cc-safety-net 2.4.5 → 2.4.7

package/dist/amp/cc-safety-net/index.ts

@@ -1,49 +1,49 @@
 // cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp
-// version: 2.4.5
+// version: 2.4.7
 // @bun
-var bi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",$e="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",wn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var yi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},_n={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...yi},processedCandidateBytes:{cap:4194304,...yi},pathEnvironmentExpansion:{cap:64,...yi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,..._n},trackedHeredocFiles:{cap:64,..._n},controlFlowStates:{cap:64,..._n},wrapperPeelIterations:{cap:20,..._n},derivedCommandShape:_n});class D extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function ye(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new D(t)}}}var hp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function at(e){return yp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function yp(e){return hp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var bp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Cp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,bp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+var Ci="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",He="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",wn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var bi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},_n={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...bi},processedCandidateBytes:{cap:4194304,...bi},pathEnvironmentExpansion:{cap:64,...bi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,..._n},trackedHeredocFiles:{cap:64,..._n},controlFlowStates:{cap:64,..._n},wrapperPeelIterations:{cap:20,..._n},derivedCommandShape:_n});class D extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function be(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new D(t)}}}var Tp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function lt(e){return Ip(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Ip(e){return Tp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var kp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Op(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":kp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function cl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function An(e={}){return{reason:wn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function ul(e){return Cp({...e,redact:at})}function dl(e){return at(e instanceof Error?e.message:String(e))}import{types as Sp}from"util";var vp=new Set(["applypatch","patch"]),Ep=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Rp=new Set(["grep","grepsearch","rg"]),xp=new Set(["find","findbyname","glob"]),_p=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),wp=new Set(["command","diff","input","patch","patchtext"]),ml=new TextEncoder,Ap=new TextDecoder,Pp=/\s/,Tp=64;class Ve extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Pn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function yl(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function wr(e){return _p.has(yl(e))}function Ei(e){let t=yl(e);if(vp.has(t))return"patch";if(Rp.has(t))return"grep";if(xp.has(t))return"glob";if(Ep.has(t))return"path";return"unknown"}function In(e){if(!e||typeof e!=="object")return;xl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ue();return}if(t.get||t.set)Ue();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function bl(e,t){return Cl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Cl(e,t,n,r){let o=Rl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Cl(a,t,n,r+1);return typeof a==="string"&&t.has(Sl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Sl(e){return e.replace(/-/g,"_").toLowerCase()}function vl(e){return El(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(kp)}function El(e,t,n,r){let o=Rl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>El(a,o.array?t:wp.has(Sl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Ip(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Pn.maxDepth||t.nodes>Pn.maxNodes)Ue();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Pn.maxStringBytes||t.stringBytes>Pn.maxAggregateStringBytes)Ue()}function Rl(e,t,n){if(Ip(e,t,n),!e||typeof e!=="object")return null;let r=xl(e);if(t.ancestors.has(e))Ue();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Pn.maxKeys)Ue();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ue();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function xl(e){if(Sp.isProxy(e))Ue();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ue();return t}function Ue(){throw new Ve}function kp(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Op(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ci(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ci(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...vi(_r(c.slice(4),!0),_r(u.slice(4),!0))),l++;continue}if(!r)t.push(...Ci(c))}return t}function Op(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ci(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return hl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return hl(n[1]);if(e.startsWith("diff --git "))return Mp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return gl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return gl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return zp(i[1]);return[]}function Mp(e){let t=Dp(e);if(t.length===2&&t[0]&&t[1])return vi(t[0],t[1]);let n=Np(e);return n?vi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Dp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Et(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Et(e[n]))n++;t.push(e.slice(i,n));continue}let o=_l(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Et(e[n]))n++;return n===e.length?t:[]}function Np(e){let t=0;while(t<e.length&&Et(e[t]))t++;let n=e.length;while(n>t&&Et(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Et(e[o])){o++;continue}let i=o;while(o<n&&Et(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Tp)Ue();if(Lp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Lp(e,t,n,r,o){if(Si(e,t,n,r,o))return!0;let i=fl(e,"/",t,n),s=fl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Si(e,t,i,r,s))return!1;return Si(e,i+1,n,s+1,o)}function Si(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function fl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Et(e){return e!==void 0&&Pp.test(e)}function _l(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Ap.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...ml.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...ml.encode(Wp(s[0]??""))),o+=2}return null}function Wp(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function Fp(e){return Tn(Bp(e))}function vi(e,t){if(e==="/dev/null")return pl(t);if(t==="/dev/null")return pl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Tn);let n=Gp(e,t)??(e===t?wl(e):null);return[e,t,...n?[n]:[]].flatMap(Tn)}function pl(e){let t=wl(e);return[e,...t?[t]:[]].flatMap(Tn)}function wl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Gp(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function gl(e){return Fp(_r(e,!0))}function zp(e){return Tn(_r(e,!1))}function _r(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=_l(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Bp(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Tn(e){return e===""||e==="/dev/null"?[]:[e]}function hl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Pi,relative as Zp,resolve as Ml,sep as Xp}from"path";import{basename as Tl,dirname as $p,isAbsolute as Up,join as Hp,normalize as jp,resolve as Al}from"path";var Vp=256,Ar=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function be(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Ke(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function wi(e,t){return Ri(e,0,t)}function Ri(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=xi(e,o+2),a=Kp(e,o,t);if(a===null){if(Ar.has(s))throw new D("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=qp(l,t,n),o=a+1;continue}let i=xi(e,o+1);if(!i){r+="$",o++;continue}r+=_i(i,n)??`$${i}`,o+=i.length+1}return r}function Kp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new D("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function qp(e,t,n){let r=e.slice(2,-1),o=xi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return _i(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Ar.has(o))throw new D("pathEnvironmentExpansion");return e}if(!Ar.has(o))return e;if(s.endsWith("="))throw new D("pathEnvironmentExpansion");let a=_i(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new D("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Ri(i.slice(s.length),t+1,n);return l?Ri(i.slice(s.length),t+1,n):""}function xi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function _i(e,t){if(!Ar.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function G(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Il(n,i);let s=t.realpath(i);if(s!==null)return Pl(n,e,s,o);let a=$p(i);if(a===i||o.length>=Vp)return Pl(n,e,i,o);o.push(Tl(i)),i=a}}function Pl(e,t,n,r){let o=r.length===0?n:Hp(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Yp(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Il(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Il(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=Ol(e,t,n);if(!o)return"";return G(o,n.paths,r).replace(/\\/g,"/")}function kl(e,t,n,r,o){let i=Ol(e,t,n);if(!i)return null;if(o(Tl(i)))return G(i,n.paths,r).replace(/\\/g,"/");let s=Yp(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Ol(e,t,n){let r=n.home,o=wi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Al(r,o.slice(2)):o,s=be(i);return jp(Up(s)?s:Al(t,s))}function Dl(e,t,n){if(Ke(e))return;let r=t.flatMap((i)=>Ai(i,n));if(!r[0])return;let o=Ai(Pi(e)?e:Ml(r[0],e),n)[0];if(!o)return;return r.some((i)=>Jp(o,i))?o:void 0}function Nl(e,t,n){if(Ke(e))return;return Ai(Pi(e)?e:Ml(t,e),n)[0]}function Ai(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Jp(e,t){let n=Zp(t,e);return n===""||n!==".."&&!n.startsWith(`..${Xp}`)&&!Pi(n)}function Yt(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as wg,realpathSync as Ag,statSync as Pg}from"fs";import{homedir as Tg,tmpdir as Ig}from"os";import{statSync as Rg}from"fs";import{join as xg}from"path";import{spawnSync as Qp}from"child_process";import{existsSync as On,lstatSync as eg,readFileSync as Mn,realpathSync as Zt,statSync as kn}from"fs";import{dirname as Ti,isAbsolute as Ii,join as Xt,resolve as Pr}from"path";var tg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],ng=5000;function Wl(e,t=Cg(),n=ng){let r=rg(e),o=r===null?null:og(r);if(r===null||o===null)return null;let i=yg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function rg(e){try{let t=Zt(Pr(e));return kn(t).isDirectory()?t:null}catch{return null}}function og(e){let t=hg(e);if(!t)return null;try{let n=eg(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=ki(t);if(!r?.commonDir)return null;if(!ag(r.gitDir,t))return null;return lg(r.gitDir,Ti(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function ki(e){try{let t=ig(e);if(!t)return null;let n=Zt(Ii(t)?t:Pr(Ti(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:sg(n)}}catch{return null}}function ig(e){let t=Mn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function sg(e){try{let t=Mn(Xt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Zt(Ii(t)?t:Pr(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function ag(e,t){let n=cg(e);return n===null?!1:Fl(e,n,t)}function lg(e,t){let n=ug(e);return n===null?!0:Fl(e,n,t)}function cg(e){let t=Xt(e,"gitdir");if(!On(t))return null;let n=Mn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function ug(e){let t=Xt(e,"config.worktree");return On(t)?mg(t):null}function Fl(e,t,n){try{return dg(Ii(t)?t:Pr(e,t),n)}catch{return!1}}function dg(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Ll(Zt.native(e))===Ll(Zt.native(t))}function Ll(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function mg(e){let t=Mn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=fg(s[1]??"")}return r}function fg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return gg(t.slice(1,-1))}var pg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function gg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:pg[n]??t)}function hg(e){try{return Oi(Zt(e))}catch{return null}}function Oi(e){let t=e;while(!0){let n=Xt(t,".git");if(On(n))return n;let r=Ti(t);if(r===t)return null;t=r}}function yg(e,t,n,r){if(bg(t))return!0;if(n===null)return!0;let o=Qp(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Sg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Gl(o.stdout.trim())}function bg(e){return[Xt(e.commonDir,"config"),Xt(e.gitDir,"config.worktree")].filter((t)=>On(t)).some((t)=>vg(t))}function Cg(){return tg.find((e)=>On(e))??null}function Dn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Sg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Dn(t)))}function vg(e){let t;try{t=Mn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Eg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Gl(c)}return r}function Eg(e){return e==="include"||e.startsWith("includeif ")}function Gl(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function zl(e,t){if(e==="")return null;let n=ye(),r=Oi(se(e,e,t,n)),o=r?_g(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function _g(e,t,n,r){try{let o=se(e,t,n,r),i=Rg(e),s=i.isFile()?o:null,a=i.isFile()?ki(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Jt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Jt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Jt(o),markerFile:s?Jt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=Jt(xg(u,"hooks").replace(/\\/g,"/"));return[m,Jt(se(m,t,n,r))]}))]}}catch{return null}}function Jt(e){return process.platform==="win32"?e.toLowerCase():e}var kg={realpath:(e)=>{try{return Ag(e)}catch{return null}},entryKind:(e)=>{let t=wg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Pg(e).isDirectory()}catch{return!1}}};function $l(){return Og({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:be(process.env.HOME||Tg()),tmpdir:Ig(),paths:kg})}function Og(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Bl(n,i,()=>zl(i,o)),worktreeFacts:(i)=>Bl(r,i,()=>Wl(i)),...t};return o}function Bl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Qt=["fail_closed","paranoid_rm","paranoid_interpreters"],Tr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Ir=["standard","strict","paranoid"];function Mg(e,t){if(!t)return e;return Ir.indexOf(t)>Ir.indexOf(e)?t:e}function Dg(e){let t=Li(Q.level,e);if(t===void 0||t==="")return;if(Ir.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Ir.join(", ")}.`);return}function Ng(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Ul(e){return Ng(Li(Q.auditScope,e))==="all"}function Di(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Ni(e={},t){let n=e.safety?.level??"standard",r=Dg(t),o=Mg(n,r),i=Tr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Rt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(Rt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(Rt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(Rt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Rt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Di(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Rt(e,t){let n=typeof e==="string"?Mi(e,t):Li(e,t);return n==="1"||n?.toLowerCase()==="true"}function Mi(e,t){return t.get(e)}function Li(e,t){let n=Mi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Mi(e.legacyName,t);return}import{dirname as Gr}from"path";import{closeSync as Lg,constants as Hl,fstatSync as Wg,fsyncSync as oP,lstatSync as Gi,mkdirSync as iP,openSync as Fg,readdirSync as sP,readFileSync as Gg,realpathSync as zi,renameSync as aP,rmdirSync as lP,statSync as zg,unlinkSync as cP,writeFileSync as uP}from"fs";import{isAbsolute as jl,join as Bi,normalize as Bg,parse as Fi,relative as $i,resolve as Ui,sep as Hi}from"path";function Wi(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var $g=Symbol("PolicyFilesystemScope"),Ug=Symbol("PolicyFilesystemTarget"),Hg=Hl.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function xt(e,t){return{[$g]:!0,root:Ui(e),label:t}}function Vl(e,t){let n=Bg(t);if(t===""||jl(t)||n===".."||n.startsWith(`..${Hi}`))throw new ae(e.label);return{[Ug]:!0,scope:e,relativePath:n,path:Bi(e.root,n)}}function Nn(e,t){return Vl(e,$i(e.root,Ui(t)))}function Kl(e,t="rules policy"){let n=Ui(e),r=Fi(n).dir;return Vl(xt(r,t),$i(r,n))}function Or(e){return Yl(e.scope.label,()=>{if(!kr(e))return null;let t=Fg(e.path,Hl.O_RDONLY|Hg);return jg(t,()=>{let n=Wg(t);if(!n.isFile())throw new ae(e.scope.label);let r=Gg(t,"utf-8"),o=Gi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return kr(e),r})})}function ql(e,t){if(e.path===t.path)return!0;return Yl(e.scope.label,()=>{if(!kr(e)||!kr(t))return!1;let n=(r)=>Bi(zi(Fi(r).dir),Fi(r).base);return n(e.path)===n(t.path)})}function Yl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function jg(e,t){try{return t()}finally{Lg(e)}}function kr(e,t="file"){let n=Vg(e.scope);if(!n)return!1;let r=e.relativePath.split(Hi);for(let o of r.keys()){let i=Bi(e.scope.root,...r.slice(0,o+1)),s=Gi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);Kg(n,zi(i),e.scope.label)}return!0}function Vg(e){if(!Gi(e.root,{throwIfNoEntry:!1}))return null;if(!zg(e.root).isDirectory())throw new ae(e.label);return zi(e.root)}function Kg(e,t,n){let r=$i(e,t);if(r===".."||r.startsWith(`..${Hi}`)||jl(r))throw new ae(n)}import{dirname as wt,isAbsolute as Jg,join as Pt,relative as Qg,resolve as At,sep as eh}from"path";var _t=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Zl="rulebook.json",Xl=".cc-safety-net/rules";var Jl=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var qg=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Yg=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Zg="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),pP=new RegExp(`^${Yg}/(${_t.source.slice(1,-1)})/${Zg}$`);function Xg(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Ql(e){if(Mr(e))try{return ji(e),null}catch(t){return t instanceof Error?t.message:String(t)}return _t.test(e)?null:`Local rulebook sources must be bare names matching ${_t}: ${e}`}function ji(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Jl);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!qg.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!_t.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Xg(o),name:o}}function Mr(e){return Jl.test(e)}var ec="rule.json",Dr="policy.json",tc=".cc-safety-net",th="rules",nh="CC_SAFETY_NET_HOME",nc="`cc-safety-net rule update`";function rh(e){return At(e,Xl)}function oh(e){return Pt(rh(e),ec)}function Ln(e){return Pt(At(e),tc,Dr)}function Vi(e,t={}){return t.userConfigDir??(t.userConfigPath?wt(t.userConfigPath):Pt(ih(e),th))}function ih(e){let t=e.env.get(nh);return t?At(be(t)):Pt(e.home,tc)}function sh(e,t={}){return Pt(Vi(e,t),ec)}function en(e,t={}){return Pt(wt(Vi(e,t)),Dr)}function rc(e,t){let n=t.userConfigPath??sh(e,t),r=t.projectConfigPath??oh(t.cwd),o=ah(e,t),i=lh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Nn(o,n),projectConfigTarget:Nn(i,r)}}function ah(e,t){let n=t.userConfigPath?wt(wt(At(t.userConfigPath))):wt(At(t.userConfigDir??Vi(e,t)));return xt(n,"user policy")}function lh(e,t){let n=At(t),r=At(e),o=Qg(n,r);if(o!==".."&&!o.startsWith(`..${eh}`)&&!Jg(o))return xt(n,"project policy");return xt(wt(wt(r)),"project policy")}function oc(e,t){return Pt(e,t,Zl)}var Ce=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),lt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ct=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),ic=new Set(["python","python3","python2","node","ruby","perl"]),Nr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Lr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var sc="Rulebook exceeds CC Safety Net's safe validation limits.",ac="Additional rulebook validation errors were omitted.",ke=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function lc(e){if(Ki(e.allowed_commands,ke.maxAllowedCommands)||Ki(e.rules,ke.maxRules)||Ki(e.tests,ke.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=ke,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>ke.maxStringCodeUnits||i&&o.length>ke.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>ke.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ki(e,t){return Array.isArray(e)&&e.length>t}var qi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Yi=64,Zi="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var ch={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Xi=new Set(["--init-file","--rcfile"]);function Ji(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!ch[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Se(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Xi.has(l)&&!s.includes("="))i++;continue}let a=Ji(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Wn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Wr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of uh(e))Wn(n,t);return t.inSingle||t.inDouble}function uh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Wn(s,n)}return t}var Qi=new Set(["rm","find","xargs","parallel"]),dh=new Set(["git","busybox",...Qi,...J,...ic,...we]),mh=new Set(["python","node","ruby","perl"]);function cc(e){let t=M(e);return dh.has(t)||Oe(t)}function Oe(e){return mh.has(fh(e))}function fh(e){let t=k(e).toLowerCase();return Nr.test(t)?"python":t}function es(e){try{let t=Or(ph(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=yh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function ph(e){return typeof e==="string"?Kl(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function uc(e){let t=new Set;return e.flatMap((n,r)=>{let o=tn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ts=`must be one of ${qi.join(", ")}`,gh=/^[^/]+\/[^/]+$/,hh=["version","rules","overrides","transparent_wrappers"];function yh(e){let t=bh(e);return{errors:ns(Ah(t,hh,(n)=>n.kind==="custom"),": "," "),sources:wh(e,t)}}function bh(e){if(!tn(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Yi;return[...e.version===1?[]:[_(["version"],"must be 1")],...Ch(e.rules,t),...Eh(e.overrides),...xh(e.transparent_wrappers),...t?[]:vh(e.rules),...tn(e.overrides)?Object.keys(e.overrides).filter((n)=>!gh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],..._h(e.transparent_wrappers)]}function Ch(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...dc(e,Yi)?[_(["rules"],Zi)]:[]];if(t)return[{path:["rules"],message:Zi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...Sh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function dc(e,t){let n=mc(e);return n!==void 0&&!(n<=t)}function Sh(e,t){let n=mc(e);return n!==void 0&&!(n>=t)}function mc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function vh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=Ql(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Eh(e){if(e===void 0)return[];if(!tn(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!tn(n))return[_(["overrides",t],'must be "off" or an object')];return[...Rh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||os(n.intent)?[]:[_(["overrides",t,"intent"],ts)]]})}function Rh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...dc(e,ct)?[_(t,`must be at most ${ct} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ct?[_(t,`must be at most ${ct} characters`)]:[]}function xh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return lt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function _h(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(cc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function wh(e,t){let n=tn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Ah(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function ns(e,t,n){return[...new Set(e.map((r)=>{let o=rs(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function rs(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function os(e){return qi.includes(e)}function tn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function pc(e){let t=Ih(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Ph=`required non-empty string up to ${ct} characters`,fc="must be a non-empty array of unique non-empty strings",Th="required non-empty array of non-empty strings";function Ih(e){if(!ut(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!lc(e))return{errors:[sc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ns(kh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>ke.maxValidationErrors?[...t.slice(0,ke.maxValidationErrors),ac]:t,ruleNames:new Set(gc(e).map((n)=>n.toLowerCase()))}}function gc(e){let t=ut(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ut(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function kh(e,t){return[...typeof e.name==="string"&&_t.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Oh(e.allowed_commands),...Mh(e.rules,t),...Wh(e.tests),...Fh(e),...Gh(e)]}function Oh(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&lt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Mh(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!ut(n))return[_(["rules",r],"must be an object")];return t?Nh(n,["rules",r]):Dh(n,["rules",r])}),...uc(e)]}function Dh(e,t){return[...hc(e.name,t),...yc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&lt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Fr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...bc(e.reason,t),...Cc(e.intent,t)]}function Nh(e,t){return[...hc(e.name,t),...yc(e.command,t),...bc(e.reason,t),...Cc(e.intent,t),...Lh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function hc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return _t.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function yc(e,t){return typeof e==="string"&&lt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function bc(e,t){return typeof e==="string"&&e!==""&&e.length<=ct?[]:[_([...t,"reason"],Ph)]}function Cc(e,t){return e===void 0||os(e)?[]:[_([...t,"intent"],ts)]}function Lh(e,t){if(!ut(e))return[_(t,"required object")];return[...Fr(e.command_path,[...t,"command_path"],Th,!1),...e.any_args===void 0?[]:Fr(e.any_args,[...t,"any_args"],fc,!0),...e.exclude_args===void 0?[]:Fr(e.exclude_args,[...t,"exclude_args"],fc,!0)]}function Fr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Wh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!ut(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Fh(e){if(!Array.isArray(e.tests))return[];let t=new Set(gc(e));return[...new Set(e.tests.flatMap((n)=>ut(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function Gh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=ut(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function ut(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function _c(e,t){let n=rc(e,t),r=!1;try{r=ql(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ae)return qh(n,f.message);throw f}let o=es(n.userConfigTarget),i=r?{config:null,errors:[]}:es(n.projectConfigTarget),s=Rc(n.userConfigPath,o.errors),a=Rc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Sc(o.config,Gr(n.userConfigPath),"user",n.userScope,l):xc(),u=i.config?Sc(i.config,Gr(n.projectConfigPath),"project",n.projectScope,l):xc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...vc(c.rules,m),...vc(u.rules,d)],transparent_wrappers:Vh(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?Ec(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Kh(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?Ec(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Sc(e,t,n,r=xt(Gr(Gr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Bh(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:zh(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function zh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Bh(e,t,n){let r=$h(e),o=oc(t,r),i=Hh(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Uh(e)}`]};let s=jh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function $h(e){return Mr(e)?ji(e).name:e}function Uh(e){return Mr(e)?`run ${nc} to vendor ${e}`:"create that file or remove that source from the rules config"}function Hh(e,t){try{return{content:Or(Nn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function jh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:pc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function Vh(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function vc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Ec(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Kh(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Rc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function qh(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function xc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as ay,readFileSync as ly}from"fs";var wc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],is=new Set(wc.map((e)=>e.id)),zr=wc,Yh=new Map(zr.map((e)=>[e.id,e.intent]));function C(e,t){return{id:e,reason:t,intent:Yh.get(e)??"manual_only"}}var ss=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Br={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Zh=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Xh=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],as=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Xh.flatMap((e)=>Zh.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var $r=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Ac=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Jh=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ls=Ac.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),cs=Ac.flatMap((e)=>Jh.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Fn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},us=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),ds=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Qh=[...ss,Br,...as,...ls,...cs,Fn,...us,...ds,...$r].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Ur=new Set($r.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),ms=new Set(Qh.map((e)=>e.id));import{isAbsolute as fs,join as ey,normalize as ty,sep as Hr}from"path";var Pc=process.platform==="win32",ny=/[*?]/;function Gn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ps(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Gn(e.trim(),t);if(!fs(n))return"must be an absolute path or start with ~/";return zn(n,t)}function gs(e,t){let n=Tc(e,t);if(n===null)return"must be a non-empty path string";if(!fs(n))return null;if(zn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var ry="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",oy="cannot cover the guard's own configuration";function Tc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Gn(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function hs(e,t){let n=Tc(e,t);if(n===null)return"must be a non-empty path string";if(ny.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!fs(n))return null;if(zn(n,t)!==null)return ry;return iy(n,t)?oy:null}function iy(e,t){let n=jr(e),r=jr(ey(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Hr}`)}function zn(e,t){let n=jr(e),r=jr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Hr)?n:`${n}${Hr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function jr(e){let t=ty(e);if(Pc)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Pc?3:1)&&t.endsWith(Hr))t=t.slice(0,-1);return t}var Ic=30,Vr=1,Kr=365;function kc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Oc=new Set(zr.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(Oc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Oc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Mc(e,t){return Object.freeze(Object.fromEntries(zr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Dc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Mc(e,t)})}var Nc={standard:0,strict:1,paranoid:2};function Fc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:ys(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:ys(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:ys(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:sy(e,t)}}function ys(e,t){return[...new Set([...e,...t??[]])]}function sy(e,t){let n=t.safety?.level,r=Tr[e.safety.level];return[...n&&Nc[n]<Nc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Qt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Lc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Lc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Ur.has(o))),...e.destructive_command_protection.enabled?Wc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Wc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Lc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Wc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Ss=new Set(["standard","strict","paranoid"]),$c={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Ic}};function Uc(e,t){let n=by(en(e,t),e.home),r=Zr(Ln(t.cwd),e.home),o=uy(r.parsed,e.home),i=Object.keys(o.policy).length>0?Fc(n.gui??