(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function Uw(e){if(process.platform==="win32")return!0;return p_.parse(e).root.length>1}function $e(e){let t=e.trim(),n=(t.includes("\\")&&Uw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Vt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function Ue(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Kt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Hw={findPolicyMutation:Lm,findGitMetadataMutation:pd,resolveGitMetadata:jw,loadPolicySnapshot:tu,findSensitiveTarget:Qm,analyzeCommand:Am,getModes:Mi};function ap(e,t){let n={...Hw,...t.dependencies},r=qw(e),o=xr(e)?e.command:r,i=vt("policy-protection",o,()=>rr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(xr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:He,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Md,intent:"stop_and_explain"}};let l=Ce(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Dm,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let f=vt("policy-protection",o,()=>km(i,t.environment,l));if(f){let E=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Im,intent:"hard_stop",evidence:{command:E,segment:f.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let m=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...Vw(m)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:xr(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:Ym,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!xr(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...il("command-validation",o),...h};let S=vt("command-analysis",o,()=>Pm(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Kw(i),i.store),e.command,t.trace));if(S.decision){let E=!g.strict&&S.decision.kind==="deny"&&(S.decision.ruleId==="raw-text.dangerous-command"||S.decision.reason===ar&&!/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/.test(S.decision.evidence?.segment??"")&&Ae(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in S?{errorCode:S.errorCode}:{},decision:E?{...S.decision,ask:!0}:S.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function jw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Vw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Kw(e){return ge(e,"declared-command")?.program}function qw(e){try{return Tn(e.input)}catch(t){let n=xr(e)?e.command:void 0;throw new Kt("policy-protection",il("policy-protection",t instanceof Ye?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Kt(e,il(e,r instanceof Ye?void 0:t,r),r)}}function il(e,t,n){let r=n instanceof N||n instanceof Ge;return{stage:e,decision:{kind:"deny",reason:r?Ci:_n,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function xr(e){return e.route.kind==="command"}import{appendFileSync as aA,mkdirSync as lA}from"node:fs";import{isAbsolute as cA,join as ll}from"node:path";import{lstatSync as cp,readdirSync as Yw,readFileSync as Zw,rmdirSync as Xw,statSync as up,unlinkSync as Jw,utimesSync as Qw,writeFileSync as eA}from"node:fs";import{join as Rr}from"node:path";function lp(e,t={}){return Xr(Qt(e,t),e.home).policy.audit.retention_days}var al=86400000,tA=".last-prune",nA=/^\d{4}-\d{2}$/,rA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,dp=(e)=>Math.floor(e/al);function mp(e,t,n=()=>new Date){try{let r=n().getTime();if(!up(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Rr(t,tA),i=up(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&dp(i)===dp(r))return;let s=r-lp(e)*al,a=new Date(r).toISOString().slice(0,7);for(let l of sl(t)){if(l.isDirectory()){oA(Rr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))iA(Rr(t,l.name),s)}eA(o,"",{mode:384}),Qw(o,r/1000,r/1000)}catch{}}function oA(e,t,n){for(let r of sl(e)){if(!r.isDirectory()||!nA.test(r.name))continue;let o=Rr(e,r.name);for(let i of sl(o)){if(!i.isFile())continue;let s=rA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+al;if(!Number.isFinite(a)||a>=t)continue;pp(Rr(o,i.name))}if(r.name!==n)fp(o)}fp(e)}function iA(e,t){try{let n=cp(e);if(n.mtimeMs>=t)return;let r=Zw(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(sA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(cp(e).mtimeMs!==n.mtimeMs)return;pp(e)}catch{}}function sA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function sl(e){try{return Yw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function pp(e){try{Jw(e)}catch{}}function fp(e){try{Xw(e)}catch{}}var uA="2.4.6",dA=1e4,fA=2000,mA=256,pA=32768;function gA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function hA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function cl(e,t,n,r,o,i,s={}){let a=gA(t);if(!a)return;let l=CA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=mi(at(n),s.failureStage?Number.POSITIVE_INFINITY:dA),f=mi(at(r),fA),d=s.toolName?mi(at(s.toolName),mA):void 0,m=i===null?void 0:mi(at(i),pA),p=ll(l,hA(m?.value??null),c.slice(0,7));lA(p,{recursive:!0,mode:448});let g=ll(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Di)(),v:uA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};aA(g,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),mp(e,l,s.now)}catch{}}function mi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function yA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&cA(n)?n:null}function CA(e){let t=yA(e);return t?ll(t,".cc-safety-net","logs"):null}function hp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=gp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?gp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function gp(e){return"command"in e?e.command??"":""}function yp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;cl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Cp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;cl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Sp(e,t,n){try{let r=ap(t,{environment:e,...n.guard});return bp(e,t,r,n),r}catch(r){if(!(r instanceof Kt))throw r;throw bp(e,t,r.evaluation,n,!(r.cause instanceof Ye),{stage:r.stage,errorCode:bA(r.cause)}),r}}function bp(e,t,n,r,o=!0,i){yp(e,hp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function bA(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Ye)return"tool-input-limit";if(e instanceof Ge)return"structural-shell-syntax-limit";return"unexpected-error"}function Et(e,t={}){return{malformed:!0,denial:wn(t),cwd:e}}function vp(e,t={}){return(n,r)=>{try{return SA(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(wn())}}}function SA(e,t,n,r){let o=Vl();if(n.cancelled?.(t))return n.block(wn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Cp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=gl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=Sp(o,i,{guard:{auditAllowed:Kl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Kt))throw l;if(Rt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${yl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var Ep="exec",vA=new Set(["auto","gateway"]);function xp(e){e.on("before_tool_call",EA(e),{matcher:[Ep],priority:50})}function EA(e,t={}){return vp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>xA(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>wA(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function xA(e,t,n,r){if(!e||typeof e!=="object")return Et(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Et(null);if(o!==Ep)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Et(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Et(null,{toolName:o});if(s.host!==void 0&&!vA.has(s.host))return Et(null,{command:a,toolName:o});let l=RA(n,t.agentId,r);if(!l)return Et(null,{command:a,toolName:o});let c=_A(l,s,r);if(!c)return Et(l,{command:a,segment:typeof s.workdir==="string"?s.workdir:void 0,toolName:o});return In(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function RA(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return wi(".",[r],n)}catch{return}}function _A(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return wi(r,[e],n)}function wA(e){return{block:!0,blockReason:hl(e)}}var WL={...pl,register:xp};export{WL as default};