$c,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?Cs(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var cy="project policy audit settings are ignored; audit is user scope only";function uy(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...Ss.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Gc({overrides:Hc(n.overrides,Qt,["safety","overrides"],Tt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Yr(o.overrides,is,Vc,Tt)}:{},...o.allow_paths!==void 0?{allow_paths:rn(o.allow_paths,ps,t,["destructive_command_protection","allow_paths"],Tt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Yr(i.overrides,ms,Kc,Tt)}:{},...i.deny_paths!==void 0?{deny_paths:rn(i.deny_paths,gs,t,["secret_protection","deny_paths"],Tt)}:{},...i.allow_paths!==void 0?{allow_paths:rn(i.allow_paths,hs,t,["secret_protection","allow_paths"],Tt)}:{}};return{policy:Gc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[cy]}}function Hc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],vs));return[]}))}function Gc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Tt=()=>{return},vs="must be a boolean",Es="must be an object if provided",jc=`must be an integer between ${Vr} and ${Kr}`,Vc={path:["destructive_command_protection","overrides"],label:"destructive command"},Kc={path:["secret_protection","overrides"],label:"secret protection"},dy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function my(e,t){let n=[];return{policy:qc(e,t,(o)=>{n.push(o)}),issues:n}}function fy(e,t){return qc(e,t,Tt)}function qc(e,t,n){if(!ve(e))return n(_([],"Config must be an object")),qr();if(e.version!==1)n(_(["version"],"must be 1"));let r=nn(e.safety,["safety"],["level","overrides"],n),o=nn(r.overrides,["safety","overrides"],Qt,n),i=nn(e.workflow,["workflow"],["worktree_mode"],n),s=nn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=nn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=nn(e.audit,["audit"],["retention_days"],n);return Yc(e,dy,[],n),{version:1,safety:{level:py(r.level,n),overrides:Hc(o,Qt,["safety","overrides"],n)},workflow:{worktree_mode:bs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:bs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Yr(s.overrides,is,Vc,n),allow_paths:rn(s.allow_paths,ps,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:bs(a.enabled,["secret_protection","enabled"],!0,n),overrides:Yr(a.overrides,ms,Kc,n),deny_paths:rn(a.deny_paths,gs,t,["secret_protection","deny_paths"],n),allow_paths:rn(a.allow_paths,hs,t,["secret_protection","allow_paths"],n)},audit:{retention_days:gy(l.retention_days,n)}}}function nn(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(t,Es)),{};return Yc(e,n,t,r),e}function Yc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function py(e,t){if(e===void 0)return"standard";if(Ss.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function bs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,vs));return n}function gy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Vr&&e<=Kr))t(_(["audit","retention_days"],jc));return kc(e)}function Yr(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(n.path,Es)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function rn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function qr(){return structuredClone($c)}function Zr(e,t){if(!ay(e))return{exists:!1,policy:qr(),errors:[]};try{let n=ly(e,"utf-8");if(!n.trim())return{exists:!0,policy:qr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=my(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${yy(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:qr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var hy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Es,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[vs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[jc,`not an integer between ${Vr} and ${Kr}`]]);function yy(e){let t=rs(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=hy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function by(e,t){let n=Zr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:Bc(),errors:[]};let o=fy(r,t);return{policy:Cs(o),gui:o,errors:[],levelPresent:zc(r)}}if(n.parsed===void 0)return{policy:Bc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:Cs(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:zc(n.parsed)}}function zc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return Ss.has(t.level)}function Zc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Ur].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Bc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Zc({}),denyPaths:[],allowPaths:[]}}}function Cs(e){return{safety:Cy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Zc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function Cy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function Xc(e,t){let n=_c(e,t),r=Uc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Ry(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return xy(o,Sy(n,r),s,r.policyScopes)}function Sy(e,t){let n=Ey(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:_y(e.errors.length>0?vy(e.errors):void 0,e.warnings.length>0?xs(e.warnings.join("; ")):void 0,n)}}function vy(e){return`${xs(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Ey(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Ry(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function xy(e,t,n=Object.freeze({}),r){let o=Rs(structuredClone(e)),i=r?{policyScopes:Rs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Rs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Rs(t);return Object.freeze(e)}function _y(...e){return xs(e.filter((t)=>!!t).join("; "))}function xs(e){return/[.!?]$/.test(e)?e:`${e}.`}function Jc(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:_s(t.fail_closed,e.strict,"strict"),paranoid_rm:_s(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:_s(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Dc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Di({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function _s(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Bn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var wy=/^[A-Za-z_][A-Za-z0-9_]*=/;function Xr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function $n(e){let t=Xr(e.words[0],"time")?1:0,n=t===1&&Xr(e.words[t],"-p")?t+1:t,r=t===1&&Xr(e.words[n],"--")?n+1:n,o=Xr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!wy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var dt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Jr(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Ay(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>me(t)))})}function Qr(e,t,n){e.push(n),t.reset()}function eo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function ws(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function on(e,t,n,r,o,i,s){return ws({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function me(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Ay(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:me(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function As(e,t,n){if(t>=n||eu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!eu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Qc(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Qc(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ps(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Py(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?Ty(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Qc(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function eu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Py(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function Ty(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var ou=new Set(["&&","||","|","|&"]);function iu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=ro(e,0,e.length,t,{used:0,max:t.maxWords},0);return me({kind:"program",dialect:"posix",source:e,span:n,status:so(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function ro(e,t,n,r,o,i,s){let a=[],l=[],c=Jr(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((h)=>h.text);Qr(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),ru(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(io(f)){if(f===`
-`||f==="\r"){m();let S=f==="\r"&&e[d+1]===`
-`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!ou.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,S),span:Object.freeze({start:d,end:S})}));if(u.length>0){let R=Ps(e,S,n,u.splice(0));l.push(...R.issues),d=R.next;continue}d=S;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
-`&&e[d]!=="\r")d++;continue}let p=c.start===-1?Zy(e,d,n):void 0;if(p){if(Is(a,l),i>=r.maxDepth)return sn(a,l,d,"depth-limit",r.maxDepth);if(!Ts(o))return sn(a,l,d,"word-limit",r.maxWords);let S=ro(e,p.braceIndex+1,n,r,o,i+1,"}"),T=S.next,R={start:p.braceIndex+1,end:S.closed?T-1:T},A=tu(e,R,S);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:A}),l.push(...S.issues),S.pendingHeredocs.length>0||Hn(S.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...S.pendingHeredocs),S.limited)return no(a,l,S.next);if(!S.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let h=oo(e,d);if(h){if(m(),!fu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:d,end:d+h.length})})),d+=h.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&Wy(e,d,n))&&c.start===-1){if(Is(a,l),i>=r.maxDepth)return sn(a,l,d,"depth-limit",r.maxDepth);let S=f==="("?")":"}",T=ro(e,d+1,n,r,o,i+1,S),R=T.next,A={start:d+1,end:T.closed?R-1:R},q=tu(e,A,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:R},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Hn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return no(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=R;continue}let g=(f==="<"||f===">")&&e[d+1]!=="("?My(e,d):null;if(g){let S=c.words.at(-1),T=S&&S.span.end===d&&/^[0-9]+$/.test(S.raw)?Number(S.raw):void 0;if(T!==void 0)c.words.pop();let R=T===void 0?d:S?.span.start??d;c.start=c.start===-1?d:c.start;let A=d+g.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let q=e[A],Z=A>d+g.length&&q==="#",ee=!q||io(q)||!!oo(e,A)||q===s||q===")"||Z||(q==="<"||q===">")&&e[A+1]!=="(",X=g==="<<"||g==="<<-",U=X?As(e,A,n):void 0,N=U?{word:on(e,A,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?ks(e,A,n,r,o,i):void 0;if(N){if(l.push(...N.issues),N.limited)return no(a,l,N.next);if(!Ts(o))return sn(a,l,N.next,"word-limit",r.maxWords)}let ce=N?.next??d+g.length,_e={kind:"redirection",operator:g,span:{start:R,end:ce},...T===void 0?{}:{fd:T},...N?{target:N.word}:{}};if(c.redirections.push(_e),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let je=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:g==="<<-",attach:(Ie)=>{if(_e.heredoc=Ie,Ie.quotedDelimiter)return;je.push(...ky(e,Ie.bodySpan.start,Ie.bodySpan.end,r,o,i+1))}})}if(!X&&!N)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`});if(N)c.nested.push(...N.nested);c.end=ce,d=ce;continue}if(c.start===-1)Is(a,l);let y=ks(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return no(a,l,y.next);let v=zy(c.words)?jy(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return sn(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let S of E){if(!Ts(o))return sn(a,l,y.next,"word-limit",r.maxWords);c.words.push(S)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return m(),ru(a,l),l.push(...Xy(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function tu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:so(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function ks(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||io(f)||(f===";"||f==="|"||f==="&")&&oo(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(f==='"'){l=!0;let g=Iy(e,a,n,r,o,i);if(s+=g.text,u.push(...g.nested),m.push(...g.issues),d||=g.limited,c=Un(c,g.provenance),a=g.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Dy(e,a+2,n);if(s+=g.text,m.push(...g.issues),!g.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=g.next;continue}if(f==="\\"){let g=e[a+1];if(!g){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(g===`
-`){a+=2;continue}s+=g,a+=2;continue}let h=f==="$"||f==="<"||f===">"||f==="`"?ao(e,a,n,r,o,i):null;if(h){let g=su(h,u,m);if(d||=g.limited,c=Un(c,g.provenance),a=g.next,d)break;continue}if(f==="$"){let g=cu(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(f==="*"||f==="?"||f==="[")c=Un(c,"glob");s+=f,a++}return{word:on(e,t,a,s,c,l,c==="literal"?void 0:Ly(e,t,a)),nested:u,issues:m,next:a,limited:d}}function Iy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
+`)}function bl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.ask?{ask:!0}:{}}}function An(e={}){return{reason:wn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function Cl(e){return Op({...e,redact:lt})}function Sl(e){return lt(e instanceof Error?e.message:String(e))}import{types as Mp}from"util";var Dp=new Set(["applypatch","patch"]),Np=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Lp=new Set(["grep","grepsearch","rg"]),Wp=new Set(["find","findbyname","glob"]),Fp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Gp=new Set(["command","diff","input","patch","patchtext"]),vl=new TextEncoder,zp=new TextDecoder,Bp=/\s/,$p=64;class Ye extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Pn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function wl(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Ar(e){return Fp.has(wl(e))}function xi(e){let t=wl(e);if(Dp.has(t))return"patch";if(Lp.has(t))return"grep";if(Wp.has(t))return"glob";if(Np.has(t))return"path";return"unknown"}function In(e){if(!e||typeof e!=="object")return;Ml(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)je();return}if(t.get||t.set)je();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Al(e,t){return Pl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Pl(e,t,n,r){let o=Ol(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Pl(a,t,n,r+1);return typeof a==="string"&&t.has(Tl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Tl(e){return e.replace(/-/g,"_").toLowerCase()}function Il(e){return kl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Hp)}function kl(e,t,n,r){let o=Ol(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>kl(a,o.array?t:Gp.has(Tl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Up(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Pn.maxDepth||t.nodes>Pn.maxNodes)je();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Pn.maxStringBytes||t.stringBytes>Pn.maxAggregateStringBytes)je()}function Ol(e,t,n){if(Up(e,t,n),!e||typeof e!=="object")return null;let r=Ml(e);if(t.ancestors.has(e))je();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Pn.maxKeys)je();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)je();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Ml(e){if(Mp.isProxy(e))je();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)je();return t}function je(){throw new Ye}function Hp(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=jp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Si(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Si(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...Ei(wr(c.slice(4),!0),wr(u.slice(4),!0))),l++;continue}if(!r)t.push(...Si(c))}return t}function jp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Si(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return _l(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return _l(n[1]);if(e.startsWith("diff --git "))return Vp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Rl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Rl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Qp(i[1]);return[]}function Vp(e){let t=Kp(e);if(t.length===2&&t[0]&&t[1])return Ei(t[0],t[1]);let n=qp(e);return n?Ei(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Kp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Et(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Et(e[n]))n++;t.push(e.slice(i,n));continue}let o=Dl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Et(e[n]))n++;return n===e.length?t:[]}function qp(e){let t=0;while(t<e.length&&Et(e[t]))t++;let n=e.length;while(n>t&&Et(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Et(e[o])){o++;continue}let i=o;while(o<n&&Et(e[o]))o++;if(i===t||o===n)continue;if(r++,r>$p)je();if(Yp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Yp(e,t,n,r,o){if(vi(e,t,n,r,o))return!0;let i=El(e,"/",t,n),s=El(e,"/",r,o);if(i<=t||s<=r)return!1;if(vi(e,t,i,r,s))return!1;return vi(e,i+1,n,s+1,o)}function vi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function El(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Et(e){return e!==void 0&&Bp.test(e)}function Dl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:zp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...vl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...vl.encode(Zp(s[0]??""))),o+=2}return null}function Zp(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function Xp(e){return Tn(eg(e))}function Ei(e,t){if(e==="/dev/null")return xl(t);if(t==="/dev/null")return xl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Tn);let n=Jp(e,t)??(e===t?Nl(e):null);return[e,t,...n?[n]:[]].flatMap(Tn)}function xl(e){let t=Nl(e);return[e,...t?[t]:[]].flatMap(Tn)}function Nl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Jp(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Rl(e){return Xp(wr(e,!0))}function Qp(e){return Tn(wr(e,!1))}function wr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Dl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function eg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Tn(e){return e===""||e==="/dev/null"?[]:[e]}function _l(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Ti,relative as cg,resolve as $l,sep as ug}from"path";import{basename as Fl,dirname as tg,isAbsolute as ng,join as rg,normalize as og,resolve as Ll}from"path";var ig=256,Pr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Ze(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ai(e,t){return Ri(e,0,t)}function Ri(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=_i(e,o+2),a=sg(e,o,t);if(a===null){if(Pr.has(s))throw new D("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=ag(l,t,n),o=a+1;continue}let i=_i(e,o+1);if(!i){r+="$",o++;continue}r+=wi(i,n)??`$${i}`,o+=i.length+1}return r}function sg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new D("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function ag(e,t,n){let r=e.slice(2,-1),o=_i(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return wi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Pr.has(o))throw new D("pathEnvironmentExpansion");return e}if(!Pr.has(o))return e;if(s.endsWith("="))throw new D("pathEnvironmentExpansion");let a=wi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new D("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Ri(i.slice(s.length),t+1,n);return l?Ri(i.slice(s.length),t+1,n):""}function _i(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function wi(e,t){if(!Pr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function z(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Gl(n,i);let s=t.realpath(i);if(s!==null)return Wl(n,e,s,o);let a=tg(i);if(a===i||o.length>=ig)return Wl(n,e,i,o);o.push(Fl(i)),i=a}}function Wl(e,t,n,r){let o=r.length===0?n:rg(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function lg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Gl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Gl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=Bl(e,t,n);if(!o)return"";return z(o,n.paths,r).replace(/\\/g,"/")}function zl(e,t,n,r,o){let i=Bl(e,t,n);if(!i)return null;if(o(Fl(i)))return z(i,n.paths,r).replace(/\\/g,"/");let s=lg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Bl(e,t,n){let r=n.home,o=Ai(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Ll(r,o.slice(2)):o,s=Ce(i);return og(ng(s)?s:Ll(t,s))}function Ul(e,t,n){if(Ze(e))return;let r=t.flatMap((i)=>Pi(i,n));if(!r[0])return;let o=Pi(Ti(e)?e:$l(r[0],e),n)[0];if(!o)return;return r.some((i)=>dg(o,i))?o:void 0}function Hl(e,t,n){if(Ze(e))return;return Pi(Ti(e)?e:$l(t,e),n)[0]}function Pi(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function dg(e,t){let n=cg(t,e);return n===""||n!==".."&&!n.startsWith(`..${ug}`)&&!Ti(n)}function Yt(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Gg,realpathSync as zg,statSync as Bg}from"fs";import{homedir as $g,tmpdir as Ug}from"os";import{statSync as Lg}from"fs";import{join as Wg}from"path";import{spawnSync as mg}from"child_process";import{existsSync as On,lstatSync as fg,readFileSync as Mn,realpathSync as Zt,statSync as kn}from"fs";import{dirname as Ii,isAbsolute as ki,join as Xt,resolve as Tr}from"path";var pg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],gg=5000;function Vl(e,t=Og(),n=gg){let r=hg(e),o=r===null?null:yg(r);if(r===null||o===null)return null;let i=Ig(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function hg(e){try{let t=Zt(Tr(e));return kn(t).isDirectory()?t:null}catch{return null}}function yg(e){let t=Tg(e);if(!t)return null;try{let n=fg(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Oi(t);if(!r?.commonDir)return null;if(!Sg(r.gitDir,t))return null;return vg(r.gitDir,Ii(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Oi(e){try{let t=bg(e);if(!t)return null;let n=Zt(ki(t)?t:Tr(Ii(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:Cg(n)}}catch{return null}}function bg(e){let t=Mn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Cg(e){try{let t=Mn(Xt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Zt(ki(t)?t:Tr(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function Sg(e,t){let n=Eg(e);return n===null?!1:Kl(e,n,t)}function vg(e,t){let n=xg(e);return n===null?!0:Kl(e,n,t)}function Eg(e){let t=Xt(e,"gitdir");if(!On(t))return null;let n=Mn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function xg(e){let t=Xt(e,"config.worktree");return On(t)?_g(t):null}function Kl(e,t,n){try{return Rg(ki(t)?t:Tr(e,t),n)}catch{return!1}}function Rg(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return jl(Zt.native(e))===jl(Zt.native(t))}function jl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function _g(e){let t=Mn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=wg(s[1]??"")}return r}function wg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Pg(t.slice(1,-1))}var Ag={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function Pg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:Ag[n]??t)}function Tg(e){try{return Mi(Zt(e))}catch{return null}}function Mi(e){let t=e;while(!0){let n=Xt(t,".git");if(On(n))return n;let r=Ii(t);if(r===t)return null;t=r}}function Ig(e,t,n,r){if(kg(t))return!0;if(n===null)return!0;let o=mg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Mg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&ql(o.stdout.trim())}function kg(e){return[Xt(e.commonDir,"config"),Xt(e.gitDir,"config.worktree")].filter((t)=>On(t)).some((t)=>Dg(t))}function Og(){return pg.find((e)=>On(e))??null}function Dn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Mg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Dn(t)))}function Dg(e){let t;try{t=Mn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Ng(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=ql(c)}return r}function Ng(e){return e==="include"||e.startsWith("includeif ")}function ql(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Yl(e,t){if(e==="")return null;let n=be(),r=Mi(se(e,e,t,n)),o=r?Fg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Fg(e,t,n,r){try{let o=se(e,t,n,r),i=Lg(e),s=i.isFile()?o:null,a=i.isFile()?Oi(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Jt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Jt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Jt(o),markerFile:s?Jt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=Jt(Wg(u,"hooks").replace(/\\/g,"/"));return[m,Jt(se(m,t,n,r))]}))]}}catch{return null}}function Jt(e){return process.platform==="win32"?e.toLowerCase():e}var Hg={realpath:(e)=>{try{return zg(e)}catch{return null}},entryKind:(e)=>{let t=Gg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Bg(e).isDirectory()}catch{return!1}}};function Xl(){return jg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ce(process.env.HOME||$g()),tmpdir:Ug(),paths:Hg})}function jg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Zl(n,i,()=>Yl(i,o)),worktreeFacts:(i)=>Zl(r,i,()=>Vl(i)),...t};return o}function Zl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Qt=["fail_closed","paranoid_rm","paranoid_interpreters"],Ir={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},kr=["standard","strict","paranoid"];function Vg(e,t){if(!t)return e;return kr.indexOf(t)>kr.indexOf(e)?t:e}function Kg(e){let t=Wi(Q.level,e);if(t===void 0||t==="")return;if(kr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${kr.join(", ")}.`);return}function qg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Jl(e){return qg(Wi(Q.auditScope,e))==="all"}function Ni(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Li(e={},t){let n=e.safety?.level??"standard",r=Kg(t),o=Vg(n,r),i=Ir[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(xt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(xt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(xt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(xt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||xt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Ni(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function xt(e,t){let n=typeof e==="string"?Di(e,t):Wi(e,t);return n==="1"||n?.toLowerCase()==="true"}function Di(e,t){return t.get(e)}function Wi(e,t){let n=Di(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Di(e.legacyName,t);return}import{dirname as zr}from"path";import{closeSync as Yg,constants as Ql,fstatSync as Zg,fsyncSync as yP,lstatSync as zi,mkdirSync as bP,openSync as Xg,readdirSync as CP,readFileSync as Jg,realpathSync as Bi,renameSync as SP,rmdirSync as vP,statSync as Qg,unlinkSync as EP,writeFileSync as xP}from"fs";import{isAbsolute as ec,join as $i,normalize as eh,parse as Gi,relative as Ui,resolve as Hi,sep as ji}from"path";function Fi(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var th=Symbol("PolicyFilesystemScope"),nh=Symbol("PolicyFilesystemTarget"),rh=Ql.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Rt(e,t){return{[th]:!0,root:Hi(e),label:t}}function tc(e,t){let n=eh(t);if(t===""||ec(t)||n===".."||n.startsWith(`..${ji}`))throw new ae(e.label);return{[nh]:!0,scope:e,relativePath:n,path:$i(e.root,n)}}function Nn(e,t){return tc(e,Ui(e.root,Hi(t)))}function nc(e,t="rules policy"){let n=Hi(e),r=Gi(n).dir;return tc(Rt(r,t),Ui(r,n))}function Mr(e){return oc(e.scope.label,()=>{if(!Or(e))return null;let t=Xg(e.path,Ql.O_RDONLY|rh);return oh(t,()=>{let n=Zg(t);if(!n.isFile())throw new ae(e.scope.label);let r=Jg(t,"utf-8"),o=zi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return Or(e),r})})}function rc(e,t){if(e.path===t.path)return!0;return oc(e.scope.label,()=>{if(!Or(e)||!Or(t))return!1;let n=(r)=>$i(Bi(Gi(r).dir),Gi(r).base);return n(e.path)===n(t.path)})}function oc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function oh(e,t){try{return t()}finally{Yg(e)}}function Or(e,t="file"){let n=ih(e.scope);if(!n)return!1;let r=e.relativePath.split(ji);for(let o of r.keys()){let i=$i(e.scope.root,...r.slice(0,o+1)),s=zi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);sh(n,Bi(i),e.scope.label)}return!0}function ih(e){if(!zi(e.root,{throwIfNoEntry:!1}))return null;if(!Qg(e.root).isDirectory())throw new ae(e.label);return Bi(e.root)}function sh(e,t,n){let r=Ui(e,t);if(r===".."||r.startsWith(`..${ji}`)||ec(r))throw new ae(n)}import{dirname as wt,isAbsolute as dh,join as Pt,relative as mh,resolve as At,sep as fh}from"path";var _t=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,ic="rulebook.json",sc=".cc-safety-net/rules";var ac=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var ah=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,lh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),ch="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),AP=new RegExp(`^${lh}/(${_t.source.slice(1,-1)})/${ch}$`);function uh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function lc(e){if(Dr(e))try{return Vi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return _t.test(e)?null:`Local rulebook sources must be bare names matching ${_t}: ${e}`}function Vi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(ac);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!ah.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!_t.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:uh(o),name:o}}function Dr(e){return ac.test(e)}var cc="rule.json",Nr="policy.json",uc=".cc-safety-net",ph="rules",gh="CC_SAFETY_NET_HOME",dc="`cc-safety-net rule update`";function hh(e){return At(e,sc)}function yh(e){return Pt(hh(e),cc)}function Ln(e){return Pt(At(e),uc,Nr)}function Ki(e,t={}){return t.userConfigDir??(t.userConfigPath?wt(t.userConfigPath):Pt(bh(e),ph))}function bh(e){let t=e.env.get(gh);return t?At(Ce(t)):Pt(e.home,uc)}function Ch(e,t={}){return Pt(Ki(e,t),cc)}function en(e,t={}){return Pt(wt(Ki(e,t)),Nr)}function mc(e,t){let n=t.userConfigPath??Ch(e,t),r=t.projectConfigPath??yh(t.cwd),o=Sh(e,t),i=vh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Nn(o,n),projectConfigTarget:Nn(i,r)}}function Sh(e,t){let n=t.userConfigPath?wt(wt(At(t.userConfigPath))):wt(At(t.userConfigDir??Ki(e,t)));return Rt(n,"user policy")}function vh(e,t){let n=At(t),r=At(e),o=mh(n,r);if(o!==".."&&!o.startsWith(`..${fh}`)&&!dh(o))return Rt(n,"project policy");return Rt(wt(wt(r)),"project policy")}function fc(e,t){return Pt(e,t,ic)}var Se=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ct=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ut=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),pc=new Set(["python","python3","python2","node","ruby","perl"]),Lr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Wr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var gc="Rulebook exceeds CC Safety Net's safe validation limits.",hc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function yc(e){if(qi(e.allowed_commands,Oe.maxAllowedCommands)||qi(e.rules,Oe.maxRules)||qi(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function qi(e,t){return Array.isArray(e)&&e.length>t}var Yi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Zi=64,Xi="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Eh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Ji=new Set(["--init-file","--rcfile"]);function Qi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!Eh[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function ve(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Ji.has(l)&&!s.includes("="))i++;continue}let a=Qi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Wn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Fr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of xh(e))Wn(n,t);return t.inSingle||t.inDouble}function xh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Wn(s,n)}return t}var es=new Set(["rm","find","xargs","parallel"]),Rh=new Set(["git","busybox",...es,...J,...pc,...we]),_h=new Set(["python","node","ruby","perl"]);function bc(e){let t=M(e);return Rh.has(t)||Me(t)}function Me(e){return _h.has(wh(e))}function wh(e){let t=k(e).toLowerCase();return Lr.test(t)?"python":t}function ts(e){try{let t=Mr(Ah(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Ih(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Ah(e){return typeof e==="string"?nc(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function Cc(e){let t=new Set;return e.flatMap((n,r)=>{let o=tn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ns=`must be one of ${Yi.join(", ")}`,Ph=/^[^/]+\/[^/]+$/,Th=["version","rules","overrides","transparent_wrappers"];function Ih(e){let t=kh(e);return{errors:rs(zh(t,Th,(n)=>n.kind==="custom"),": "," "),sources:Gh(e,t)}}function kh(e){if(!tn(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Zi;return[...e.version===1?[]:[_(["version"],"must be 1")],...Oh(e.rules,t),...Nh(e.overrides),...Wh(e.transparent_wrappers),...t?[]:Dh(e.rules),...tn(e.overrides)?Object.keys(e.overrides).filter((n)=>!Ph.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Fh(e.transparent_wrappers)]}function Oh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...Sc(e,Zi)?[_(["rules"],Xi)]:[]];if(t)return[{path:["rules"],message:Xi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...Mh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function Sc(e,t){let n=vc(e);return n!==void 0&&!(n<=t)}function Mh(e,t){let n=vc(e);return n!==void 0&&!(n>=t)}function vc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Dh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=lc(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Nh(e){if(e===void 0)return[];if(!tn(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!tn(n))return[_(["overrides",t],'must be "off" or an object')];return[...Lh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||is(n.intent)?[]:[_(["overrides",t,"intent"],ns)]]})}function Lh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...Sc(e,ut)?[_(t,`must be at most ${ut} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ut?[_(t,`must be at most ${ut} characters`)]:[]}function Wh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return ct.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Fh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ct.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(bc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Gh(e,t){let n=tn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function zh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function rs(e,t,n){return[...new Set(e.map((r)=>{let o=os(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function os(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function is(e){return Yi.includes(e)}function tn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function xc(e){let t=Uh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Bh=`required non-empty string up to ${ut} characters`,Ec="must be a non-empty array of unique non-empty strings",$h="required non-empty array of non-empty strings";function Uh(e){if(!dt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!yc(e))return{errors:[gc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...rs(Hh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),hc]:t,ruleNames:new Set(Rc(e).map((n)=>n.toLowerCase()))}}function Rc(e){let t=dt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=dt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Hh(e,t){return[...typeof e.name==="string"&&_t.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...jh(e.allowed_commands),...Vh(e.rules,t),...Zh(e.tests),...Xh(e),...Jh(e)]}function jh(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ct.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ct.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Vh(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!dt(n))return[_(["rules",r],"must be an object")];return t?qh(n,["rules",r]):Kh(n,["rules",r])}),...Cc(e)]}function Kh(e,t){return[..._c(e.name,t),...wc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ct.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Gr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Ac(e.reason,t),...Pc(e.intent,t)]}function qh(e,t){return[..._c(e.name,t),...wc(e.command,t),...Ac(e.reason,t),...Pc(e.intent,t),...Yh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function _c(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return _t.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function wc(e,t){return typeof e==="string"&&ct.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function Ac(e,t){return typeof e==="string"&&e!==""&&e.length<=ut?[]:[_([...t,"reason"],Bh)]}function Pc(e,t){return e===void 0||is(e)?[]:[_([...t,"intent"],ns)]}function Yh(e,t){if(!dt(e))return[_(t,"required object")];return[...Gr(e.command_path,[...t,"command_path"],$h,!1),...e.any_args===void 0?[]:Gr(e.any_args,[...t,"any_args"],Ec,!0),...e.exclude_args===void 0?[]:Gr(e.exclude_args,[...t,"exclude_args"],Ec,!0)]}function Gr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Zh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!dt(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Xh(e){if(!Array.isArray(e.tests))return[];let t=new Set(Rc(e));return[...new Set(e.tests.flatMap((n)=>dt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function Jh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=dt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function dt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Dc(e,t){let n=mc(e,t),r;try{r=rc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ae)return ay(n,f.message);throw f}let o=ts(n.userConfigTarget),i=r?{config:null,errors:[]}:ts(n.projectConfigTarget),s=Oc(n.userConfigPath,o.errors),a=Oc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Tc(o.config,zr(n.userConfigPath),"user",n.userScope,l):Mc(),u=i.config?Tc(i.config,zr(n.projectConfigPath),"project",n.projectScope,l):Mc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Ic(c.rules,m),...Ic(u.rules,d)],transparent_wrappers:iy(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?kc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?sy(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?kc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Tc(e,t,n,r=Rt(zr(zr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=ey(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:Qh(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Qh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function ey(e,t,n){let r=ty(e),o=fc(t,r),i=ry(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${ny(e)}`]};let s=oy(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function ty(e){return Dr(e)?Vi(e).name:e}function ny(e){return Dr(e)?`run ${dc} to vendor ${e}`:"create that file or remove that source from the rules config"}function ry(e,t){try{return{content:Mr(Nn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function oy(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:xc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function iy(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Ic(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function kc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function sy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Oc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function ay(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Mc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Cy,readFileSync as Sy}from"fs";var Nc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ss=new Set(Nc.map((e)=>e.id)),Br=Nc,ly=new Map(Br.map((e)=>[e.id,e.intent]));function C(e,t){return{id:e,reason:t,intent:ly.get(e)??"manual_only"}}var as=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],$r={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},cy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],uy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ls=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...uy.flatMap((e)=>cy.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Ur=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Lc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],dy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],cs=Lc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),us=Lc.flatMap((e)=>dy.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Fn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ds=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),ms=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],my=[...as,$r,...ls,...cs,...us,Fn,...ds,...ms,...Ur].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Hr=new Set(Ur.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),fs=new Set(my.map((e)=>e.id));import{isAbsolute as ps,join as fy,normalize as py,sep as jr}from"path";var Vr=process.platform==="win32",Wc=/[*?]/;function gs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Vr?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(Wc.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Gn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function hs(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Gn(e.trim(),t);if(!ps(n))return"must be an absolute path or start with ~/";return zn(n,t)}function ys(e,t){let n=Fc(e,t);if(n===null)return"must be a non-empty path string";if(!ps(n))return null;if(zn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var gy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",hy="cannot cover the guard's own configuration";function Fc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=Vr?n.replaceAll("\\","/"):n;return Gn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function bs(e,t){let n=Fc(e,t);if(n===null)return"must be a non-empty path string";let r=gs(n)?.root??n;if(Wc.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!ps(r))return null;if(zn(r,t)!==null)return gy;return yy(r,t)?hy:null}function yy(e,t){let n=Kr(e),r=Kr(fy(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${jr}`)}function zn(e,t){let n=Kr(e),r=Kr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(jr)?n:`${n}${jr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Kr(e){let t=py(e);if(Vr)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Vr?3:1)&&t.endsWith(jr))t=t.slice(0,-1);return t}var Gc=30,qr=1,Yr=365;function zc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Bc=new Set(Br.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(Bc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Bc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function $c(e,t){return Object.freeze(Object.fromEntries(Br.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Uc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:$c(e,t)})}var Hc={standard:0,strict:1,paranoid:2};function Kc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:Cs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:Cs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:Cs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:by(e,t)}}function Cs(e,t){return[...new Set([...e,...t??[]])]}function by(e,t){let n=t.safety?.level,r=Ir[e.safety.level];return[...n&&Hc[n]<Hc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Qt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...jc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...jc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Hr.has(o))),...e.destructive_command_protection.enabled?Vc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Vc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function jc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Vc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Es=new Set(["standard","strict","paranoid"]),Xc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Gc}};function Jc(e,t){let n=Iy(en(e,t),e.home),r=Jr(Ln(t.cwd),e.home),o=Ey(r.parsed,e.home),i=Object.keys(o.policy).length>0?Kc(n.gui??Xc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?vs(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var vy="project policy audit settings are ignored; audit is user scope only";function Ey(e,t){if(!Ee(e))return{policy:{},diagnostics:[]};let n=Ee(e.safety)?e.safety:{},r=Ee(e.workflow)?e.workflow:{},o=Ee(e.destructive_command_protection)?e.destructive_command_protection:{},i=Ee(e.secret_protection)?e.secret_protection:{},s={...Es.has(n.level)?{level:n.level}:{},...Ee(n.overrides)?qc({overrides:Qc(n.overrides,Qt,["safety","overrides"],Tt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Xr(o.overrides,ss,tu,Tt)}:{},...o.allow_paths!==void 0?{allow_paths:rn(o.allow_paths,hs,t,["destructive_command_protection","allow_paths"],Tt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Xr(i.overrides,fs,nu,Tt)}:{},...i.deny_paths!==void 0?{deny_paths:rn(i.deny_paths,ys,t,["secret_protection","deny_paths"],Tt)}:{},...i.allow_paths!==void 0?{allow_paths:rn(i.allow_paths,bs,t,["secret_protection","allow_paths"],Tt)}:{}};return{policy:qc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[vy]}}function Qc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],xs));return[]}))}function qc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Tt=()=>{return},xs="must be a boolean",Rs="must be an object if provided",eu=`must be an integer between ${qr} and ${Yr}`,tu={path:["destructive_command_protection","overrides"],label:"destructive command"},nu={path:["secret_protection","overrides"],label:"secret protection"},xy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Ry(e,t){let n=[];return{policy:ru(e,t,(o)=>{n.push(o)}),issues:n}}function _y(e,t){return ru(e,t,Tt)}function ru(e,t,n){if(!Ee(e))return n(_([],"Config must be an object")),Zr();if(e.version!==1)n(_(["version"],"must be 1"));let r=nn(e.safety,["safety"],["level","overrides"],n),o=nn(r.overrides,["safety","overrides"],Qt,n),i=nn(e.workflow,["workflow"],["worktree_mode"],n),s=nn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=nn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=nn(e.audit,["audit"],["retention_days"],n);return ou(e,xy,[],n),{version:1,safety:{level:wy(r.level,n),overrides:Qc(o,Qt,["safety","overrides"],n)},workflow:{worktree_mode:Ss(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Ss(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Xr(s.overrides,ss,tu,n),allow_paths:rn(s.allow_paths,hs,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Ss(a.enabled,["secret_protection","enabled"],!0,n),overrides:Xr(a.overrides,fs,nu,n),deny_paths:rn(a.deny_paths,ys,t,["secret_protection","deny_paths"],n),allow_paths:rn(a.allow_paths,bs,t,["secret_protection","allow_paths"],n)},audit:{retention_days:Ay(l.retention_days,n)}}}function nn(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(t,Rs)),{};return ou(e,n,t,r),e}function ou(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function wy(e,t){if(e===void 0)return"standard";if(Es.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Ss(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,xs));return n}function Ay(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=qr&&e<=Yr))t(_(["audit","retention_days"],eu));return zc(e)}function Xr(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(n.path,Rs)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function rn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function Ee(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Zr(){return structuredClone(Xc)}function Jr(e,t){if(!Cy(e))return{exists:!1,policy:Zr(),errors:[]};try{let n=Sy(e,"utf-8");if(!n.trim())return{exists:!0,policy:Zr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Ry(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${Ty(i)}`),fallback:Ee(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Zr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var Py=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Rs,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[xs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[eu,`not an integer between ${qr} and ${Yr}`]]);function Ty(e){let t=os(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=Py.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function Iy(e,t){let n=Jr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ee(r))return{policy:Zc(),errors:[]};let o=_y(r,t);return{policy:vs(o),gui:o,errors:[],levelPresent:Yc(r)}}if(n.parsed===void 0)return{policy:Zc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:vs(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Yc(n.parsed)}}function Yc(e){let t=Ee(e)&&Ee(e.safety)?e.safety:{};return Es.has(t.level)}function iu(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Hr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Zc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:iu({}),denyPaths:[],allowPaths:[]}}}function vs(e){return{safety:ky(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:iu(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function ky(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function su(e,t){let n=Dc(e,t),r=Jc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Ny(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Ly(o,Oy(n,r),s,r.policyScopes)}function Oy(e,t){let n=Dy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:Wy(e.errors.length>0?My(e.errors):void 0,e.warnings.length>0?ws(e.warnings.join("; ")):void 0,n)}}function My(e){return`${ws(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Dy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Ny(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Ly(e,t,n=Object.freeze({}),r){let o=_s(structuredClone(e)),i=r?{policyScopes:_s(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function _s(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))_s(t);return Object.freeze(e)}function Wy(...e){return ws(e.filter((t)=>!!t).join("; "))}function ws(e){return/[.!?]$/.test(e)?e:`${e}.`}function au(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:As(t.fail_closed,e.strict,"strict"),paranoid_rm:As(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:As(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Uc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Ni({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function As(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Bn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Fy=/^[A-Za-z_][A-Za-z0-9_]*=/;function Qr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function $n(e){let t=Qr(e.words[0],"time")?1:0,n=t===1&&Qr(e.words[t],"-p")?t+1:t,r=t===1&&Qr(e.words[n],"--")?n+1:n,o=Qr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Fy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var mt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function eo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Gy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function to(e,t,n){e.push(n),t.reset()}function no(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Ps(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function on(e,t,n,r,o,i,s){return Ps({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Gy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ts(e,t,n){if(t>=n||cu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!cu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=lu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=lu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Is(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=zy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?By(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function lu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function cu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function zy(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function By(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var fu=new Set(["&&","||","|","|&"]);function pu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=io(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:lo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function io(e,t,n,r,o,i,s){let a=[],l=[],c=eo(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((g)=>g.text);to(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),mu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(ao(f)){if(f===`
+`||f==="\r"){m();let v=f==="\r"&&e[d+1]===`
+`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!fu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,v),span:Object.freeze({start:d,end:v})}));if(u.length>0){let x=Is(e,v,n,u.splice(0));l.push(...x.issues),d=x.next;continue}d=v;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
+`&&e[d]!=="\r")d++;continue}let p=c.start===-1?lb(e,d,n):void 0;if(p){if(Os(a,l),i>=r.maxDepth)return sn(a,l,d,"depth-limit",r.maxDepth);if(!ks(o))return sn(a,l,d,"word-limit",r.maxWords);let v=io(e,p.braceIndex+1,n,r,o,i+1,"}"),T=v.next,x={start:p.braceIndex+1,end:v.closed?T-1:T},A=uu(e,x,v);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:A}),l.push(...v.issues),v.pendingHeredocs.length>0||Hn(v.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...v.pendingHeredocs),v.limited)return oo(a,l,v.next);if(!v.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let g=so(e,d);if(g){if(m(),!Eu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:g,span:Object.freeze({start:d,end:d+g.length})})),d+=g.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&Yy(e,d,n))&&c.start===-1){if(Os(a,l),i>=r.maxDepth)return sn(a,l,d,"depth-limit",r.maxDepth);let v=f==="("?")":"}",T=io(e,d+1,n,r,o,i+1,v),x=T.next,A={start:d+1,end:T.closed?x-1:x},q=uu(e,A,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:x},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Hn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return oo(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=x;continue}let h=(f==="<"||f===">")&&e[d+1]!=="("?jy(e,d):null;if(h){let v=c.words.at(-1),T=v&&v.span.end===d&&/^[0-9]+$/.test(v.raw)?Number(v.raw):void 0;if(T!==void 0)c.words.pop();let x=T===void 0?d:v?.span.start??d;c.start=c.start===-1?d:c.start;let A=d+h.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let q=e[A],Z=A>d+h.length&&q==="#",ee=!q||ao(q)||!!so(e,A)||q===s||q===")"||Z||(q==="<"||q===">")&&e[A+1]!=="(",X=h==="<<"||h==="<<-",U=X?Ts(e,A,n):void 0,N=U?{word:on(e,A,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Ms(e,A,n,r,o,i):void 0;if(N){if(l.push(...N.issues),N.limited)return oo(a,l,N.next);if(!ks(o))return sn(a,l,N.next,"word-limit",r.maxWords)}let ue=N?.next??d+h.length,_e={kind:"redirection",operator:h,span:{start:x,end:ue},...T===void 0?{}:{fd:T},...N?{target:N.word}:{}};if(c.redirections.push(_e),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let qe=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:h==="<<-",attach:(ke)=>{if(_e.heredoc=ke,ke.quotedDelimiter)return;qe.push(...Uy(e,ke.bodySpan.start,ke.bodySpan.end,r,o,i+1))}})}if(!X&&!N)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(N)c.nested.push(...N.nested);c.end=ue,d=ue;continue}if(c.start===-1)Os(a,l);let y=Ms(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return oo(a,l,y.next);let S=Jy(c.words)?rb(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(S?.limitCode)return sn(a,l,y.next,S.limitCode,S.limitCode==="word-limit"?r.maxWords:S.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=S?.words??[y.word];for(let v of E){if(!ks(o))return sn(a,l,y.next,"word-limit",r.maxWords);c.words.push(v)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return m(),mu(a,l),l.push(...cb(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function uu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:lo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ms(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||ao(f)||(f===";"||f==="|"||f==="&")&&so(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=$y(e,a,n,r,o,i);if(s+=h.text,u.push(...h.nested),m.push(...h.issues),d||=h.limited,c=Un(c,h.provenance),a=h.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let h=Vy(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
+`){a+=2;continue}s+=h,a+=2;continue}let g=f==="$"||f==="<"||f===">"||f==="`"?co(e,a,n,r,o,i):null;if(g){let h=gu(g,u,m);if(d||=h.limited,c=Un(c,h.provenance),a=h.next,d)break;continue}if(f==="$"){let h=bu(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=Un(c,"glob");s+=f,a++}return{word:on(e,t,a,s,c,l,c==="literal"?void 0:qy(e,t,a)),nested:u,issues:m,next:a,limited:d}}function $y(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
 `){m+=2;continue}if(p==="\r"&&e[m+2]===`
-`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=Os(e,m+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(m,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=h;continue}let f=ao(e,m,n,r,o,i);if(f){let p=su(f,l,c);if(m=p.next,u||=p.limited,a=Un(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=cu(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function ao(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=Os(e,t+u,n,m),f=d===-1?n:d,p=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:Yy(e,t+u,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],S=!1,T=t+u;while(T<f){let R=ao(e,T,f,r,o,i+1);if(!R){T++;continue}if(v.push(...R.program.nodes),E.push(...R.program.issues),S||=R.program.status==="limited",T=R.next,S)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:so(E,S),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=ro(e,t+u,f,r,o,i+1),g=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Hn(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:so([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function ky(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?ao(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function su(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Os(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=Ds(e,m+3,n,"))"),g=p===-1?n:p+2;if(s+=e.slice(m,g),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=g;continue}let f=co(e,m,n,r,o,i);if(f){let p=gu(f,l,c);if(m=p.next,u||=p.limited,a=Un(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=bu(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function co(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=Ds(e,t+u,n,m),f=d===-1?n:d,p=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:ab(e,t+u,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let S=[],E=[],v=!1,T=t+u;while(T<f){let x=co(e,T,f,r,o,i+1);if(!x){T++;continue}if(S.push(...x.program.nodes),E.push(...x.program.issues),v||=x.program.status==="limited",T=x.next,v)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:lo(E,v),issues:E,nodes:S}),next:p,provenance:"arithmetic"}}let g=io(e,t+u,f,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Hn(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:lo([...g.issues,...h,...y],g.limited),issues:[...g.issues,...h,...y],nodes:g.nodes}),next:p,provenance:"command-substitution"}}function Uy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?co(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function gu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Ds(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
 `||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=Ps(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=au(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=Oy(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=As(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Oy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=au(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function au(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!Jy(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function oo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function My(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function io(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function lu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Dy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Ny(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Ny(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return to(e,t+1,n,16,2,t+1);if(r==="u")return to(e,t+1,n,16,4,t+1);if(r==="U")return to(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return to(e,t,n,8,3,t+1);return{text:r,next:t+1}}function to(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function so(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function cu(e,t,n,r,o){let i=lu(e,t,n);return{text:r+e.slice(t,i),provenance:Un(o,"variable"),next:i}}function Ly(e,t,n){let r=eo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,p=c?"))":d?"`":")",h=Os(e,a+f,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let f=lu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Un(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function Wy(e,t,n){return t+1>=n||io(e[t+1]??"")||oo(e,t+1)!==null}var Fy=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Gy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function zy(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=By(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function By(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return $y(e,t);if(n==="env")return Uy(e,t);if(n==="sudo")return Hy(e,t);return}function $y(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Uy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Fy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function Hy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Gy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function uu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=du(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>mu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function jy(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=du(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>mu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>on(e,t.span.start,t.span.end,a,"literal",!1))}}function du(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>nu(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=nu(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...Vy(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function nu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&qy(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:Ky(e,r)}}function Vy(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function Ky(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function qy(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function mu(e,t){let n=`x${e}`,r=ks(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function Yy(e,t,n,r){return me({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function sn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function no(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ts(e){return e.used++,e.used<=e.max}function Zy(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Hn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Hn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Hn(t.body.nodes)})}function Xy(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function fu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function ru(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!ou.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Is(e,t){if(!fu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function Jy(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var gu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Qy=new Set(["gc","cat","type","cp","mv","rm"]),hu=["-rec","-for","-path","-literalpath","-whatif"],eb=/^\$env:\w/i,tb=/^(?:\$\{?\w+\}?|~)\\./;function yu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...gu].some((o)=>n.includes(o))&&!(n.includes("rm")&&hu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!nb(n))return!1;let r=Ls(e,t);if(bu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ns(r).some(rb)}function bu(e){return e.nodes.some((t)=>{if(t.kind==="group")return bu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function nb(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function rb(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&gu.has(n))return!0;let r=e.slice(t+1);if(n&&Qy.has(n)&&r.some(ob))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return hu.some((s)=>i.startsWith(s))})}function ob(e){return eb.test(e)||tb.test(e)}function Ls(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ws(e,0,e.length,t,0);return me({kind:"program",dialect:"powershell",source:e,span:n,status:cb(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ws(e,t,n,r,o,i=!1){let s=[],a=[],l=Jr(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};Qr(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=lb(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`?a+2:a+1,m=Is(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=hu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=Hy(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=Ts(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Hy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=hu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function hu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!ub(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function so(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function jy(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function ao(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function yu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Vy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Ky(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Ky(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return ro(e,t+1,n,16,2,t+1);if(r==="u")return ro(e,t+1,n,16,4,t+1);if(r==="U")return ro(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return ro(e,t,n,8,3,t+1);return{text:r,next:t+1}}function ro(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function lo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function bu(e,t,n,r,o){let i=yu(e,t,n);return{text:r+e.slice(t,i),provenance:Un(o,"variable"),next:i}}function qy(e,t,n){let r=no(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,p=c?"))":d?"`":")",g=Ds(e,a+f,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=yu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Un(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function Yy(e,t,n){return t+1>=n||ao(e[t+1]??"")||so(e,t+1)!==null}var Zy=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Xy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Jy(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Qy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Qy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return eb(e,t);if(n==="env")return tb(e,t);if(n==="sudo")return nb(e,t);return}function eb(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function tb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Zy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function nb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Xy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function Cu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=Su(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>vu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function rb(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=Su(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>vu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>on(e,t.span.start,t.span.end,a,"literal",!1))}}function Su(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>du(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=du(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...ob(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function du(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&sb(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:ib(e,r)}}function ob(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function ib(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function sb(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function vu(e,t){let n=`x${e}`,r=Ms(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function ab(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function sn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function oo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ks(e){return e.used++,e.used<=e.max}function lb(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Hn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Hn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Hn(t.body.nodes)})}function cb(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function Eu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function mu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!fu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Os(e,t){if(!Eu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function ub(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Ru=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),db=new Set(["gc","cat","type","cp","mv","rm"]),_u=["-rec","-for","-path","-literalpath","-whatif"],mb=/^\$env:\w/i,fb=/^(?:\$\{?\w+\}?|~)\\./;function wu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...Ru].some((o)=>n.includes(o))&&!(n.includes("rm")&&_u.some((o)=>n.includes(o)))&&!n.includes("<#")&&!pb(n))return!1;let r=Fs(e,t);if(Au(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ws(r).some(gb)}function Au(e){return e.nodes.some((t)=>{if(t.kind==="group")return Au(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function pb(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function gb(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Ru.has(n))return!0;let r=e.slice(t+1);if(n&&db.has(n)&&r.some(hb))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return _u.some((s)=>i.startsWith(s))})}function hb(e){return mb.test(e)||fb.test(e)}function Fs(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Gs(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:vb(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Gs(e,t,n,r,o,i=!1){let s=[],a=[],l=eo(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};to(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=Sb(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
 `){m();let y=f==="\r"&&e[d+1]===`
-`?d+2:d+1;s.push(Ms(e,d,y)),d=y;continue}d++;continue}let h=vu(e,d);if(h){m(),s.push(Ms(e,d,d+h.length)),d+=h.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Su(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ws(e,d+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=me({kind:"program",dialect:"powershell",source:e.slice(d+1,v),span:{start:d+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(Ms(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?pu(e,v,n,r,o):void 0,S=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:S}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=S,d=S;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(ws({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let g=pu(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,u||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next>d?g.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function pu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(p)=>{let h=ib(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),u+=Ds(h.program),m||=h.program.status==="limited",s="command-substitution",h.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||vu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[f+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=h,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(p==="'"){a=!0,f++;let h=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){h=!0,f++;break}i+=e[f]??"",f++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let h=!1;while(f<n){let g=e[f];if(g==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(g==='"'){h=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=g??"",f++}if(!h)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:on(e,t,f,i,s,a,s==="literal"?void 0:sb(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function ib(e,t,n,r,o){let i=Cu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Su(r.maxDepth)],nodes:[]}),next:a};let l=Ws(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Cu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Ds(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Ds(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Ds(r)}}return t}function sb(e,t,n){let r=eo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Cu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=ab(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function ab(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Su(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ns(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ns(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ns)]})}function vu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function lb(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function cb(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Ms(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Me(e,t="auto",n=dt){if(t==="powershell"||t==="auto"&&yu(e.slice(0,n.maxInputLength),n))return Ls(e,n);return iu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function an(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function lo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Fs(e,t){return{value:e,work:t}}function b(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function jn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){jn(e,t)}function It(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Gs(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Y(e))return!1;for(let r=0;r<n.length;r++)if(b(e,t+r)!==n[r])return!1;return!0}function qe(e,t,n){return!It(b(e,t-1))&&j(e,t,n)&&!It(b(e,t+n.length))}function Ye(e,t){return It(b(e,t-1))!==It(b(e,t))}function oe(e){return e===`
-`||e===";"||e==="&"||e==="|"}function ln(e){return e==="|"||e===";"}function co(e,t,n){let r=Fs(e,n);if(t==="rm")return ub(r);if(t==="dd")return mb(r);return Au(r,!0)}function uo(e,t,n){let r=Fs(e,n);if(t==="rm")return fb(r);if(t==="reset-hard")return _u(r,"--ha","rd");if(t==="reset-merge")return _u(r,"--me","rge");if(t==="clean")return yb(r);if(t==="checkout")return Cb(r);if(t==="push-force")return Sb(r);if(t==="push-refspec")return vb(r);if(t==="push-delete")return Eb(r);if(t==="branch")return Rb(r);if(t==="tag")return wb(r);if(t==="restore")return Ab(r);return Au(r,!1)}function ub(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=b(e,i);if(!t){let l=b(e,i+2);if(qe(e,i,"rm")&&H(l)&&l!==`
-`)t=!0,i++;continue}let a=db(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=Eu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Eu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function db(e,t){if(b(e,t)!=="\\"||b(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function Eu(e,t,n){if(Ru(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Ru(e,t,n,"force"))return{recursive:!1,force:!0};if(b(e,t)!=="-"||b(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=b(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Ru(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(b(e,t+i+2)!==r[i])return!1;return!0}function mb(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(b(e,n))){t=!1;continue}if(qe(e,n,"dd")){t=!0,n++;continue}if(!t||!qe(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(b(e,r))&&b(e,r)!=="'"&&b(e,r)!=='"')return!0}return!1}function fb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=b(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=gb(e,o);if(s>=0){if(pb(e,s))return!0;let a=s,l=!1;while(H(b(e,a)))l||=b(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(b(e,o-1)))&&(!b(e,o+2)||H(b(e,o+2))||oe(b(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&Ye(e,o+11)||zs(e,o,"recursive"),r||=j(e,o,"--force")&&Ye(e,o+7)||zs(e,o,"force"),n&&r)return!0;o++}return!1}function zs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=b(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&Ye(e,t+r+2)}function pb(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(b(e,n)))n++;let i=n;while(n<Y(e)&&!H(b(e,n)))n++;if(b(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=xu(e,i,"recursive"),a=xu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,b(e,i+1)==="-")continue;let l=hb(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function xu(e,t,n){return j(e,t,`--${n}`)&&Ye(e,t+n.length+2)||zs(e,t,n)}function gb(e,t){if(t>0&&It(b(e,t-1)))return-1;let n=t;if(b(e,n)==="\\")n++;if(b(e,n)!=="r")return-1;if(n++,b(e,n)==="\\")n++;if(b(e,n)!=="m"||!H(b(e,n+1)))return-1;return n+1}function hb(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(b(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=b(e,c)??"",m=(u==="r"||u==="f")&&Ye(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function _u(e,t,n){return Kn(e,"reset",ln,!0,(r)=>b(e,r)==="-"&&cn(e,r,t,n)?!0:r)}function yb(e){return Kn(e,"clean",ln,!0,(t)=>{if(b(e,t)!=="-")return t;if(cn(e,t,"--fo","rce"))return!0;let n=Vn(e,t,ln);for(let r=t+1;r<n;r++)if(b(e,r)==="f")return!0;return n-1})}function mo(e,t,n){if(!qe(e,t,"git"))return null;let r=t+3;if(!H(b(e,r)))return{commandEnd:-1,next:r};while(H(b(e,r)))r++;while(r<Y(e)){if(oe(b(e,r)))return{commandEnd:-1,next:r};let o=Vn(e,r,oe);if(qe(e,r,n))return{commandEnd:r+n.length,next:o};if(b(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=bb(e,r,o);r=o;while(H(b(e,r)))r++;if(i)return{commandEnd:qe(e,r,n)?r+n.length:-1,next:Vn(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(b(e,r)))return{commandEnd:-1,next:r};r=Vn(e,r,oe);while(H(b(e,r)))r++}return{commandEnd:-1,next:r}}function bb(e,t,n){for(let r of Ce)if(n-t===r.length&&j(e,t,r))return!0;return!1}function Cb(e){return wu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function Sb(e){return Kn(e,"push",ln,!0,(t)=>{if(b(e,t)!=="-")return t;if(b(e,t+1)==="f"&&!It(b(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Pu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function vb(e){return Kn(e,"push",oe,!1,(t)=>{if(H(b(e,t))&&b(e,t+1)==="+"&&t+2<Y(e)&&!oe(b(e,t+2))&&!H(b(e,t+2)))return!0;if(b(e,t)===":"&&b(e,t+1)==="+")return!0;return t})}function Eb(e){return Kn(e,"push",oe,!1,(t)=>{if(b(e,t)==="-"&&cn(e,t,"--de","lete"))return!0;if(H(b(e,t))&&b(e,t+1)===":"&&t+2<Y(e)&&!H(b(e,t+2))&&!oe(b(e,t+2)))return!0;return t})}function Rb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(b(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=mo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||b(e,o)!=="-")continue;let i=Vn(e,o,oe),s=xb(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function xb(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(b(e,i)!=="-")continue;if(cn(e,i,"--de","lete"))r=!0;if(cn(e,i,"--fo","rce"))o=!0;if(b(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&_b(b(e,s))){let u=b(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!Ye(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function _b(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function wb(e){return wu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function wu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=b(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&b(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=mo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(b(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(cn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(b(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Ye(e,r+1))return!0;if(ln(o))i.outerActive=!1}return!1}function Kn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=b(e,s),l=n(a);if(!i&&!l){let c=mo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(b(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(b(e,u)))i=!1;s=c}if(l)i=!1}return!1}function Ab(e){let t=!1;for(let n=0;n<Y(e);n++){if(Gs(b(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=mo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&b(e,n)==="-"&&b(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Au(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=b(e,r),i=t?Gs(o):oe(o);if(n&&H(o)&&b(e,r+1)==="-"&&qe(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(qe(e,r,"find"))n=!0,r+=3}return!1}function Vn(e,t,n){let r=t;while(r<Y(e)&&!H(b(e,r))&&!n(b(e,r)))r++;return r}function Pu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&b(e,o)===r[i];i++)o++;return Ye(e,o)?o:-1}function cn(e,t,n,r){return Pu(e,t,n,r)>=0}function Ze(e,t){jn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&uo(a,s.scan,t))return C("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var Pb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Iu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;jn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return ku(t.nodes,r,i)}function ku(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return ku(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return Tb(r,t,n)})}function Tb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!Pb.test(o.text));return e.words.every((o,i)=>o===t||Tu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Tu(o.target.raw,n.anchored,!0)))}function Tu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as Ib,resolve as Ou}from"path";function qn(e,t,n,r){let o=Ib(e)?Ou(e):t?Ou(t,e):void 0;if(!o)return;try{return G(o,n,r)}catch{return o}}function Mu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var un="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Yn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Bs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),kb=new Set(["-p","--print"]),Ob=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),Mb=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),Db=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),Nb=new Map([["python",new Set(["m"])]]),Lb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),Wb=new Set(["always","default","never"]),Fb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Gb=/\\\r?\n/g,zb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Nu(e){return po(e).code}function fo(e){return po(e).sources}function Lu(e){return zb.get(Us(e))??[]}function po(e){let t=Us(e[0]??"");if(!Bs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return De(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return De(t,n,r,o,i,s);if(t==="node"&&kb.has(s)){let m=e[i+1];if(m===void 0)return De(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if($b(t,s)){let m=e[i+1];if(m===void 0)return De(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return De(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(Ub(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=Bb(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,De(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return De(t,n,r,o);if(Lb.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&Fb.has(s))||t==="python"&&!Wb.has(m))return De(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(Nb.get(t)?.has(d)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return De(t,n,r,o)}if(Ob.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(Mb.get(t)?.has(d)){if(m+1===s.length)i++;break}if(Db.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return De(t,n,r,o);if(c)i++}return De(t,n,r,o,void 0,void 0,!0)}function De(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function Bb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function $s(e,t){return Us(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Us(e){let t=k(e).toLowerCase();return Nr.test(t)?"python":t}function $b(e,t){return Bs.get(e)?.has(t)??!1}function Ub(e){return Bs.get(e)?.has("--eval")??!1}function Zn(e,t){let n=Vb(e,t);if(!Du(n,t))return!1;Ee(t,n);let r=jb(n);if(Du(r,t))return!0;return Ee(t,r),Hb.test(r)}var Hb=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function jb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Du(e,t){if(co(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(co(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(co(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>uo(o,r))))}function Vb(e,t){return Ee(t,e),e.replace(Gb,"")}import{isAbsolute as ld,relative as cd}from"path";import{isAbsolute as Uu,parse as nC}from"path";import{dirname as Kb,isAbsolute as qb,parse as Yb,sep as Zb}from"path";function mt(e,t,n){if(Ke(t))throw Error("Unsupported Windows namespace path");let r=qb(t)?Yb(t).root:"",o=r||e;for(let i of Jb(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=Kb(o);continue}let s=Xb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function Xb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${Zb}${t}`}function Jb(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Hs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],Qb=new Set(Hs),eC=1024,Wu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Fu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),tC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function go(e){return Qb.has(e)}function js(e){return go(e)||Wu.has(e)||Fu.has(e)||Dn(e)}function Xe(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Gu(e,t){let n=Xe("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=eC?{state:"valid",count:r}:{state:"invalid"}}function ho(e,t,n){let o=e.match(tC)?.[1];if(!o||!js(o))return null;let i=e.indexOf("=");return{name:o,value:`${Xe(o,t,n)??""}${e.slice(i+1)}`}}function zu(e){return $u(e,Fu)}function Bu(e){return $u(e,Wu)}function $u(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var ju=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ae(e){if(!ju.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function yo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Ae(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Vu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function kt(e,t,n,r){if(!Vu(dn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let d=Hu(i),f=yo(i);for(let[h,g]of f.envAssignments)s.set(h,g),a.set(h,g);if(i=f.words,i.length===0)break;while(i.length>0&&dn(i).includes("=")&&!oC(i)){let h=iC(dn(i),a,t.env)??ho(dn(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=dn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=aC(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=uC(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=dC(i);if(p==="builtin")i=i.slice(Ne(i,1)==="--"?2:1);if(Hu(i)===d)break}let u=yo(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:rC(u.words,o)}}function rC(e,t){return e.some((n)=>!t.has(n))}function Hu(e){return e.map(w).join(" ")}function dn(e){let t=e[0];return t?w(t):""}function Ne(e,t){let n=e[t];return n?w(n):void 0}function oC(e){return ju.test(dn(e))}function iC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var sC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function aC(e,t,n){let r=1,o=n;while(r<e.length){let i=Ne(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Ne(e,r+1);o=s?Xn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Xn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Xn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(sC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var lC=new Set(["-i","-0","--null"]),cC=new Set(["-u","--unset","-C","--chdir","-P"]);function uC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Ne(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(lC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Ne(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:Ne(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(cC.has(c)){if(c==="-C"||c==="--chdir"){let m=Ne(e,a+1);s=m?Xn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Xn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Ae(c))break;while(a<e.length){let m=Ae(Ne(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Ne(e,a)==="--")a++;return l(a)}return l(a)}function Xn(e,t,n){if(t==="")return null;if(!e&&!Uu(t))return null;let r=Uu(t)?nC(t).root:n.realpath(e??"/");if(r===null)return null;try{return mt(r,t,n)}catch{return null}}function dC(e){if(Ne(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Ne(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var mC=/['"\\$`{}#]/;function bo(e,t){if(e.some((r)=>mC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function ft(e,t,n){return Co(e,t,n).tokens}function fC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ot(e,t,n,r=0){let o=Co(e,t,n),i=(o.envSplitValues??[]).flatMap(fC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ot(s,t,n,r+1)}function Co(e,t,n,r){if(!Vu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=kt(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Ys=Symbol("adopt-as-operand"),pC=new Set(["env","sudo","command","builtin"]),gC=new Set(["&&","||","|&","|","&",";"]),hC=new Set(["<<","<<<",">|"]),yC=new Set(["|","|&"]),bC=/[*@#?$!_-]/,CC=/^\w+(?::\w+)*/,SC=Object.freeze([]),Jn=Object.freeze({kind:"scope",edge:"enter"}),Qn=Object.freeze({kind:"scope",edge:"exit"}),vC=Object.freeze([]),EC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),er=new Set(["bash","sh","zsh","dash","ksh"]),RC=256,Xu=new WeakMap;function Ju(e,t){let n=t.status==="complete"?new Set(qs(t)):new Set,r=wC(e,n);if(Wr(r))return So("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Mt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return So("structural-limit",r,t);if(o.invalid)return So("invalid",r,t);let s=So("complete",r,t,o.assignmentFallbacks);return Xu.set(s,Object.freeze(i)),s}function Eo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of Qu(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=xC(a,s,n,r),c=a.length>0&&yC.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===Ys){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function Ro(e){return Qu(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function fe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:fe(i,t);return a?fe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function xC(e,t,n,r){let o=tr(e)?new Map([...t.variables,..._C(e,t.variables)]):t.variables,i=ft([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(fe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function _C(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],fe(o,t)]]:[]})}function Qu(e){return Xu.get(e)??SC}function wC(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function So(e,t,n,r=vC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Mt(e,t){return e.nodes.flatMap((n,r)=>AC(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function AC(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Le(OC(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Le(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[vo("{"),...Mt(e.body,a),...s?[vo("}")]:[]]:[Jn,Le("("),...Mt(e.body,a),...s?[Le(")")]:[],Qn]}]}let o=LC(e,r.functions);if(o){if(r.depth>=dt.maxDepth||++r.flags.expansions>RC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Ku(e,r),vo(";"),...Mt(o,{...r,depth:r.depth+1}),vo(";")]},...qu(e,t,n,r)]}return[{start:e.span.start,events:Ku(e,r)},...qu(e,t,n,r)]}function Ku(e,t){return[...e.words.map((n)=>({start:n.span.start,events:td(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:PC(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function PC(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?td(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[Zs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:MC(r),targetOrder:hC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:rd(t)}:{}}),...s===void 0?o:o.slice(1)]}function qu(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[Zs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Le(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...ed(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?TC(t,n,r):[]]}function TC(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:ed(n.source.slice(r.span.end,e.span.end),n)}]}function ed(e,t){if(t.depth>=dt.maxDepth)return t.flags.limited=!0,[];let n=Me(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Mt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function td(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Le("glob"):s!==""||e.quoted&&o.length===0?Zs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of Vs(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Le(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=Vs(f,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=u?Mt(u,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(Jn,...p,Qn);continue}let m=u?Mt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Jn,...m,Qn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Le("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Jn,...m,...c.raw.endsWith(")")?[Le(")")]:[],Qn);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>Le("(")),...d===1?[Jn]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>Le(")")):[],...d===1?[Qn]:[])}return l(),o}function Vs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Yu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Yu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Yu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=kC(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return IC(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&bC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?CC:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function IC(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Vs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function kC(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function OC(e){return/^[\r\n]+$/.test(e)?";":e}function Le(e){return Object.freeze({kind:"operator",operator:e,boundary:gC.has(e)})}function vo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function Zs(e){return Object.freeze({kind:"word",text:e})}function MC(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function nr(e){return EC.has(e)||/^python\d/.test(e)}var DC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function nd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=DC.get(e)?.has(n)??!1;return nd(e,t.slice(r?2:1))}function Ks(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Ks(e.slice(1));if(!pC.has(t))return[...e];return Ks(nd(t,e.slice(1)))}function rd(e){let t=$n(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Ks(n<0?[]:e.words.slice(n).map((r)=>r.text))}function NC(e){let t=rd(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return nr(n)&&!er.has(n)}function qs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return qs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>qs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(NC(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!FC(t))return r;return[...r,...o]})}function LC(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function pt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function WC(e){if(pt(e.words[0],"git"))return pt(e.words[1],"commit");if(!pt(e.words[0],"gh")||!pt(e.words[2],"create"))return!1;return pt(e.words[1],"pr")||pt(e.words[1],"issue")}function FC(e){return(pt(e.words[0],"cat")||pt(e.words[0],"tee")||WC(e))&&!e.words.some(Zu)&&!e.redirections.some((n)=>Zu(n.target))}function Zu(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var od=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),id=new Set([...od,"glob"]),GC=new Set([...id,"pattern"]);class We extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function rr(e){let t=zC(),n=In(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:BC(e),store:t}}function pe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Je(e,t){if(!e.includes("$"))return e;return wi(e,t)}function zC(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Me(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=Ju(i,a);return e.set(i,c),c},getCommandProgram:r}}function BC(e){let t=e.route.kind==="grep"?id:e.route.kind==="glob"?GC:od;return[...bl(e.input,t),...e.route.kind==="patch"?vl(e.input):[]]}var $C=new Set(["-S","--suffix"]);function mn(e,t,n,r,o){if(e.status==="structural-limit")throw new We;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Eo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(fe(i.target,s.variables),s)?i.target:null})}function xo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&$C.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Pe="Git metadata and hooks are protected. Ask the user before modifying them.";function ud(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(wr(e.invocation.toolName))return null;let a=e.paths.find((l)=>sd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=pe(e,"input-candidate");if(!i)return null;let s=mn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>VC(a,l,t,n,r),isRedirectionTarget:(a,l)=>sd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=wo(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Xs(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?_o(m,l):UC(m,l);if(n.markerFiles.some(u))return!0;return r&&ad(n).some(u)}if(Xs(a,n))return!0;return r&&ad(n).some((c)=>_o(c,a))}function UC(e,t){let n=cd(t,e);if(n===""||n.startsWith("..")||ld(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function HC(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function jC(e,t,n,r,o){if(!n)return!1;return Xs(wo(se(e,t,r,o)),n)}function sd(e,t,n,r,o,i){let s=wo(se(e,t,r,o));return i.includes(s)||md(s,n)}function dd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>_o(i,wo(se(s,t,r,o)))))}function Xs(e,t){return t.entries.includes(e)||t.directories.includes(e)||md(e,t)}function md(e,t){return t.hooksDirectories.some((n)=>_o(e,n))}function ad(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function _o(e,t){let n=cd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!ld(n)}function wo(e){return process.platform==="win32"?e.toLowerCase():e}function VC(e,t,n,r,o){if(tr(e))return null;let i=Ot([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=xo(i.slice(1)),a=s.sources.find((l)=>HC(fe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&jC(fe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as ko,normalize as eS,parse as tS,posix as Sd,resolve as Lt,sep as ta}from"path";import{isAbsolute as KC,join as fd,normalize as hd,parse as qC,sep as pd}from"path";var YC=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],ZC=` 	
-`;function or(e,t){if(gt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Js(e.get("TMPDIR")??"",t)}function Nt(e,t){if(e.has("TMPDIR"))return Js(e.get("TMPDIR")??"",t);let n=Qs(e,t);if(n===void 0)return!0;return Js(n,t)}function Qs(e,t){return bd(e,t,"TMPDIR")}function Js(e,t){if(!e)return!1;if(JC(e))return!1;return fn(e,t)}function gt(e,t){let n=bd(e,t,"IFS");return n!==void 0&&n!==""&&n!==ZC}function fn(e,t){let n=Ao(e,t.paths);if(n===null)return!1;return yd(t).some((r)=>Io(n,r))}function To(e,t){let n=Ao(e,t.paths);if(n===null)return!1;return yd(t).some((r)=>Po(r)===Po(n))}var gd=new WeakMap;function yd(e){let t=gd.get(e);if(t)return t;let n=XC(e);return gd.set(e,n),n}function XC(e){let t=YC.map((r)=>Ao(r,e.paths)??hd(r)),n=Ao(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&QC(n))return[...t,n];return t}function JC(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function bd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function QC(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Ao(e,t){try{let n=hd(e);if(!KC(n))return n;let r=qC(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=fd(i,o[s]??"");if(t.entryKind(a)==="missing")return fd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Io(e,t){let n=Po(e),r=Po(t);if(n===r)return!0;let o=r.endsWith(pd)?r:`${r}${pd}`;return n.startsWith(o)}function Po(e){return process.platform==="win32"?e.toLowerCase():e}var nS=process.platform==="win32",Cd=64,rS=16384;function ir(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return C(o.id,o.reason)}function sr(e){let t=uu(e,Cd,Cd,rS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:oS(e)}}function oS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>iS(e.raw,n.span.start-e.span.start))}function iS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Wt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??ye();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:dS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Fe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&fS(e))return{kind:"outside_anchored_cwd"};let o=!r&&Ed(e,t.posixShell);if(Ke(e))return{kind:"outside_anchored_cwd"};if(na(e,r))return{kind:"root_or_home_target"};if(aS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(lS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(mS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&yS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>bS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(CS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(sS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function sS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(ko(r)||r.startsWith("~"))return!1;if(ra(r))return!1;if(Rd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return fn(Lt(t.resolvedCwd,r),t.environment)}function vd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Fe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(uS(i))return!1;if(To(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Rd(r??i,s,t.environment.paths,t.budget))}function na(e,t=!1){let n=e.trim(),r=Sd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function aS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=ko(o)?o:t.resolvedCwd?Lt(t.resolvedCwd,o):null;if(!i)return!1;let s=ge(G(i,t.environment.paths,t.budget));if(s===tS(s).root)return!0;return s===ge(G(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function ge(e){let t=eS(e);if(nS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function lS(e,t,n,r,o,i,s,a){let l=e.trim();if(ra(l))return!1;if(!r&&fn(l,a))return!0;return(t||i&&s)&&n&&!o&&cS(l,n)}function cS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Ed(e.slice(n.length+1),t)})}function uS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Sd.normalize(`/${t[1]??""}`)==="/"}function ra(e){return e.split(/[\\/]+/).includes("..")}function dS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Gn(o.trim(),t);if(!ko(i))return[];try{let s=G(i,n,r);if(zn(s,G(t,n,r)))return[];return[ge(s)]}catch{return[]}})}function mS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(ra(r))return!1;let o=n?r:Gn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=ko(o)?o:i?Lt(i,o):null;if(!s)return!1;try{let a=ge(G(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(ta)?l:`${l}${ta}`))}catch{return!1}}function fS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Ed(e,t=!1){return e.includes("$")||e.includes("`")||pS(e)||t&&gS(e)}function pS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function gS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&hS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function hS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function yS(e,t,n,r){try{return ge(G(e,n,r))===ge(G(t,n,r))}catch{try{return ge(e)===ge(t)}catch{return!1}}}function bS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return ge(G(Lt(t,e),n,r))===ge(G(o,n,r))}catch{try{return ge(Lt(t,e))===ge(o)}catch{return!1}}}function CS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ea(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ea(Lt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ea(Lt(a,e),t,i,s)}catch{return!1}}function ea(e,t,n,r){try{return xd(G(e,n,r),G(t,n,r))}catch{return!1}}function Rd(e,t,n,r){if(!t)return!1;try{return xd(G(t,n,r),G(e,n,r))}catch{return!0}}function xd(e,t){let n=ge(e),r=ge(t);return n.startsWith(`${r}${ta}`)||n===r}var SS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),_d="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",vS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",wd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Ad="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",ES="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",RS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",xS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Ad},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Pe},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:wd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:ES},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:_d},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:vS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:_d}};function Pd(e,t,n,r=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return _S(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function _S(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=AS(o),s=o[i];if(!s||!SS.has(LS(s.text)))return null;let a=wS(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return C("powershell.remove-item-pipeline-dynamic-target",RS);for(let l of a.targets)if(!Ke(l.text)&&na(ia(l.text)))return C(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Ad);for(let l of a.targets)if(n.resolvedCwd&&Dt(ia(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return C("powershell.remove-item-git-metadata",Pe);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return C("powershell.remove-item-recursive-force-dynamic-target",wd);for(let l of a.targets){let c=ir(Fe(ia(l.text),n),n,r,xS);if(c)return c}return null}function wS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(PS(l))continue;if(s){t.push(oa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=IS(l.text);if(!c){t.push(oa(l)),i=i||l.dynamic;continue}if(kS(c.name)){let u=c.value?TS(c.value,l):e[++a];if(u?.kind==="word"){t.push(oa(u)),i=i||u.dynamic;continue}i=!0;continue}if(OS(c.name)){n=!0;continue}if(MS(c.name)){r=!0;continue}if(DS(c.name))o=NS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function AS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function oa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function PS(e){return e.kind==="word"&&e.text===","}function ia(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function TS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function IS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function kS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function OS(e){return"recurse".startsWith(e)}function MS(e){return e.length>=2&&"force".startsWith(e)}function DS(e){return e==="wi"||"whatif".startsWith(e)}function NS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function LS(e){return e.toLowerCase()}var pn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Oo="Unsupported heredoc syntax",Td="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var WS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),FS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),GS=new Set(["-o","--output","--query","--subscription"]),zS=new Set;function Id(e){if(e==="aws")return WS;if(e==="gcloud")return FS;if(e==="az")return GS;return zS}var BS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),$S=new Set;function kd(e){if(e==="git")return Ce;if(e==="docker")return BS;return $S}function Qe(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=de(e);for(let o of t){if(!jS(n,o.command))continue;if(o.match){if(US(n,e,o.match))return Od(o);continue}if(!VS(n,e,o.subcommand))continue;if(qS(e,new Set(o.block_args),r))return Od(o)}return null}function Od(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function US(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return HS(r,n.command_path,Id(e))}function HS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function jS(e,t){return e===M(t)}function VS(e,t,n){if(!n)return!0;return Md(t,1,n,kd(e))}function Md(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&KS(e,i,n,r))return!0;continue}return s===n}return!1}function KS(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Md(e,t+2,n,r)}function qS(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var YS=new Set(["-e","--source"]),ZS=new Set(["-F","-v","--assign","--field-separator"]),Dd=new Set(["-f","--file"]),XS=new Set(["print","printf","return"]),Nd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],JS="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Ld(e,t,n){let r=!1;for(let o of QS(e)){let i=ev(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?C("awk.system-dynamic",JS):null}function aa(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&YS.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(ZS.has(a)||Dd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Dd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function lr(e){return aa(e).sources}function QS(e){return lr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function ev(e,t){Ee(t,e);let n=e.includes("system")?la(e,t):null,r=tv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function la(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Do(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Wd(e,i+1);continue}if(s==="/"&&Fd(e,i)){i=Gd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,ar(e[a-1])||ar(e[i]))continue;let l=Mo(e,i);if(e[l]!=="(")continue;l=Mo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Do(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Mo(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function tv(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=Do(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=Wd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Fd(e,i)){let f=Gd(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(sa(e,i,"print")||sa(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=Mo(e,m);if(sa(e,d,"getline")){o=!0;let f=ov(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(sv(s,a)){o=!0;let f=rv(e,d);if(!f){r=!0,c=m,i=m;continue}if(!nv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function ar(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Mo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function nv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Do(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=iv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function rv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Do(e,t,n)}function ov(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function iv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function sa(e,t,n){return e.startsWith(n,t)&&!ar(e[t-1])&&!ar(e[t+n.length])}function sv(e,t){return t!==null&&t>=e}function Wd(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Fd(e,t){let n=av(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(ar(e[r-1]))r--;return XS.has(e.slice(r,n+1))}function av(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Gd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var lv=new Set(["sudo","env","command","builtin"]);function No(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=cv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function cv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&uv(a,r);if(l)i.push(s);if(!l&&Lr.has(M(a)))break;if(o)break}return i}function uv(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||Qi.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Oe(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return lv.has(e.toLowerCase())}function Gt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Ge(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Lo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Lo(e,t,n,r,o,i,s,a,l){let c=Co(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=bo(c.envSplitValues,u);if(!f)throw new D("derivedCommandShape");ca(a),yield*Lo(f,t,m,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new D("wrapperPeelIterations");let d=No(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])ca(a),yield*Lo(f===d.childIndex?d.tokens:[...u.slice(f)],t,m,r,new Map(o),new Map(i),s,a,!0);return}if(mv(u)){ca(a),yield*Lo([...u.slice(1)],t,m,r,o,i,s,a,l);return}yield dv(u,m,r,o,i,l)}function dv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function ca(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function mv(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ua(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function ze(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||da(r,"recursive")){t=!0;continue}if(r==="-f"||da(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function zd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>da(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function da(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var fv="find -delete permanently removes files. Use -print first to preview.",pv="find -exec rm -rf is dangerous. Use explicit file list instead.",gv=new Set(["-exec","-execdir","-ok","-okdir"]),hv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Bd(e,t){let n=e.map(w),r=yv(e,n,t);if(r)return r;if(Fo(n,1)&&!Cv(e,n,t)){let s=P(C("find.delete",fv),t.policy);if(s)return s}let o=t.budget??ye(),i=0;while(i<n.length){let s=n[i],a=ht(s??"");if(a>0){i+=a+1;continue}if(!et(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=cr(n,i);i=l.nextIndex;let c=vv(l.tokens,t.environment);if(c){let f=P(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=m?.id.startsWith("custom.")?m:P(m,t.policy);if(d)return d}return null}function yv(e,t,n){if(!Fo(t,1)&&!ma(t,n.environment))return null;let o=Wo(e)??K(["."]),i=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=sr(s);for(let l of a.expandedTargets??[w(s)]){let c=Fe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return C("find.delete-git-metadata",Pe)}}if(bv(t)&&i.resolvedCwd&&dd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return C("find.delete-git-metadata",Pe);return null}function ma(e,t){let n=0;while(n<e.length){if(!et(e[n])){n++;continue}let r=cr(e,n),o=Ot([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function bv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function Cv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Wo(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Qs(o,n.environment),s=n.trustedTmpdirValue??Nt(o,n.environment),a=n.allowTmpdirVar??!or(o,n.environment),l=Wt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??gt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=sr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((m)=>vd(m,l,{containmentTarget:Sv(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function Sv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Wo(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function vv(e,t){let n=ft([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&ze(n))return C("find.exec-rm-recursive-force",pv);return null}function cr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Fo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(et(r)){n=cr(e,n).nextIndex;continue}let o=ht(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ht(e){return hv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function et(e){return e!==void 0&&gv.has(e)}import{resolve as KE}from"path";function ur(e){let t=Me(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Ev=5,fa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Ud(e,t,n){let r=Go(e,t,n),o=Rv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Ev;a++){let{subcommand:l,rest:c}=Re(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=Pv(m);if(d===null||d.length===0)return{blockedReason:fa,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:fa,expanded:!0,tokens:i}}function Hd(e,t,n){return Go(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Re(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Ce.has(o)?2:1}return{subcommand:null,rest:[]}}function Rv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Go(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=_v(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...xv(e,t,n)]}}function xv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=pa(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=pa(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=$d(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=$d(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Ce.has(i)){o+=2;continue}o++}return r}function _v(e,t){let n=wv(e,t),r=Av(e,t);return{blockedReason:n===null||r===null?fa:null,entries:[...n??[],...r??[]]}}function wv(e,t){let n=Xe("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=ur(n);if(!o)return null;for(let i of o){let s=pa(i);if(!s)return null;r.push(s)}return r}function Av(e,t){let n=Gu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Xe(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Xe(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function pa(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function $d(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Xe(e.slice(r+1),t,n)}}function Pv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return ur(t)}var Tv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",Iv="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",kv="git checkout --force discards uncommitted changes. Use 'git stash' first.",Ov="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Mv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Dv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",Nv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Lv="git switch --force discards uncommitted changes. Use 'git stash' first.",Wv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Fv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Gv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",zv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Bv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",$v="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Uv="git push --force destroys remote history. Use --force-with-lease for safer force push.",Hv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",jv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Vv="git branch -D force-deletes without merge check. Use -d for safe delete.",Kv="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",qv="git merge --abort discards merge conflict resolutions. Use 'git status' first.",Yv="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Zv="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Xv="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",Jv="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Qv="git worktree remove --force can delete uncommitted changes. Remove --force flag.",eE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),tE=new Set(["--recurse-submodules","--track","-t"]),ga=new Set(["-b","-B","-U"]),ha=new Set(["-c","-C"]),nE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var gn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Vd(e,t){let{subcommand:n,rest:r}=Re(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return yt(rE(r,t));case"switch":return yt(iE(r));case"restore":return yt(aE(r));case"reset":return cE(r);case"clean":return yt(dE(r));case"rm":return yt(mE(r));case"push":return zt(fE(r));case"branch":return zt(hE(r));case"stash":return zt(vE(r));case"worktree":return zt(EE(r));case"rebase":return yt(yE(r));case"merge":return yt(bE(r));case"tag":return zt(CE(r));case"reflog":return zt(SE(r));default:return null}}function yt(e){return e?{...e,localDiscard:!0}:null}function zt(e){return e?{...e,localDiscard:!1}:null}function rE(e,t){let{index:n,before:r}=ie(e),o=de(r,{shortOptsWithValue:ga});if(r.some((a)=>O(a,"--force"))||o.has("-f"))return C("git.checkout-force",kv);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(O(a,"--pathspec-from-file"))return C("git.checkout-pathspec-from-file",Mv)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return C("git.checkout-ref-path",Ov);return C("git.checkout-double-dash",Tv)}let i=sE(e);if(i.length>=2)return C("git.checkout-ambiguous",Dv);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>O(a,"--detach")||O(a,"--track")))return null;if(oE(s)||t(s))return C("git.checkout-double-dash",Iv);return null}function oE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function iE(e){let{before:t}=ie(e);if(t.some((r)=>O(r,"--discard-changes")))return C("git.switch-discard-changes",Nv);let n=de(t,{shortOptsWithValue:ha});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return C("git.switch-force",Lv);return null}function sE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(eE.has(r)){n+=2;continue}if(tE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function aE(e){let t=lE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?C("git.restore-worktree",Fv):C("git.restore-unstaged",Wv)}function lE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(nE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function cE(e){let t=null;for(let n of e){if(O(n,"--hard")){t=C("git.reset-hard",Gv);break}if(O(n,"--merge")){t=C("git.reset-merge",zv);break}}if(!t)return null;return uE(e)?zt(t):yt(t)}function uE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function dE(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return C("git.clean-force",Bv);return null}function mE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?C("git.rm-force",$v):null}function fE(e){let{before:t,after:n}=ie(e),r=de(t);if(t.some((s)=>O(s,"--mirror")))return C("git.push-mirror",jv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||jd(t,n).some(pE))return C("git.push-force",Uv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||jd(t,n).some(gE))return C("git.push-delete",Hv);return null}function jd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function pE(e){return e.startsWith("+")||e.includes(":+")}function gE(e){return e.length>1&&e.startsWith(":")}function hE(e){let{before:t}=ie(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return C("git.branch-force-delete",Vv);return null}function yE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?C("git.rebase-abort",Kv):null}function bE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?C("git.merge-abort",qv):null}function CE(e){let{before:t}=ie(e);return de(t).has("-d")||t.some((r)=>O(r,"--delete"))?C("git.tag-delete",Yv):null}function SE(e){return e[0]==="delete"?C("git.reflog-delete",Zv):null}function vE(e){for(let t of e){if(t==="drop")return C("git.stash-drop",Xv);if(t==="clear")return C("git.stash-clear",Jv)}return null}function EE(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return C("git.worktree-remove-force",Qv);return null}import{dirname as $E,isAbsolute as UE,join as am,resolve as HE}from"path";var ba="TMPDIR",Ca="IFS",qd=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Yd=/^[A-Za-z_][A-Za-z0-9_]*$/,Zd=new Set(["export","typeset","declare","readonly"]),RE=new Set(["builtin","command","time"]),Xd=new Set(["do","then","else"]),xE=new Set(["do","then","case"]),Kd=new Set(["done","fi","esac"]),_E=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Jd(e,t){return e.map((n)=>n.provenance==="variable"&&om(n.text)?dr(n.text,t.shellAssignments):w(n))}function dr(e,t){return e.replace(_E,(n,r,o)=>t.get(r??o??"")??n)}function Qd(e,t){return{env:e,effectiveEnvAssignments:TE(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function em(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Sa(e,t){let n=nm(e,t),r=e[0]??"";if(xE.has(r))t.bodyDepth+=1;if(r==="elif"||Kd.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(Kd.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);va(t,a)});let o=n.commandIndex;if(o!==-1&&Zd.has(e[o]??""))e.filter((a)=>Yd.test(a)&&ya(a)).forEach((a)=>{IE(t,a)});let i=o===-1?-1:rm(e,o);if(i===-1||e[i]!=="unset")return;let s=OE(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(Xd.has(r)){t.shellAssignments.set(a,"");return}kE(t,a)})}function tm(e,t){let n=nm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function nm(e,t){let n=Xd.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!om(a)),o=r!==-1&&Zd.has(e[rm(e,r)]??""),i=PE(t);return{assignments:e.flatMap((a,l)=>{let c=wE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!go(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function rm(e,t){let n=t;while(RE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function om(e){return Ae(e)!==null||qd.test(e)}function wE(e,t,n){return Ae(e)??AE(e,t,n)}function AE(e,t,n){let r=ho(e,n,t);if(r)return r;let o=e.match(qd)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function ya(e){return e===ba||e===Ca||js(e)}function PE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function TE(e,t){let n=[ba,Ca].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function va(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function IE(e,t){va(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function kE(e,t){if(!ya(t)&&!Yd.test(t))return;if(e.shellAssignments.set(t,""),go(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!ya(t)||t===ba||t===Ca||Dn(t)){va(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function OE(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as ME}from"path";function zo(e,t){return Hs.some((n)=>t?.has(n)||e.has(n))}function hn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(ME(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=im(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=im(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Ce.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function im(e,t,n){try{let r=mt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function sm(e,t,n){if(!t.localDiscard||!n.worktreeMode||zo(n.environment.env,n.envAssignments))return null;let r=hn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Ea(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Ea(e,t,n){let{subcommand:r,rest:o}=Re(e),i=r?.toLowerCase();if(t.dynamicArguments||DE(o)||GE(e,t.environment.env,t.envAssignments,n)||WE(o)||NE(i,o))return!0;return i==="clean"&&FE(o)>1}function DE(e){return e.some((t)=>/[$*?[]/.test(t))}function NE(e,t){if(e==="checkout"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:ga}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:ha}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||LE(s))||r.has("-C");return o&&i}return!1}function LE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function WE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function FE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function GE(e,t,n,r){if(Xe("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Go(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>BE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||zE(s.value);if(Bu(n))return!0;return r.recursiveSubmodules}function zE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function BE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function lm(e,t,n){let r=e.map(w),o=n.environment.paths,i=hn(r,n.cwd,o),s=n.originalCwd?o.realpath(HE(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||zo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?VE(e,n.shellAssignments,o):cm(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!jE(a,r,t,n)||!fn(a,n.environment)||To(a,n.environment)||Io(s,a)||Io(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function jE(e,t,n,r){let o=r.environment.paths,i=am(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!Ea(t,r,s)}function VE(e,t,n){let r=Re(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?dr(a,t??new Map):a;if(!UE(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function cm(e,t){if(t.entryKind(am(e,".git"))!=="missing")return e;let n=$E(e);return n===e?null:cm(n,t)}var qE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",YE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Bo(e,t){return um(e,t)}function um(e,t,n){let r=e.map(w),o=Ud(r,t.environment.env,t.envAssignments),i=o.blockedReason?P(C("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((zu(t.envAssignments)||Hd(r,t.environment.env,t.envAssignments))&&ZE(s))return C("git.ssh-env",qE);let a=Vd(s,(c)=>{let u=hn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(KE(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=sm(r,a,t)??lm(e,a,t);if(!l)return a;return n?.(l),null}function dm(e,t){let n=null;return{match:um(e,t,(o)=>{n=o}),relaxation:n}}function ZE(e){let{subcommand:t,rest:n}=Re(e),r=t?.toLowerCase();if(!r)return!1;if(YE.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&XE(n)}function XE(e){return e.find((t)=>!JE(t))?.toLowerCase()==="update"}function JE(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as MR}from"path";function mm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function $o(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var fm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",QE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",eR="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",gm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",tR="rm -rf in home directory is dangerous. Change to a project directory first.",pm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:gm},git_metadata_target:{id:"rm.git-metadata",reason:Pe},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:eR},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:tR},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:fm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:QE},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:fm}};function Uo(e,t){let n=Wt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=ze(r),i=zd(r),s=rR(e);for(let a of s){let l=sr(a.word);if(o&&l.unsafeBraceExpansion){let c=P(ir({kind:"outside_anchored_cwd"},n,t.policy,pm),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=be(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return C("rm.git-metadata",Pe);if(i&&!o){let d=Fe(u,n,m);if(d.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home",gm);if(d.kind==="git_metadata_target")return C("rm.git-metadata",Pe);continue}if(!o)continue;for(let d of nR(u,n,m)){let f=ir(d,n,t.policy,pm),p=P(f,t.policy);if(p)return p}}}return null}function nR(e,t,n){let r=Fe(e,t,n);if(r.kind==="cwd_self_target")return[r,Fe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Fe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Fe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function rR(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var bt={kind:"none"},Bt={kind:"dynamic"},oR=new Set(["<","<<","<<-","<<<","<&","<>"]),ym=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,iR=/^(?:[0-9]+|[@*])$/,sR=dt.maxWords,aR=dt.maxInputLength;function bm(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`?d+2:d+1;s.push(Ns(e,d,y)),d=y;continue}d++;continue}let g=Iu(e,d);if(g){m(),s.push(Ns(e,d,d+g.length)),d+=g.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Tu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Gs(e,d+1,n,r,o+1,!0),S=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(d+1,S),span:{start:d+1,end:S},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(Ns(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,S=y;while(/[ \t]/.test(e[S]??""))S++;let E=S<n?xu(e,S,n,r,o):void 0,v=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:v}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=v,d=v;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Ps({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=xu(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function xu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(p)=>{let g=yb(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),u+=Ls(g.program),m||=g.program.status==="limited",s="command-substitution",g.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||Iu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[f+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=g,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(p==="'"){a=!0,f++;let g=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){g=!0,f++;break}i+=e[f]??"",f++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let g=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){g=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:on(e,t,f,i,s,a,s==="literal"?void 0:bb(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function yb(e,t,n,r,o){let i=Pu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Tu(r.maxDepth)],nodes:[]}),next:a};let l=Gs(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Pu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Ls(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Ls(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Ls(r)}}return t}function bb(e,t,n){let r=no(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Pu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=Cb(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function Cb(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Tu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ws(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ws(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ws)]})}function Iu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function Sb(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function vb(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Ns(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function De(e,t="auto",n=mt){if(t==="powershell"||t==="auto"&&wu(e.slice(0,n.maxInputLength),n))return Fs(e,n);return pu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function an(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function uo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function zs(e,t){return{value:e,work:t}}function b(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function jn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function xe(e,t){jn(e,t)}function It(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Bs(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Y(e))return!1;for(let r=0;r<n.length;r++)if(b(e,t+r)!==n[r])return!1;return!0}function Xe(e,t,n){return!It(b(e,t-1))&&j(e,t,n)&&!It(b(e,t+n.length))}function Je(e,t){return It(b(e,t-1))!==It(b(e,t))}function oe(e){return e===`
+`||e===";"||e==="&"||e==="|"}function ln(e){return e==="|"||e===";"}function mo(e,t,n){let r=zs(e,n);if(t==="rm")return Eb(r);if(t==="dd")return Rb(r);return Lu(r,!0)}function fo(e,t,n){let r=zs(e,n);if(t==="rm")return _b(r);if(t==="reset-hard")return Du(r,"--ha","rd");if(t==="reset-merge")return Du(r,"--me","rge");if(t==="clean")return Tb(r);if(t==="checkout")return kb(r);if(t==="push-force")return Ob(r);if(t==="push-refspec")return Mb(r);if(t==="push-delete")return Db(r);if(t==="branch")return Nb(r);if(t==="tag")return Fb(r);if(t==="restore")return Gb(r);return Lu(r,!1)}function Eb(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=b(e,i);if(!t){let l=b(e,i+2);if(Xe(e,i,"rm")&&H(l)&&l!==`
+`)t=!0,i++;continue}let a=xb(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=ku(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=ku(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function xb(e,t){if(b(e,t)!=="\\"||b(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function ku(e,t,n){if(Ou(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Ou(e,t,n,"force"))return{recursive:!1,force:!0};if(b(e,t)!=="-"||b(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=b(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Ou(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(b(e,t+i+2)!==r[i])return!1;return!0}function Rb(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(b(e,n))){t=!1;continue}if(Xe(e,n,"dd")){t=!0,n++;continue}if(!t||!Xe(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(b(e,r))&&b(e,r)!=="'"&&b(e,r)!=='"')return!0}return!1}function _b(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=b(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=Ab(e,o);if(s>=0){if(wb(e,s))return!0;let a=s,l=!1;while(H(b(e,a)))l||=b(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(b(e,o-1)))&&(!b(e,o+2)||H(b(e,o+2))||oe(b(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&Je(e,o+11)||$s(e,o,"recursive"),r||=j(e,o,"--force")&&Je(e,o+7)||$s(e,o,"force"),n&&r)return!0;o++}return!1}function $s(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=b(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&Je(e,t+r+2)}function wb(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(b(e,n)))n++;let i=n;while(n<Y(e)&&!H(b(e,n)))n++;if(b(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=Mu(e,i,"recursive"),a=Mu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,b(e,i+1)==="-")continue;let l=Pb(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Mu(e,t,n){return j(e,t,`--${n}`)&&Je(e,t+n.length+2)||$s(e,t,n)}function Ab(e,t){if(t>0&&It(b(e,t-1)))return-1;let n=t;if(b(e,n)==="\\")n++;if(b(e,n)!=="r")return-1;if(n++,b(e,n)==="\\")n++;if(b(e,n)!=="m"||!H(b(e,n+1)))return-1;return n+1}function Pb(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(b(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=b(e,c)??"",m=(u==="r"||u==="f")&&Je(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Du(e,t,n){return Kn(e,"reset",ln,!0,(r)=>b(e,r)==="-"&&cn(e,r,t,n)?!0:r)}function Tb(e){return Kn(e,"clean",ln,!0,(t)=>{if(b(e,t)!=="-")return t;if(cn(e,t,"--fo","rce"))return!0;let n=Vn(e,t,ln);for(let r=t+1;r<n;r++)if(b(e,r)==="f")return!0;return n-1})}function po(e,t,n){if(!Xe(e,t,"git"))return null;let r=t+3;if(!H(b(e,r)))return{commandEnd:-1,next:r};while(H(b(e,r)))r++;while(r<Y(e)){if(oe(b(e,r)))return{commandEnd:-1,next:r};let o=Vn(e,r,oe);if(Xe(e,r,n))return{commandEnd:r+n.length,next:o};if(b(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=Ib(e,r,o);r=o;while(H(b(e,r)))r++;if(i)return{commandEnd:Xe(e,r,n)?r+n.length:-1,next:Vn(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(b(e,r)))return{commandEnd:-1,next:r};r=Vn(e,r,oe);while(H(b(e,r)))r++}return{commandEnd:-1,next:r}}function Ib(e,t,n){for(let r of Se)if(n-t===r.length&&j(e,t,r))return!0;return!1}function kb(e){return Nu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function Ob(e){return Kn(e,"push",ln,!0,(t)=>{if(b(e,t)!=="-")return t;if(b(e,t+1)==="f"&&!It(b(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Wu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function Mb(e){return Kn(e,"push",oe,!1,(t)=>{if(H(b(e,t))&&b(e,t+1)==="+"&&t+2<Y(e)&&!oe(b(e,t+2))&&!H(b(e,t+2)))return!0;if(b(e,t)===":"&&b(e,t+1)==="+")return!0;return t})}function Db(e){return Kn(e,"push",oe,!1,(t)=>{if(b(e,t)==="-"&&cn(e,t,"--de","lete"))return!0;if(H(b(e,t))&&b(e,t+1)===":"&&t+2<Y(e)&&!H(b(e,t+2))&&!oe(b(e,t+2)))return!0;return t})}function Nb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(b(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=po(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||b(e,o)!=="-")continue;let i=Vn(e,o,oe),s=Lb(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function Lb(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(b(e,i)!=="-")continue;if(cn(e,i,"--de","lete"))r=!0;if(cn(e,i,"--fo","rce"))o=!0;if(b(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&Wb(b(e,s))){let u=b(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!Je(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function Wb(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function Fb(e){return Nu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Nu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=b(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&b(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=po(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(b(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(cn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(b(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Je(e,r+1))return!0;if(ln(o))i.outerActive=!1}return!1}function Kn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=b(e,s),l=n(a);if(!i&&!l){let c=po(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(b(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(b(e,u)))i=!1;s=c}if(l)i=!1}return!1}function Gb(e){let t=!1;for(let n=0;n<Y(e);n++){if(Bs(b(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=po(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&b(e,n)==="-"&&b(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Lu(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=b(e,r),i=t?Bs(o):oe(o);if(n&&H(o)&&b(e,r+1)==="-"&&Xe(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Xe(e,r,"find"))n=!0,r+=3}return!1}function Vn(e,t,n){let r=t;while(r<Y(e)&&!H(b(e,r))&&!n(b(e,r)))r++;return r}function Wu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&b(e,o)===r[i];i++)o++;return Je(e,o)?o:-1}function cn(e,t,n,r){return Wu(e,t,n,r)>=0}function Ae(e,t){jn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)xe(t,a);if((s.regex?.test(a)??!1)||s.scan&&fo(a,s.scan,t))return C("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var zb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Gu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;jn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return zu(t.nodes,r,i)}function zu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return zu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return Bb(r,t,n)})}function Bb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!zb.test(o.text));return e.words.every((o,i)=>o===t||Fu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Fu(o.target.raw,n.anchored,!0)))}function Fu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as $b,resolve as Bu}from"path";function qn(e,t,n,r){let o=$b(e)?Bu(e):t?Bu(t,e):void 0;if(!o)return;try{return z(o,n,r)}catch{return o}}function $u(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var un="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Yn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Hs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),Ub=new Set(["-p","--print"]),Hb=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),jb=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),Vb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),Kb=new Map([["python",new Set(["m"])]]),qb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),Yb=new Set(["always","default","never"]),Zb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Xb=/\\\r?\n/g,Jb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Uu(e){return ho(e).code}function go(e){return ho(e).sources}function Hu(e){return Jb.get(Vs(e))??[]}function ho(e){let t=Vs(e[0]??"");if(!Hs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&Ub.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(eC(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(tC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=Qb(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(qb.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&Zb.has(s))||t==="python"&&!Yb.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(Kb.get(t)?.has(d)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(Hb.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(jb.get(t)?.has(d)){if(m+1===s.length)i++;break}if(Vb.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function Qb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function js(e,t){return Vs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Vs(e){let t=k(e).toLowerCase();return Lr.test(t)?"python":t}function eC(e,t){return Hs.get(e)?.has(t)??!1}function tC(e){return Hs.get(e)?.has("--eval")??!1}function Zn(e,t,n=!1){let r=oC(e,t);if(!Us(r,t))return!1;xe(t,r);let o=rC(r);if(Us(o,t))return!0;if(xe(t,o),!ju.test(o))return!1;return!n||nC(r,t)}function nC(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let n=e.split(""),r=[];for(let s=0;s<e.length;s++){let a=e[s];if(a!=="'"&&a!=='"')continue;let l=e.startsWith(a.repeat(3),s)?a.repeat(3):a,c=s+l.length,u=c;while(u<e.length&&!e.startsWith(l,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;r.push({start:c,text:e.slice(c,u)}),n.fill(" ",s,u+l.length),s=u+l.length-1}let o=n.join(""),i=Array.from(o.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((s)=>ju.test(s[1]??"")).map((s)=>{let a=s.index+s[0].length;return{start:a,end:Ks(o,a)}});if(i.some((s)=>qs(o,s.start)))return!0;return r.some((s)=>(/\b(?:system|exec|spawn|popen)\s*$/.test(o.slice(0,s.start))||i.some((a)=>s.start>=a.start&&s.start<a.end))&&Us(s.text,t))}function Ks(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function qs(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var ju=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function rC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Us(e,t){if(mo(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(xe(t,e),r.test(e))return!0;if(mo(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(xe(t,e),r.test(e))return!0;if(mo(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(xe(t,e),n.some((o)=>fo(o,r))))}function oC(e,t){return xe(t,e),e.replace(Xb,"")}import{isAbsolute as yd,relative as bd}from"path";import{isAbsolute as Ju,parse as pC}from"path";import{dirname as iC,isAbsolute as sC,parse as aC,sep as lC}from"path";function ft(e,t,n){if(Ze(t))throw Error("Unsupported Windows namespace path");let r=sC(t)?aC(t).root:"",o=r||e;for(let i of uC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=iC(o);continue}let s=cC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function cC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${lC}${t}`}function uC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Ys=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],dC=new Set(Ys),mC=1024,Vu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Ku=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),fC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function yo(e){return dC.has(e)}function Zs(e){return yo(e)||Vu.has(e)||Ku.has(e)||Dn(e)}function Qe(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function qu(e,t){let n=Qe("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=mC?{state:"valid",count:r}:{state:"invalid"}}function bo(e,t,n){let o=e.match(fC)?.[1];if(!o||!Zs(o))return null;let i=e.indexOf("=");return{name:o,value:`${Qe(o,t,n)??""}${e.slice(i+1)}`}}function Yu(e){return Xu(e,Ku)}function Zu(e){return Xu(e,Vu)}function Xu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var ed=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!ed.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Co(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function td(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function kt(e,t,n,r){if(!td(dn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let d=Qu(i),f=Co(i);for(let[g,h]of f.envAssignments)s.set(g,h),a.set(g,h);if(i=f.words,i.length===0)break;while(i.length>0&&dn(i).includes("=")&&!hC(i)){let g=yC(dn(i),a,t.env)??bo(dn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=dn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=CC(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=EC(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=xC(i);if(p==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(Qu(i)===d)break}let u=Co(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:gC(u.words,o)}}function gC(e,t){return e.some((n)=>!t.has(n))}function Qu(e){return e.map(w).join(" ")}function dn(e){let t=e[0];return t?w(t):""}function Le(e,t){let n=e[t];return n?w(n):void 0}function hC(e){return ed.test(dn(e))}function yC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var bC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function CC(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?Xn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Xn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Xn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(bC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var SC=new Set(["-i","-0","--null"]),vC=new Set(["-u","--unset","-C","--chdir","-P"]);function EC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(SC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Le(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(vC.has(c)){if(c==="-C"||c==="--chdir"){let m=Le(e,a+1);s=m?Xn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Xn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(Le(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function Xn(e,t,n){if(t==="")return null;if(!e&&!Ju(t))return null;let r=Ju(t)?pC(t).root:n.realpath(e??"/");if(r===null)return null;try{return ft(r,t,n)}catch{return null}}function xC(e){if(Le(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var RC=/['"\\$`{}#]/;function So(e,t){if(e.some((r)=>RC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function pt(e,t,n){return vo(e,t,n).tokens}function _C(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ot(e,t,n,r=0){let o=vo(e,t,n),i=(o.envSplitValues??[]).flatMap(_C);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ot(s,t,n,r+1)}function vo(e,t,n,r){if(!td(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=kt(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var ea=Symbol("adopt-as-operand"),wC=new Set(["env","sudo","command","builtin"]),AC=new Set(["&&","||","|&","|","&",";"]),PC=new Set(["<<","<<<",">|"]),TC=new Set(["|","|&"]),IC=/[*@#?$!_-]/,kC=/^\w+(?::\w+)*/,OC=Object.freeze([]),Jn=Object.freeze({kind:"scope",edge:"enter"}),Qn=Object.freeze({kind:"scope",edge:"exit"}),MC=Object.freeze([]),DC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),er=new Set(["bash","sh","zsh","dash","ksh"]),NC=256,sd=new WeakMap;function ad(e,t){let n=t.status==="complete"?new Set(Qs(t)):new Set,r=FC(e,n);if(Fr(r))return Eo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Mt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Eo("structural-limit",r,t);if(o.invalid)return Eo("invalid",r,t);let s=Eo("complete",r,t,o.assignmentFallbacks);return sd.set(s,Object.freeze(i)),s}function Ro(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of ld(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=LC(a,s,n,r),c=a.length>0&&TC.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===ea){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function _o(e){return ld(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function LC(e,t,n,r){let o=tr(e)?new Map([...t.variables,...WC(e,t.variables)]):t.variables,i=pt([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function WC(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function ld(e){return sd.get(e)??OC}function FC(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Eo(e,t,n,r=MC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Mt(e,t){return e.nodes.flatMap((n,r)=>GC(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function GC(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(HC(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[xo("{"),...Mt(e.body,a),...s?[xo("}")]:[]]:[Jn,We("("),...Mt(e.body,a),...s?[We(")")]:[],Qn]}]}let o=qC(e,r.functions);if(o){if(r.depth>=mt.maxDepth||++r.flags.expansions>NC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...nd(e,r),xo(";"),...Mt(o,{...r,depth:r.depth+1}),xo(";")]},...rd(e,t,n,r)]}return[{start:e.span.start,events:nd(e,r)},...rd(e,t,n,r)]}function nd(e,t){return[...e.words.map((n)=>({start:n.span.start,events:ud(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:zC(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function zC(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?ud(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ta(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:jC(r),targetOrder:PC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:md(t)}:{}}),...s===void 0?o:o.slice(1)]}function rd(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ta(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...cd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?BC(t,n,r):[]]}function BC(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:cd(n.source.slice(r.span.end,e.span.end),n)}]}function cd(e,t){if(t.depth>=mt.maxDepth)return t.flags.limited=!0,[];let n=De(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Mt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function ud(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?ta(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of Xs(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(We(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=Xs(f,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=u?Mt(u,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(Jn,...p,Qn);continue}let m=u?Mt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Jn,...m,Qn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Jn,...m,...c.raw.endsWith(")")?[We(")")]:[],Qn);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>We("(")),...d===1?[Jn]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>We(")")):[],...d===1?[Qn]:[])}return l(),o}function Xs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=od(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=od(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function od(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=UC(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return $C(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&IC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?kC:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function $C(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Xs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function UC(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function HC(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:AC.has(e)})}function xo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ta(e){return Object.freeze({kind:"word",text:e})}function jC(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function nr(e){return DC.has(e)||/^python\d/.test(e)}var VC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function dd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=VC.get(e)?.has(n)??!1;return dd(e,t.slice(r?2:1))}function Js(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Js(e.slice(1));if(!wC.has(t))return[...e];return Js(dd(t,e.slice(1)))}function md(e){let t=$n(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Js(n<0?[]:e.words.slice(n).map((r)=>r.text))}function KC(e){let t=md(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return nr(n)&&!er.has(n)}function Qs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Qs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Qs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(KC(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!ZC(t))return r;return[...r,...o]})}function qC(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function gt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function YC(e){if(gt(e.words[0],"git"))return gt(e.words[1],"commit");if(!gt(e.words[0],"gh")||!gt(e.words[2],"create"))return!1;return gt(e.words[1],"pr")||gt(e.words[1],"issue")}function ZC(e){return(gt(e.words[0],"cat")||gt(e.words[0],"tee")||YC(e))&&!e.words.some(id)&&!e.redirections.some((n)=>id(n.target))}function id(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var fd=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),pd=new Set([...fd,"glob"]),XC=new Set([...pd,"pattern"]);class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function rr(e){let t=JC(),n=In(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:QC(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function et(e,t){if(!e.includes("$"))return e;return Ai(e,t)}function JC(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=De(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=ad(i,a);return e.set(i,c),c},getCommandProgram:r}}function QC(e){let t=e.route.kind==="grep"?pd:e.route.kind==="glob"?XC:fd;return[...Al(e.input,t),...e.route.kind==="patch"?Il(e.input):[]]}var eS=new Set(["-S","--suffix"]);function mn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Ro(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function wo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&eS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function Cd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Ar(e.invocation.toolName))return null;let a=e.paths.find((l)=>gd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=mn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>oS(a,l,t,n,r),isRedirectionTarget:(a,l)=>gd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Po(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(na(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?Ao(m,l):tS(m,l);if(n.markerFiles.some(u))return!0;return r&&hd(n).some(u)}if(na(a,n))return!0;return r&&hd(n).some((c)=>Ao(c,a))}function tS(e,t){let n=bd(t,e);if(n===""||n.startsWith("..")||yd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function nS(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function rS(e,t,n,r,o){if(!n)return!1;return na(Po(se(e,t,r,o)),n)}function gd(e,t,n,r,o,i){let s=Po(se(e,t,r,o));return i.includes(s)||vd(s,n)}function Sd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Ao(i,Po(se(s,t,r,o)))))}function na(e,t){return t.entries.includes(e)||t.directories.includes(e)||vd(e,t)}function vd(e,t){return t.hooksDirectories.some((n)=>Ao(e,n))}function hd(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Ao(e,t){let n=bd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!yd(n)}function Po(e){return process.platform==="win32"?e.toLowerCase():e}function oS(e,t,n,r,o){if(tr(e))return null;let i=Ot([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=wo(i.slice(1)),a=s.sources.find((l)=>nS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&rS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Mo,normalize as mS,parse as fS,posix as Td,resolve as Lt,sep as sa}from"path";import{isAbsolute as iS,join as Ed,normalize as _d,parse as sS,sep as xd}from"path";var aS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],lS=` 	
+`;function or(e,t){if(ht(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!ra(e.get("TMPDIR")??"",t)}function Nt(e,t){if(e.has("TMPDIR"))return ra(e.get("TMPDIR")??"",t);let n=oa(e,t);if(n===void 0)return!0;return ra(n,t)}function oa(e,t){return Ad(e,t,"TMPDIR")}function ra(e,t){if(!e)return!1;if(uS(e))return!1;return fn(e,t)}function ht(e,t){let n=Ad(e,t,"IFS");return n!==void 0&&n!==""&&n!==lS}function fn(e,t){let n=To(e,t.paths);if(n===null)return!1;return wd(t).some((r)=>Oo(n,r))}function ko(e,t){let n=To(e,t.paths);if(n===null)return!1;return wd(t).some((r)=>Io(r)===Io(n))}var Rd=new WeakMap;function wd(e){let t=Rd.get(e);if(t)return t;let n=cS(e);return Rd.set(e,n),n}function cS(e){let t=aS.map((r)=>To(r,e.paths)??_d(r)),n=To(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&dS(n))return[...t,n];return t}function uS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Ad(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function dS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function To(e,t){try{let n=_d(e);if(!iS(n))return n;let r=sS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Ed(i,o[s]??"");if(t.entryKind(a)==="missing")return Ed(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Oo(e,t){let n=Io(e),r=Io(t);if(n===r)return!0;let o=r.endsWith(xd)?r:`${r}${xd}`;return n.startsWith(o)}function Io(e){return process.platform==="win32"?e.toLowerCase():e}var pS=process.platform==="win32",Pd=64,gS=16384;function ir(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return C(o.id,o.reason)}function sr(e){let t=Cu(e,Pd,Pd,gS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:hS(e)}}function hS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>yS(e.raw,n.span.start-e.span.start))}function yS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Wt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??be();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:xS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&_S(e))return{kind:"outside_anchored_cwd"};let o=!r&&kd(e,t.posixShell);if(Ze(e))return{kind:"outside_anchored_cwd"};if(aa(e,r))return{kind:"root_or_home_target"};if(CS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(SS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(RS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&TS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>IS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(kS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(bS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function bS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Mo(r)||r.startsWith("~"))return!1;if(la(r))return!1;if(Od(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return fn(Lt(t.resolvedCwd,r),t.environment)}function Id(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(ES(i))return!1;if(ko(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Od(r??i,s,t.environment.paths,t.budget))}function aa(e,t=!1){let n=e.trim(),r=Td.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function CS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Mo(o)?o:t.resolvedCwd?Lt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(z(i,t.environment.paths,t.budget));if(s===fS(s).root)return!0;return s===he(z(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=mS(e);if(pS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function SS(e,t,n,r,o,i,s,a){let l=e.trim();if(la(l))return!1;if(!r&&fn(l,a))return!0;return(t||i&&s)&&n&&!o&&vS(l,n)}function vS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!kd(e.slice(n.length+1),t)})}function ES(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Td.normalize(`/${t[1]??""}`)==="/"}function la(e){return e.split(/[\\/]+/).includes("..")}function xS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Gn(o.trim(),t);if(!Mo(i))return[];try{let s=z(i,n,r);if(zn(s,z(t,n,r)))return[];return[he(s)]}catch{return[]}})}function RS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(la(r))return!1;let o=n?r:Gn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Mo(o)?o:i?Lt(i,o):null;if(!s)return!1;try{let a=he(z(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(sa)?l:`${l}${sa}`))}catch{return!1}}function _S(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function kd(e,t=!1){return e.includes("$")||e.includes("`")||wS(e)||t&&AS(e)}function wS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function AS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&PS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function PS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function TS(e,t,n,r){try{return he(z(e,n,r))===he(z(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function IS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(z(Lt(t,e),n,r))===he(z(o,n,r))}catch{try{return he(Lt(t,e))===he(o)}catch{return!1}}}function kS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ia(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ia(Lt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ia(Lt(a,e),t,i,s)}catch{return!1}}function ia(e,t,n,r){try{return Md(z(e,n,r),z(t,n,r))}catch{return!1}}function Od(e,t,n,r){if(!t)return!1;try{return Md(z(t,n,r),z(e,n,r))}catch{return!0}}function Md(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${sa}`)||n===r}var OS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Dd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",MS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Nd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Ld="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",DS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",NS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",LS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Ld},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Te},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Nd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:DS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Dd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:MS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Dd}};function Wd(e,t,n,r=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return WS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function WS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=GS(o),s=o[i];if(!s||!OS.has(qS(s.text)))return null;let a=FS(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return C("powershell.remove-item-pipeline-dynamic-target",NS);for(let l of a.targets)if(!Ze(l.text)&&aa(ua(l.text)))return C(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Ld);for(let l of a.targets)if(n.resolvedCwd&&Dt(ua(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return C("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return C("powershell.remove-item-recursive-force-dynamic-target",Nd);for(let l of a.targets){let c=ir(Ge(ua(l.text),n),n,r,LS);if(c)return c}return null}function FS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(zS(l))continue;if(s){t.push(ca(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=$S(l.text);if(!c){t.push(ca(l)),i=i||l.dynamic;continue}if(US(c.name)){let u=c.value?BS(c.value,l):e[++a];if(u?.kind==="word"){t.push(ca(u)),i=i||u.dynamic;continue}i=!0;continue}if(HS(c.name)){n=!0;continue}if(jS(c.name)){r=!0;continue}if(VS(c.name))o=KS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function GS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function ca(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function zS(e){return e.kind==="word"&&e.text===","}function ua(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function BS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function $S(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function US(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function HS(e){return"recurse".startsWith(e)}function jS(e){return e.length>=2&&"force".startsWith(e)}function VS(e){return e==="wi"||"whatif".startsWith(e)}function KS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function qS(e){return e.toLowerCase()}var pn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Do="Unsupported heredoc syntax",ar="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Fd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var YS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),ZS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),XS=new Set(["-o","--output","--query","--subscription"]),JS=new Set;function Gd(e){if(e==="aws")return YS;if(e==="gcloud")return ZS;if(e==="az")return XS;return JS}var QS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),ev=new Set;function zd(e){if(e==="git")return Se;if(e==="docker")return QS;return ev}function tt(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=me(e);for(let o of t){if(!rv(n,o.command))continue;if(o.match){if(tv(n,e,o.match))return Bd(o);continue}if(!ov(n,e,o.subcommand))continue;if(sv(e,new Set(o.block_args),r))return Bd(o)}return null}function Bd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function tv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return nv(r,n.command_path,Gd(e))}function nv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function rv(e,t){return e===M(t)}function ov(e,t,n){if(!n)return!0;return $d(t,1,n,zd(e))}function $d(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&iv(e,i,n,r))return!0;continue}return s===n}return!1}function iv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return $d(e,t+2,n,r)}function sv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var av=new Set(["-e","--source"]),lv=new Set(["-F","-v","--assign","--field-separator"]),Ud=new Set(["-f","--file"]),cv=new Set(["print","printf","return"]),Hd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],uv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function jd(e,t,n){let r=!1;for(let o of dv(e)){let i=mv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?C("awk.system-dynamic",uv):null}function ma(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&av.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(lv.has(a)||Ud.has(a))){let l=e[s+1];if(i&&=l!==void 0,Ud.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function cr(e){return ma(e).sources}function dv(e){return cr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function mv(e,t){xe(t,e);let n=e.includes("system")?fa(e,t):null,r=fv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function fa(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Lo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Vd(e,i+1);continue}if(s==="/"&&Kd(e,i)){i=qd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,lr(e[a-1])||lr(e[i]))continue;let l=No(e,i);if(e[l]!=="(")continue;l=No(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Lo(e,l,c);if(!u){r=!0,o=!0;continue}if(l=No(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function fv(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=Lo(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=Vd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Kd(e,i)){let f=qd(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(da(e,i,"print")||da(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=No(e,m);if(da(e,d,"getline")){o=!0;let f=hv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(bv(s,a)){o=!0;let f=gv(e,d);if(!f){r=!0,c=m,i=m;continue}if(!pv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function lr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function No(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function pv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Lo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=yv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function gv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Lo(e,t,n)}function hv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function yv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function da(e,t,n){return e.startsWith(n,t)&&!lr(e[t-1])&&!lr(e[t+n.length])}function bv(e,t){return t!==null&&t>=e}function Vd(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Kd(e,t){let n=Cv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(lr(e[r-1]))r--;return cv.has(e.slice(r,n+1))}function Cv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function qd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var Sv=new Set(["sudo","env","command","builtin"]);function Wo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=vv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function vv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&Ev(a,r);if(l)i.push(s);if(!l&&Wr.has(M(a)))break;if(o)break}return i}function Ev(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||es.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return Sv.has(e.toLowerCase())}function Gt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function ze(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Fo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Fo(e,t,n,r,o,i,s,a,l){let c=vo(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=So(c.envSplitValues,u);if(!f)throw new D("derivedCommandShape");pa(a),yield*Fo(f,t,m,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new D("wrapperPeelIterations");let d=Wo(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])pa(a),yield*Fo(f===d.childIndex?d.tokens:u.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(Rv(u)){pa(a),yield*Fo(u.slice(1),t,m,r,o,i,s,a,l);return}yield xv(u,m,r,o,i,l)}function xv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function pa(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function Rv(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ga(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Be(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||ha(r,"recursive")){t=!0;continue}if(r==="-f"||ha(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Yd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>ha(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function ha(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var _v="find -delete permanently removes files. Use -print first to preview.",wv="find -exec rm -rf is dangerous. Use explicit file list instead.",Av=new Set(["-exec","-execdir","-ok","-okdir"]),Pv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Zd(e,t){let n=e.map(w),r=Tv(e,n,t);if(r)return r;if(zo(n,1)&&!kv(e,n,t)){let s=P(C("find.delete",_v),t.policy);if(s)return s}let o=t.budget??be(),i=0;while(i<n.length){let s=n[i],a=yt(s??"");if(a>0){i+=a+1;continue}if(!nt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=ur(n,i);i=l.nextIndex;let c=Mv(l.tokens,t.environment);if(c){let f=P(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=m?.id.startsWith("custom.")?m:P(m,t.policy);if(d)return d}return null}function Tv(e,t,n){if(!zo(t,1)&&!ya(t,n.environment))return null;let o=Go(e)??K(["."]),i=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=sr(s);for(let l of a.expandedTargets??[w(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return C("find.delete-git-metadata",Te)}}if(Iv(t)&&i.resolvedCwd&&Sd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return C("find.delete-git-metadata",Te);return null}function ya(e,t){let n=0;while(n<e.length){if(!nt(e[n])){n++;continue}let r=ur(e,n),o=Ot([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function Iv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function kv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Go(e);if(!r)return!1;let o=n.envAssignments??new Map,i=oa(o,n.environment),s=n.trustedTmpdirValue??Nt(o,n.environment),a=n.allowTmpdirVar??!or(o,n.environment),l=Wt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??ht(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=sr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((m)=>Id(m,l,{containmentTarget:Ov(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function Ov(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Go(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function Mv(e,t){let n=pt([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&Be(n))return C("find.exec-rm-recursive-force",wv);return null}function ur(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function zo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(nt(r)){n=ur(e,n).nextIndex;continue}let o=yt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function yt(e){return Pv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function nt(e){return e!==void 0&&Av.has(e)}import{resolve as ix}from"path";function dr(e){let t=De(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Dv=5,ba="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Jd(e,t,n){let r=Bo(e,t,n),o=Nv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Dv;a++){let{subcommand:l,rest:c}=Re(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=zv(m);if(d===null||d.length===0)return{blockedReason:ba,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:ba,expanded:!0,tokens:i}}function Qd(e,t,n){return Bo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Re(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Se.has(o)?2:1}return{subcommand:null,rest:[]}}function Nv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Bo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=Wv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Lv(e,t,n)]}}function Lv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ca(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ca(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Xd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Xd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Se.has(i)){o+=2;continue}o++}return r}function Wv(e,t){let n=Fv(e,t),r=Gv(e,t);return{blockedReason:n===null||r===null?ba:null,entries:[...n??[],...r??[]]}}function Fv(e,t){let n=Qe("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=dr(n);if(!o)return null;for(let i of o){let s=Ca(i);if(!s)return null;r.push(s)}return r}function Gv(e,t){let n=qu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Qe(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Qe(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ca(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Xd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Qe(e.slice(r+1),t,n)}}function zv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return dr(t)}var Bv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",$v="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",Uv="git checkout --force discards uncommitted changes. Use 'git stash' first.",Hv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",jv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Vv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",Kv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",qv="git switch --force discards uncommitted changes. Use 'git stash' first.",Yv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Zv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Xv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Jv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Qv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",eE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",tE="git push --force destroys remote history. Use --force-with-lease for safer force push.",nE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",rE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",oE="git branch -D force-deletes without merge check. Use -d for safe delete.",iE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",sE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",aE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",lE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",cE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",uE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",dE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",mE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),fE=new Set(["--recurse-submodules","--track","-t"]),Sa=new Set(["-b","-B","-U"]),va=new Set(["-c","-C"]),pE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var gn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function tm(e,t){let{subcommand:n,rest:r}=Re(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return bt(gE(r,t));case"switch":return bt(yE(r));case"restore":return bt(CE(r));case"reset":return vE(r);case"clean":return bt(xE(r));case"rm":return bt(RE(r));case"push":return zt(_E(r));case"branch":return zt(PE(r));case"stash":return zt(ME(r));case"worktree":return zt(DE(r));case"rebase":return bt(TE(r));case"merge":return bt(IE(r));case"tag":return zt(kE(r));case"reflog":return zt(OE(r));default:return null}}function bt(e){return e?{...e,localDiscard:!0}:null}function zt(e){return e?{...e,localDiscard:!1}:null}function gE(e,t){let{index:n,before:r}=ie(e),o=me(r,{shortOptsWithValue:Sa});if(r.some((a)=>O(a,"--force"))||o.has("-f"))return C("git.checkout-force",Uv);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(O(a,"--pathspec-from-file"))return C("git.checkout-pathspec-from-file",jv)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return C("git.checkout-ref-path",Hv);return C("git.checkout-double-dash",Bv)}let i=bE(e);if(i.length>=2)return C("git.checkout-ambiguous",Vv);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>O(a,"--detach")||O(a,"--track")))return null;if(hE(s)||t(s))return C("git.checkout-double-dash",$v);return null}function hE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function yE(e){let{before:t}=ie(e);if(t.some((r)=>O(r,"--discard-changes")))return C("git.switch-discard-changes",Kv);let n=me(t,{shortOptsWithValue:va});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return C("git.switch-force",qv);return null}function bE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(mE.has(r)){n+=2;continue}if(fE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function CE(e){let t=SE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?C("git.restore-worktree",Zv):C("git.restore-unstaged",Yv)}function SE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(pE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function vE(e){let t=null;for(let n of e){if(O(n,"--hard")){t=C("git.reset-hard",Xv);break}if(O(n,"--merge")){t=C("git.reset-merge",Jv);break}}if(!t)return null;return EE(e)?zt(t):bt(t)}function EE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function xE(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return C("git.clean-force",Qv);return null}function RE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?C("git.rm-force",eE):null}function _E(e){let{before:t,after:n}=ie(e),r=me(t);if(t.some((s)=>O(s,"--mirror")))return C("git.push-mirror",rE);if(t.some((s)=>O(s,"--force"))||r.has("-f")||em(t,n).some(wE))return C("git.push-force",tE);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||em(t,n).some(AE))return C("git.push-delete",nE);return null}function em(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function wE(e){return e.startsWith("+")||e.includes(":+")}function AE(e){return e.length>1&&e.startsWith(":")}function PE(e){let{before:t}=ie(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return C("git.branch-force-delete",oE);return null}function TE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?C("git.rebase-abort",iE):null}function IE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?C("git.merge-abort",sE):null}function kE(e){let{before:t}=ie(e);return me(t).has("-d")||t.some((r)=>O(r,"--delete"))?C("git.tag-delete",aE):null}function OE(e){return e[0]==="delete"?C("git.reflog-delete",lE):null}function ME(e){for(let t of e){if(t==="drop")return C("git.stash-drop",cE);if(t==="clear")return C("git.stash-clear",uE)}return null}function DE(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return C("git.worktree-remove-force",dE);return null}import{dirname as ex,isAbsolute as tx,join as hm,resolve as nx}from"path";var xa="TMPDIR",Ra="IFS",rm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,om=/^[A-Za-z_][A-Za-z0-9_]*$/,im=new Set(["export","typeset","declare","readonly"]),NE=new Set(["builtin","command","time"]),sm=new Set(["do","then","else"]),LE=new Set(["do","then","case"]),nm=new Set(["done","fi","esac"]),WE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function am(e,t){return e.map((n)=>n.provenance==="variable"&&fm(n.text)?mr(n.text,t.shellAssignments):w(n))}function mr(e,t){return e.replace(WE,(n,r,o)=>t.get(r??o??"")??n)}function lm(e,t){return{env:e,effectiveEnvAssignments:BE(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function cm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function _a(e,t){let n=dm(e,t),r=e[0]??"";if(LE.has(r))t.bodyDepth+=1;if(r==="elif"||nm.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(nm.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);wa(t,a)});let o=n.commandIndex;if(o!==-1&&im.has(e[o]??""))e.filter((a)=>om.test(a)&&Ea(a)).forEach((a)=>{$E(t,a)});let i=o===-1?-1:mm(e,o);if(i===-1||e[i]!=="unset")return;let s=HE(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(sm.has(r)){t.shellAssignments.set(a,"");return}UE(t,a)})}function um(e,t){let n=dm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function dm(e,t){let n=sm.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!fm(a)),o=r!==-1&&im.has(e[mm(e,r)]??""),i=zE(t);return{assignments:e.flatMap((a,l)=>{let c=FE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!yo(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function mm(e,t){let n=t;while(NE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function fm(e){return Pe(e)!==null||rm.test(e)}function FE(e,t,n){return Pe(e)??GE(e,t,n)}function GE(e,t,n){let r=bo(e,n,t);if(r)return r;let o=e.match(rm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Ea(e){return e===xa||e===Ra||Zs(e)}function zE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function BE(e,t){let n=[xa,Ra].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function wa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function $E(e,t){wa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function UE(e,t){if(!Ea(t)&&!om.test(t))return;if(e.shellAssignments.set(t,""),yo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Ea(t)||t===xa||t===Ra||Dn(t)){wa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function HE(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as jE}from"path";function $o(e,t){return Ys.some((n)=>t?.has(n)||e.has(n))}function hn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(jE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=pm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=pm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Se.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function pm(e,t,n){try{let r=ft(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function gm(e,t,n){if(!t.localDiscard||!n.worktreeMode||$o(n.environment.env,n.envAssignments))return null;let r=hn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Aa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Aa(e,t,n){let{subcommand:r,rest:o}=Re(e),i=r?.toLowerCase();if(t.dynamicArguments||VE(o)||XE(e,t.environment.env,t.envAssignments,n)||YE(o)||KE(i,o))return!0;return i==="clean"&&ZE(o)>1}function VE(e){return e.some((t)=>/[$*?[]/.test(t))}function KE(e,t){if(e==="checkout"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:Sa}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:va}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||qE(s))||r.has("-C");return o&&i}return!1}function qE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function YE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function ZE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function XE(e,t,n,r){if(Qe("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Bo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>QE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||JE(s.value);if(Zu(n))return!0;return r.recursiveSubmodules}function JE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function QE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function ym(e,t,n){let r=e.map(w),o=n.environment.paths,i=hn(r,n.cwd,o),s=n.originalCwd?o.realpath(nx(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||$o(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?ox(e,n.shellAssignments,o):bm(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!rx(a,r,t,n)||!fn(a,n.environment)||ko(a,n.environment)||Oo(s,a)||Oo(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function rx(e,t,n,r){let o=r.environment.paths,i=hm(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!Aa(t,r,s)}function ox(e,t,n){let r=Re(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?mr(a,t??new Map):a;if(!tx(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function bm(e,t){if(t.entryKind(hm(e,".git"))!=="missing")return e;let n=ex(e);return n===e?null:bm(n,t)}var sx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",ax=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Uo(e,t){return Cm(e,t)}function Cm(e,t,n){let r=e.map(w),o=Jd(r,t.environment.env,t.envAssignments),i=o.blockedReason?P(C("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Yu(t.envAssignments)||Qd(r,t.environment.env,t.envAssignments))&&lx(s))return C("git.ssh-env",sx);let a=tm(s,(c)=>{let u=hn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(ix(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=gm(r,a,t)??ym(e,a,t);if(!l)return a;return n?.(l),null}function Sm(e,t){let n=null;return{match:Cm(e,t,(o)=>{n=o}),relaxation:n}}function lx(e){let{subcommand:t,rest:n}=Re(e),r=t?.toLowerCase();if(!r)return!1;if(ax.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&cx(n)}function cx(e){return e.find((t)=>!ux(t))?.toLowerCase()==="update"}function ux(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as jx}from"path";function vm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Ho(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Em="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",dx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",mx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Rm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",fx="rm -rf in home directory is dangerous. Change to a project directory first.",xm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Rm},git_metadata_target:{id:"rm.git-metadata",reason:Te},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:mx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:fx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Em},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:dx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Em}};function jo(e,t){let n=Wt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Be(r),i=Yd(r),s=gx(e);for(let a of s){let l=sr(a.word);if(o&&l.unsafeBraceExpansion){let c=P(ir({kind:"outside_anchored_cwd"},n,t.policy,xm),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=Ce(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return C("rm.git-metadata",Te);if(i&&!o){let d=Ge(u,n,m);if(d.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home",Rm);if(d.kind==="git_metadata_target")return C("rm.git-metadata",Te);continue}if(!o)continue;for(let d of px(u,n,m)){let f=ir(d,n,t.policy,xm),p=P(f,t.policy);if(p)return p}}}return null}function px(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function gx(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},Bt={kind:"dynamic"},hx=new Set(["<","<<","<<-","<<<","<&","<>"]),wm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,yx=/^(?:[0-9]+|[@*])$/,bx=mt.maxWords,Cx=mt.maxInputLength;function Am(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Ho(e){let t=mr(e[1])==="--"?2:1;if(e.length<=t)return bt;let n=e.slice(t);if(!n.every(Vo))return Bt;return{kind:"literal",source:n.map(w).join(" ")}}function Cm(e){let t=mr(e[1])==="--"?2:1,n=e[t],r=mr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return bt;if(!Vo(n))return Bt;return{kind:"literal",source:r}}function jo(e,t){let n=cR(e);if(n===-1)return bt;let r=uR(t);if(!r)return bt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=mR(s,e,n,r.ifs);if(!a)return Bt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>sR||i>aR)return Bt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(pR)].filter((s)=>s!==null).join(" ")}}function Sm(e,t,n,r){if(!Se(e.map(w)).readsStdinAsCommands)return bt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&oR.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return bt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Bt;return{kind:"literal",source:o.target.text}}if(!n)return bt;return r===void 0?Bt:{kind:"literal",source:r}}function tt(e){let t=Se(e.map(w)).scriptIndex;if(t===null)return bt;let n=e[t],r=mr(n);return lo(n,r)?{kind:"literal",source:r}:Bt}var lR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function wa(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Ae(s)!==null)return!1;let a=k(M(s));return!lR.has(a)&&!J.has(a)&&!Ft(a)}function cR(e){return Se(e.map(w)).commandIndex??-1}function uR(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(dR);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function dR(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function mR(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ra(o):fR(o,r);if(e.parameter==="*"){let a=Ra(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:xa(l,r)}let i=t[n+1+e.parameter];if(i&&!Vo(i))return;let s=mr(i);return e.quoted?[s]:xa(s,r)}function Ra(e){return e.every(Vo)?e.map(w):void 0}function fR(e,t){let n=Ra(e);if(!n)return;let r=n.map((o)=>xa(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function xa(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Vo(e){let t=fr(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(qo))return Bt;return{kind:"literal",source:n.map(w).join(" ")}}function Pm(e){let t=fr(e[1])==="--"?2:1,n=e[t],r=fr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!qo(n))return Bt;return{kind:"literal",source:r}}function Ko(e,t){let n=vx(e);if(n===-1)return Ct;let r=Ex(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Rx(s,e,n,r.ifs);if(!a)return Bt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>bx||i>Cx)return Bt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(wx)].filter((s)=>s!==null).join(" ")}}function Tm(e,t,n,r){if(!ve(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&hx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Bt;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?Bt:{kind:"literal",source:r}}function rt(e){let t=ve(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=fr(n);return uo(n,r)?{kind:"literal",source:r}:Bt}var Sx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ka(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=k(M(s));return!Sx.has(a)&&!J.has(a)&&!Ft(a)}function vx(e){return ve(e.map(w)).commandIndex??-1}function Ex(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(xx);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function xx(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Rx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Pa(o):_x(o,r);if(e.parameter==="*"){let a=Pa(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Ta(l,r)}let i=t[n+1+e.parameter];if(i&&!qo(i))return;let s=fr(i);return e.quoted?[s]:Ta(s,r)}function Pa(e){return e.every(qo)?e.map(w):void 0}function _x(e,t){let n=Pa(e);if(!n)return;let r=n.map((o)=>Ta(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ta(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Vo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function mr(e){return e?w(e):""}function pR(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Aa(e,t){return _a(Me(e,"posix"),t)}function pr(e){return Aa(e,new Set(Array.from(e.matchAll(ym)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function _a(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(_a(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>_a(o,n))||vm(r.words,n))return!0;CR(r,n)}return!1}function vm(e,t){let n=e.findIndex((s)=>Ae(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(fr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return hm(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Se(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&hm(s[l],t)}let i=gR(e,n,t);if(i===null)return!1;if(i===-1)return!0;return vm(e.slice(i),t)}function gR(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return hR(e,t+1);if(r==="exec")return yR(e,t+1);if(r==="env")return bR(e,t+1,n);return null}function hR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function yR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function bR(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return fr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return fr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Ae(i))continue;return r}return null}function CR(e,t){if(!e.words.every((n)=>Ae(n.text)!==null))return;for(let n of e.words){let r=Ae(n.text);if(!r)continue;if(fr(n,t))t.add(r.name)}}function fr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(ym)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(iR.test(o)||t.has(o))}))}function hm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||fr(e,t))}var SR=["--init-file","--rcfile"],vR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function nt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Em(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Em(e,t,!1);if(r!==null)return r}}return null}function rt(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Se(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Em(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Rm(e){let t=k(e[0]??"").toLowerCase(),n=ER(e,t),r=vR.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function ER(e,t){let n=Se(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?SR.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Xi.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Ji(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var Pa="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Ta="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",RR="__CC_SAFETY_NET_XARGS_INPUT__",Ko="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",qo="rm",xR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,_R=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,wR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,AR=/^(?:[0-9]+|[@*])$/;function wm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=$t(n),i=n.slice(r),s=C("xargs.shell-dynamic",Ta);if(TR(i,o,t)&&P(s,t.policy))return P(s,t.policy);for(let a of Ge(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?P(s,t.policy):null;if(c)return c;let u=km(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&Tm(l,o),d=t.analyzeChild(l,{...Gt(a,t),dynamicInput:u,dynamicSourceInput:m||Pm(l,a.head,o,a.wrapperEnvAssignments,u,t.environment),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:C("xargs.rm-recursive-force-dynamic",Pa)});if(d)return d;let f=PR(l,o,t.policy?.rules??[],P(s,t.policy));if(f)return f;if(a.head==="git"){let h=o===null?[...l,RR]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...Gt(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=Qe(l,t.policy?.rules??[]);if(p)return p}return null}function PR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=Qe([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Am(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=mm(e,r,t.length,n);return o===null?[]:[o]}function Pm(e,t,n,r,o,i){if(J.has(t)){if(rt(e))return!1;if(n!==null&&IR(e,n))return!0;let s=nt(e);if(!s){let a=tt(K(e));if(a.kind==="literal")return n!==null&&a.source.includes(n);return a.kind==="none"&&o}if(n!==null&&s.includes(n))return!0;if(Ze(s))return!0;return kR(s,n,r)}if(Oe(t))return xm(e,n,po,Lu(t));if(we.has(t))return xm(e,n,aa,Nd);if(t==="eval"){let s=Ho(K(e));if(s.kind==="dynamic")return!0;if(n!==null)return s.kind==="literal"&&s.source.includes(n);return o}if(t==="find")return OR(e,n,i);if(t==="git"){let s=Re(e);return n===null?s.subcommand===null:(s.subcommand?.includes(n)??!1)||s.subcommand!==null&&gn.has(s.subcommand.toLowerCase())&&Im(s.rest,n).some((a)=>a.includes(n))}return!1}function xm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Ko]).sources.some((a)=>a.value===Ko);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Ko}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Ko}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Am(l,t,a))));return $o(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function TR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Ge(e,n),(i)=>i.head)),o=t===null?[...e,qo]:e.map((i,s)=>s===0?i:i.replaceAll(t,qo));return Array.from(Ge(o,n)).some((i)=>i.head===qo&&!r.has(qo))}function Tm(e,t){return Im(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Im(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function km(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function IR(e,t){let n=Se(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return Am(i,t,o).some((l)=>{let c=e.map((m,d)=>d===s?m.replaceAll(t,l):m),u=Se(c);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(n.commandIndex===null&&u.commandIndex!==null)return!0;if(n.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(c[u.commandIndex]??"").includes(l))return!0;return u.scriptIndex!==null&&(c[u.scriptIndex]??"").includes(l)})}))}function kR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(xR))if(_m(o,r))return!0;for(let o of e.matchAll(_R))for(let i of(o[1]??"").matchAll(wR))if(_m(i,r))return!0;return Aa(e,r)}function _m(e,t){let n=e[1]??e[2];return n!==void 0&&(AR.test(n)||t.has(n))}function OR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(et(s)){let l=cr(e,i);i=l.nextIndex-1;for(let c of Ge(l.tokens,{environment:n,cwd:void 0})){let u=km(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Tm(c.tokens,t)||Pm(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=ht(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function $t(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var gr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",hr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",DR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",NR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Zo=/\{[^{}\s]*\}/g,Om=/\{\}|\{-?\d+\}/g,LR=["e","f","source","file","-e","-f","--source","--file"],WR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],FR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),GR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Mm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),zR=new Set(["--workdir","--wd"]),Dm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Te(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Gm(e){return Te([...e],(t)=>Ze(t))}function zm(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=yn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Ym(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=yn(t);if(p)return p;let h=Gm(t.envAssignments?.values()??[]);if(h)return h}if(l){let p=VR(t);if(p)return p}if(u!==void 0&&a){let p=yn(t);if(p)return p}let d=KR(u,t.cwd,t.environment.paths);if(d===null){let p=yn(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...Ge(i,f)].flatMap((h)=>[...h.envAssignments.values()]).some(Oa)){let h=yn(t);if(h)return h}return null}if(i.length===0){let p=s.map((g)=>g[0]??"");t.budget.charge("derivedTokens",p.length);let h=Hm(f.envAssignments,f.cwd,a);return Te(p,(g)=>t.analyzeNested(g,h))}return Te(Ge(i,f),(p)=>BR(p,o,t,f))}function BR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(Km)){let g=yn(n);if(g)return g}let u=Gm(c);if(u)return u;let m=c.some(F),d=i||m,f=a&&d,p=Hm(e.envAssignments,e.wrapperCwd,s||f);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Te(o,(E)=>n.analyzeChild(Yo(l,E,n.budget),Gt(e,r)))};if(rt(l))return g();let y=nt(l);if(y){if(qm(y)){let R=Ct(n);if(R)return R;if(o.length===0)return null;return Te(o,(A)=>n.analyzeNested(Wm(y,A,n.budget),p))}if(F(y)){if(o.length>0)return Te(o,(q)=>n.analyzeNested(Wm(y,q,n.budget),p));let R=ur(y);if(R?.[0]&&M(R[0])==="rm"&&ze(R)){let q=Lm(n);if(q)return q}let A=R?n.analyzeChild(R,{...Gt(e,r),dynamicInput:a,shellDynamicMatch:C("parallel.shell-dynamic",hr),rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",gr)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((R)=>jo(K(R===void 0?l:i?l.map((A)=>jm(A,R)):[...l,...R]),y)):[];if(E.some((R)=>R.kind==="dynamic")){let R=Ct(n);if(R)return R}let S=E.flatMap((R)=>R.kind==="literal"?[R.source]:[]);if(S.length>0)return n.budget.charge("derivedTokens",S.length),Te(S,(R)=>n.analyzeNested(R,p));if(pr(y)){let R=Ct(n);if(R)return R}let T=n.analyzeNested(y,p);if(T)return T;if(d)return Ct(n);return null}let v=tt(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&F(v.source))return Ct(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=Ct(n);if(E)return E;let S=g();if(S)return S;if(i)return null;let T=o.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return n.budget.charge("derivedTokens",T.length),Te(T,(R)=>n.analyzeNested(R,p))}if(d||a)return Ct(n)??g();return null}if(e.head==="rm"&&ze(l)){if(i&&o.length>0)return Te(o,(y)=>Ia(Yo(l,y,n.budget,Om),e.cwd,r));if(o.length>0)return Te(o,(y)=>Ia(Fm(l,y,n.budget),e.cwd,r));let g=Ia(l.flatMap((y,v)=>{if(v===0||!F(y))return[y];return y.startsWith("-")?[y.replace(Om,"")]:[]}),e.cwd,r);if(g)return g;return Lm(n)}let h=o.length>0?o:[void 0];return Te(h,(g)=>{let y=g===void 0?l:i?Yo(l,g,n.budget):Fm(l,g,n.budget),v=C("parallel.shell-dynamic",hr),E=a&&e.head==="find"?jR(y,r):null,S=$m(y,a,n)??E?.customResult??null,T=M(e.head),R=a&&(T==="rm"&&ka(y)||T==="xargs"&&Um(y)||E?.rmOptions===!0),A=a&&(R||E?.executedSource===!0||E===null&&Bm(y,T)),q=n.analyzeChild(y,{...Gt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:R,dynamicSourceInput:S!==null||A,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",gr)});if(A){let Z=P(v,n.policy);if(Z)return Z}return q??S??Qe(y,n.policy?.rules??[])})}function Bm(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return HR(e);if(t==="git")return $R(e);if(t==="find")return!0;if(we.has(t))return Nm(e,LR,lr);if(Oe(t))return Nm(e,WR,fo);return!1}function ka(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||qm(o)))}function $R(e){if(UR(e))return!0;let t=Re(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!gn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function UR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function HR(e){if(rt(e))return!1;let t=nt(e);if(t!==null)return F(t);let n=tt(K(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function Nm(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,Dm]).some((o)=>o.value===Dm);return $o(r,t,(o)=>n(e.map((i)=>jm(i,[o]))))}function $m(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return Ct(n);return Te(o,(i)=>Qe([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function jR(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of Ge(i,t))n.executedSource||=Bm(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&ka(a.tokens)||a.head==="xargs"&&Um(a.tokens),n.customResult??=$m(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(et(a)){i=[],n.executedSource||=F(a);continue}let l=ht(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function Um(e){let t=e.slice($t(e).childStart);return M(t[0]??"")==="rm"&&ka(t)}function Xo(e,t){return(n)=>P(C(e,t),n.policy)}var Ct=Xo("parallel.shell-dynamic",hr),VR=Xo("parallel.command-stream-dynamic",DR),yn=Xo("parallel.command-stream-dynamic",NR),Lm=Xo("parallel.rm-recursive-force-dynamic",gr);function Ia(e,t,n){return P(Uo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Nt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Hm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function jm(e,t){return e.replace(Zo,(n)=>Vm(n,t))}function Yo(e,t,n,r=Zo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Vm(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Wm(e,t,n){return Yo([e],t,n)[0]??""}function Fm(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Vm(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(Zo)!==-1}function Km(e){if(Oa(e))return!0;for(let t of e.matchAll(Zo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Oa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function qm(e){return/^\{[^{}\s]*\}$/.test(e)}function KR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!MR(e))return null;try{return mt(t??e,e,n)}catch{return null}}function Ym(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ua(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ua(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||GR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(Mm.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=Mm.has(p)?2:1;continue}if(zR.has(y)){c=!0;let E=v??h;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(FR.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Oa:Km);let u=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){u.push(p),p=[];continue}if(g!==void 0)p.push(g)}u.push(p)}c||=u.length>1;let m=qR(u),d=n.some(F),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function qR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");o.push([...i,s])}t=o}return t}function Zm(e){return Ym(e).childStart}var YR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Jo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Da(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ma(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Jm(e,t,n,r,o=!1,i){let a=(Bn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?C("shell.dynamic-executable",YR):null;return P(a,i)??Qm(e,t,n,o,i)}function Qm(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Da(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=an(e,t),l=XR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return P(C("shell.dynamic-structure",Jo),o);if(P(Bo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&gn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return P(C("shell.dynamic-structure",Jo),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&JR(t)?P(C("shell.dynamic-structure",Jo),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=ze(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?P(C("shell.dynamic-structure",Jo),o):null}if(s==="xargs")return Xm(e,t.slice($t(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return Xm(e,t.slice(Zm(t.map(w))),"parallel",n,r,o);return null}function Xm(e,t,n,r,o,i){if(t.length===0)return null;let s=ZR(t,r);if(Bn(e,s)){let l=P(C(`${n}.shell-dynamic`,n==="xargs"?Ta:hr),i);if(l)return l}let a=Qm(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Da(l)&&Ma(l)))return P(C(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Pa:gr),i);return null}function ZR(e,t){let n=kt(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function XR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(Ce.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function JR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Da(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ma(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ma(s)))return!0;continue}if(t=!0,a)return!0;let l=ht(s.text);if(l>0){n=l;continue}if(et(s.text))o=!0,r=!0}return!1}function Na(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!lo(t[n.tokenIndex],n.value)})}var QR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",ex="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",tx="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function ef(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return C("dd.device-write",QR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return C("mkfs.device",ex);if(e==="shred"&&n.length>0)return C("shred.target",tx);return null}var nf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Uo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Bo(e.words,La(e))},{heads:new Set(["find"]),analyze:(e)=>Bd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>wm(e.words,{...tf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>zm(e.words,{...tf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})}];function tf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ut(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function La(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var af="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function lf(e){return nf.find((t)=>t.heads.has(e))?.analyze}function Cn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=yo(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=kt(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let x=[...p,...i(f.words)].join(" "),I=Ze(x);if(I)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:I.reason}),ue(I);if(n.strict)return he(r);let L=bo(p,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(te)return te}}let h=f.rewritten?K(i(f.words)):an(o,f.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>h.length){let x=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),E=g[0];if(!E)return null;if(Ft(E))throw new D("wrapperPeelIterations");let S=M(E),T=f.cwd===null?void 0:f.cwd??u,R=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,q=s?s.allowTmpdirVar:!or(v,n.environment),Z=Jm(o,f.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),ue(Z);let ee=No(g,n.policy);if(ee){for(let x of[ee.childIndex,...ee.alternativeChildIndices]){rf(y.wrapperNormalizationBudget);let I=h.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=Cn(I,t,{...y,effectiveCwd:A,envAssignments:v});if(L)return L}return null}let X=l?void 0:S==="eval"?Ho(h):S==="trap"&&!a?Cm(h):void 0;if(a&&s&&S==="eval"){if(X?.kind==="dynamic")return bn(s,n.policy);if(X?.kind==="literal"){let x=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:v});if(x)return x}return Sn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!wa(n.commandView)))return he(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:S==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let x=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:v,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?J.has(S):uf(E,S)){if(rt(g))return null;if(a&&s){let x=nt(g);if(x){if(s.dynamicSourceInput??s.dynamicInput){let L=bn(s,n.policy);if(L)return L}if(pr(x)){let L=bn(s,n.policy);if(L)return L}return n.analyzeNested(x,{effectiveCwd:A,envAssignments:v})}let I=tt(h);if(I.kind==="dynamic")return bn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?bn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?bn(s,n.policy):null}if(l){let x=nt(g),I=x?n.analyzeNested(x,{effectiveCwd:A,envAssignments:v}):tt(h).kind==="dynamic"?he(r):null;if(I)return I}if(s===void 0){let x=ix(g,v,A,n,r,t);if(x)return x;let I=nt(g);if(I){let qt=jo(h,I);if(qt.kind==="dynamic")return he(r);let hi=qt.kind==="literal"?qt.source:I,al=sx(hi);r?.recordSegment({type:"shell-wrapper",wrapper:S,innerCommand:al}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:al,depth:t+1});let ll=n.analyzeNested(hi,{effectiveCwd:A,envAssignments:v});if(ll)return ll;return pr(hi)?he(r):null}let L=tt(h);if(L.kind==="dynamic")return he(r);if(L.kind==="literal")return Qo(L.source,A,v,n,r,t);let te=Sm(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return he(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:A,envAssignments:v})}}if(!s&&(S==="source"||S===".")){let x=g[1]==="-p"?2:null;if(x!==null){let qt=n.commandView?h[x]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return he(r)}let I=x===null?1:3,L=g[I]==="--"?I+1:I,te=n.commandView?h[L]:void 0;if(!te)return null;if(te.provenance==="literal")return Qo(te.text,A,v,n,r,t);if(n.strict||!n.commandView||!wa(n.commandView))return he(r)}if(we.has(S)&&!l){if(!s&&n.strict&&Na(lr(g),h))return he(r);let x=Ld(g,(L)=>Ut(n.analyzeNested(L,{effectiveCwd:A,envAssignments:v}))),I=P(x,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),ue(I)}if(Oe(S)&&!l){if(!s&&n.strict&&Na(fo(g),h))return he(r);let x=Nu(g);if(a&&s)return rx(S,x,A,v,n,s);if(x){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:S,codeArg:x,paranoidBlocked:I}),I){let te=P(C("interpreter.one-liner-paranoid",Yn),n.policy);if(te)return ue(te)}if($s(S,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let L=n.analyzeNested(x,{effectiveCwd:A,envAssignments:v});if(L&&!cf(L,x))return L;if(Zn(x)){let te=P(C("interpreter.dangerous-command",un),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:un}),ue(te)}r=void 0}}if(S==="busybox"&&g.length>1)return rf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),Cn(h.slice(1),t,{...y,effectiveCwd:A,envAssignments:v});let N=s?null:P(ef(S,g),n.policy);if(N)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:N.reason}),ue(N);let ce=r===y.trace?y:{...y,trace:r},_e={words:h,head:S,cwd:T,originalCwd:R,envAssignments:v,allowTmpdirVar:q,dynamicArguments:f.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:ce,analyzeChildTokens:(x,I)=>a&&s?Wa(x,t,ce,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ut(Cn(K(x),t+1,{...ce,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:v}))??Qe(x,ce.policy.rules),analyzeChild:(x,I)=>Wa(x,t,ce,I)},je=s&&(S==="xargs"||S==="parallel")?void 0:lf(S);if(S==="rm"||S==="xargs"||S==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let Ie=r&&S==="git"?dm(_e.words,La(_e)):void 0,pi=of(Ie?Ie.match:je?.(_e)??null,n.policy);if(r)ax(_e,pi,Ie?.relaxation??null);if(pi)return ue(pi);if(a&&s&&(S==="rm"||S==="rmdir")){if(!(S==="rm"&&(ze(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Sn(s,n.policy):null)??ox(s,n.policy)}let il=je!==void 0,sl=!s&&!il&&!Lr.has(S),gi=r&&sl?[]:void 0;if(sl)for(let x=1;x<g.length;x++){let I=g[x];if(!I)continue;gi?.push(I);let L=of(nx(g,x,t,ce,T,R,A,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[],embeddedCommandFound:M(I)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&il)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let xr=Qe(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!xr,reason:xr?.reason}),xr)return ue(xr);return a&&s?Sn(s,n.policy):null}function Wa(e,t,n,r){return Ut(Cn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function nx(e,t,n,r,o,i,s,a){for(let l of Ge(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=M(c);if(uf(c,u)||lf(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=Wa(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!or(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function rx(e,t,n,r,o,i){if(!t)return Sn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=P(C("interpreter.one-liner-paranoid",Yn),o.policy);if(a)return ue(a)}if($s(e,t))return Sn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!cf(s,t))return s;if(Zn(t)){let a=P(C("interpreter.dangerous-command",un),o.policy);if(a)return ue(a)}return Sn(i,o.policy)}function cf(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Oo)||e.reason===pn)&&!Wr(t)}function bn(e,t){let n=e.shellDynamicMatch?P(e.shellDynamicMatch,t):null;return n?ue(n):null}function Sn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?P(e.dynamicSourceMatch,t):null;return n?ue(n):null}function ox(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?P(e.rmDynamicMatch,t):null;return n?ue(n):null}function ix(e,t,n,r,o,i){let s=Rm(e);if(s.argvSource?.kind==="absent")return he(o);if(s.argvSourceApplies&&s.argvSource){let l=Qo(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Qo(a,n,t,r,o,i,!0)}function Qo(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return he(o);let a=qn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?he(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function sx(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function ax(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function rf(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function he(e){return e?.recordSegment({type:"error",message:af}),ue(lx())}function lx(){return{id:"",reason:af,intent:"stop_and_explain"}}function uf(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function of(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:P(e,t)}var cx=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,ux=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function dx(e,t){let n=ff(e,t);if(n.length===0)return!1;let r=n[mf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return cx.test(e.join(" "))}function df(e,t,n,r,o){if(e.dialect==="powershell"){let g=fx(e.words,o);if(g.kind==="none")return;if(!t||g.kind==="unknown")return null;return sf(yx(g.target),t,n.paths)}let i=e.words.map(w),s=i.some((g)=>/^CDPATH\+?=/.test(g));if(!dx(i,n))return s?null:void 0;if(!t)return null;let a=ff(i,n,t),l=mf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((g)=>g.length<=1||!g.startsWith("-")||g==="--");if((u===-1?c:c.slice(0,u)).some((g)=>!/^-[LP]+$/.test(g)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length!==1)return null;let p=f[0]??"",h=e.words.some((g)=>g.provenance==="variable"&&g.text===p)?mx(p,r):p;if(h===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(h)&&(s||n.env.has("CDPATH")))return null;return sf(h,t,n.paths)}function mx(e,t){let n=dr(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function sf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return mt(t,e,n)}catch{return null}}function fx(e,t){let n=px(e[0])?1:0,r=e[n];if(!gx(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!ux.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return hx(e.slice(n+1),t)}function px(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function gx(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function hx(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function yx(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function mf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function ff(e,t,n){let r=bx(e);return ft([...r],t,n)}function bx(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var Cx="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Ht="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function $a(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Me(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Ba(e,n);let u=`${Oo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return Cf(e,n),{reason:pn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Cf(e,n),{reason:pn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Ba(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Qd(n.environment.env,n.envAssignments);return ni(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ni(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,d=Sx(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=f||En(m);if(c.kind==="function"){let Z=h.flatMap((X)=>{let U=Rn(X);return U.functionDefinitions.set(c.name,c.body),Fa(X,[U],d,m==="&",En(m))}),ee=Ga(Z,[],g,y,a,m);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of h){let N=ni(c.body,t,n,r,[Rn(U)]);if(N.result)return N;if(Z.push(...Fa(U,N.states,d,m==="&",En(m))),v)ee.push(U,...d?N.states.map((ce)=>ei(U,ce)):N.states)}let X=Ga(Z,ee,g,y,a,m);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),S=e.nodes[l-2],T=ri(a)&&S?.kind==="command"?bm(S)??Ex(S):void 0,R=[],A=[];for(let Z of h){let ee=Rx(c,t,n,r,[Rn(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ei(Z,U));for(let U of X){let N=Rn(U),ce=wx(c,t,n.trace?{...n,trace:Sf(n.trace,E)}:n,r,N,ri(a),T);if(ce)return{result:ce,states:i};let _e=$x(c,N.functionDefinitions);if(_e)n.budget.charge("derivedTokens",oi(_e));let je=_e?t+1>=V.recursionDepth.cap?za(c.displayText,n,[N]):ni(_e,t+1,n,r,[N]):{result:null,states:zx(c,N)};if(je.result)return je;if(R.push(...Fa(Z,je.states,d,m==="&",En(m))),v)A.push(Z),A.push(...je.states.map((Ie)=>d?ei(Z,Ie):Ie))}}let q=Ga(R,A,g,y,a,m);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function Sx(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ri(r)||ri(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&vx(e,t)}function Fa(e,t,n,r,o){let i=n?t.map((a)=>ei(e,a)):[...t],s=o?i.flatMap((a)=>vn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ei(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function vx(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(xx(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ri(e){return e==="|"||e==="|&"}function Ex(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function En(e){return e==="&&"||e==="||"}function Ga(e,t,n,r,o,i){let s={success:ti([...n,...e]),failure:ti([...r,...t])},a=En(i)?s:void 0;return{states:En(o)||a?ti([...s.success,...s.failure]):s.success,conditionalStates:a}}function Sf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function Rx(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=_x(e);if(s){if(t+1>=V.recursionDepth.cap)return za(s,n,o);let a=Me(s,"powershell");if(a.status==="limited")return za(s,n,o);if(a.status!=="complete")return pf(i,n,r,o);n.budget.charge("derivedTokens",oi(a)),i.push({program:a,depth:t+1})}}return pf(i,n,r,o)}function xx(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function pf(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ni(i.program,i.depth,t,n,[Rn(a)]);if(l.result)return l;s.push(...l.states)}o=ti(s)}return{result:null,states:o}}function _x(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function oi(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+oi(o),0):n.kind==="group"||n.kind==="function"?oi(n.body):0),0)}function za(e,t,n){return t.trace?.recordSegment({type:"error",message:$e}),{result:{reason:$e,segment:e,intent:"stop_and_explain"},states:[...n]}}function wx(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=Mx(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};vf(e,o,"before-consumer",a.environment.paths,a.budget);let c=an(e.dialect,e.words),u=c.map(w),m=e.displayText,d=Jd(c,o.shellGitContextState),f=tm(d,o.shellGitContextState);if(e.dialect==="powershell"){let g=P(Pd(e,i,Hx(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!g,reason:g?.reason}),g)return Ux(m,g)}if(u.length===1&&u[0]?.includes(" ")&&!Bn(e.dialect,e.words)){let g=P(Ze(u[0]),a.policy),y=g!==null&&!a.strict&&Iu(e,a.rootProgram);if(g&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:g.reason}),{reason:g.reason,segment:m,ruleId:g.id,intent:g.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let v=gf(e,l,o,f,s,a);if(v)return v;return Sa(d,o.shellGitContextState),null}let p=Cn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(g,y)=>{let v=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=$a(g,t+1,{...a,effectiveCwd:v,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?Sf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:m};let h=gf(e,l,o,f,s,a);if(h)return h;return Sa(d,o.shellGitContextState),null}function gf(e,t,n,r,o,i){let s=Dx(e,t,n,r??new Map,i);if(s)return s;return vf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),Tx(e,t,n,i.environment.paths,i.budget),Wx(e,n,o,i.environment,i.trace),null}var Ax=new Set([">>","<>"]);function vf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?Px(s):Ax.has(s.operator)))continue;hf(s.target,t,r,o)}if(n!=="before-consumer"||!xe(e.words[0],"tee"))return;let i=Ef(e.words.slice(1));if(!i)return;for(let s of i.operands)hf(s,t,r,o)}function Px(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function hf(e,t,n,r){let o=e?.provenance==="literal"?qn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function Tx(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!ii(i))return;for(let s of Ix(e)){let a=qn(s.text,n.effectiveCwd,r,o);if(!a||!Mu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new D("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function Ix(e){let t=Ox(e.redirections)?.target,n=yf(t)?[t]:[];if(xe(e.words[0],"cat"))return kx(e.words)?n:[];if(!xe(e.words[0],"tee"))return[];let r=Ef(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(yf))return[];return[...r.operands,...n]}function kx(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function Ox(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Ef(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&xe(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function yf(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function xe(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function ii(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function Mx(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return Ht;let n=t[0];if(!n?.heredoc)return Ht;if(!ii(n.heredoc))return Cx;if(n.fd!==void 0&&n.fd!==0)return Ht;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return Ht;let r=e.redirections.some((s)=>s!==n&&bf(s.target));if(xe(e.words[0],"cat"))return r?Ht:void 0;if(xe(e.words[0],"tee"))return r||e.words.slice(1).some(bf)?Ht:void 0;let o=e.words[0],i=e.words[1];if(xe(o,"git")&&(xe(i,"apply")||xe(i,"commit")))return;if(xe(o,"gh")&&(xe(i,"pr")||xe(i,"issue"))&&xe(e.words[2],"create"))return;return Ht}function bf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function Dx(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(Lx(e,i,n,r,o))return null;let a=Nx(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Ba(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function Nx(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!ii(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Oe(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=P(C("interpreter.one-liner-paranoid",Yn),n.policy);if(c)return c}if(!Zn(s))return null;let l=P(C("interpreter.dangerous-command",un),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function Lx(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!ii(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=kt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return rt(a)}function Wx(e,t,n,r,o){let i=df(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var Fx=/^[A-Za-z_][A-Za-z0-9_]*$/,Gx=8;function zx(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!Fx.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=Gx&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=Rn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function Rn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:em(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ti(e){let t=[];for(let n of e){if(!t.some((r)=>Bx(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new D("controlFlowStates")}return t}function Bx(e,t){return e.effectiveCwd===t.effectiveCwd&&vn(e.shellGitContextState.env,t.shellGitContextState.env)&&vn(e.literalHeredocFiles,t.literalHeredocFiles)&&vn(e.functionDefinitions,t.functionDefinitions)&&vn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&vn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function vn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function $x(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function Ux(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function Hx(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Ba(e,t){let n=P(Ze(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Cf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:pn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var jx=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Rf(e,t,n,r){let o=$a(e,0,{...t,...Jc(t),budget:t.budget??ye(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function xf(e,t,n){try{return{decision:e()}}catch(r){let o=Vx(r,t,n);if(!o)throw r;return o}}function Vx(e,t,n){if(!(e instanceof D)||!jx.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var Kx=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Ha=new Set(["cc-safety-net","ccsn"]),qx=new Set(["bunx","npx","pnpx"]),Yx=new Set(["pnpm","yarn"]),Zx=new Set(["npm","pnpm","yarn"]),Xx=new Set(["bun","node"]);function ai(e,t,n={}){if(Ha.has(e))return 0;if(qx.has(e)){if(n.broad)return Ua(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return si(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&Zx.has(e)&&n.broad&&t[r]==="exec"){let o=Ua(t.slice(r+1));return o===null?null:r+1+o}if(Yx.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&si(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ua(t.slice(r+1));return o===null?null:r+1+o}if(Xx.has(e)){let o=n.broad&&r!==-1?r:0;if(_f(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&_f(t[o+1]))return o+2}return null}function Ua(e){let t=e.findIndex((r)=>si(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!si(r))break;n++}return n}function si(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return Ha.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return Ha.has(e.slice(0,t))}function _f(e){let t=e?.replaceAll("\\","/");return[...Kx].some((n)=>t===n||t?.endsWith(`/${n}`))}var wf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Af(e,t,n){let r=pe(e,"input-candidate");if(!r)return null;let o=mn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>Jx(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function Jx(e,t){let n=ft([...e],t),r=n.slice(1),o=ai(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as li}from"path";var kf="This path contains the protected policy config and you must not modify or delete it.",Qx=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Of(e,t,n){let r=i_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Pf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=pe(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Tf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Tf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Pf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||wr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Pf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>yr(a,n,r,o,i));return s?{target:s}:null}function Tf(e,t,n,r,o){let i=mn(e,t,r,o,{findSegmentTarget:(s,a)=>e_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>yr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>o_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function e_(e,t,n,r,o){if(tr(e))return null;let i=Ot([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&t_(a)){let l=n_(a).find((c)=>If(fe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Fo(i,1)||ma(i,r)){let c=(Wo(K(i))??K(["."])).find((u)=>{let m=fe(u.text,t.variables);return yr(m,t.cwd,n,r,o)||If(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=xo(a).sources.find((c)=>s_(fe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(r_(i,s))return null;for(let l of[...e,...i])for(let c of Mf(l))if(yr(fe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function t_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function n_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function r_(e,t){if(!Qx.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function o_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Mf(i))if(yr(s,t,n,r,o))return{target:s};return null}function Mf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function i_(e,t,n){let r=(a)=>br(se(a,e.executionCwd,t,n)),o=r(en(t)),i=[r(Ln(e.executionCwd)),r(Ln(e.configCwd))],s=new Set(i.map((a)=>li(a)));for(let a=li(o);;a=li(a))if(s.add(a),li(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function yr(e,t,n,r,o){let i=kl(e,t,r,o,(s)=>br(s)===Dr);return i!==null&&n.files.has(br(i))}function If(e,t,n,r,o){return n.directoriesAndAncestors.has(br(se(e,t,r,o)))}function s_(e,t,n,r,o){let i=br(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function br(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ci,posix as a_,resolve as di,win32 as l_}from"path";import{fileURLToPath as c_}from"url";var Uf="Access to a sensitive path is not allowed.",Hf=new Set(["echo","printf"]),u_=new Set(["find"]),d_=new Set(["-exec","-execdir"]),m_=new Set([";","+"]),f_=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),p_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),jf=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),g_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),h_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Vf=new Set(["-c","-e","-r","-E","--eval","--exec"]),y_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),b_=new Set(["grep","rg"]),Df=new Set(["jq","gojq","jaq"]),Nf="f",Lf="file",C_="files",S_=new Set(["e","f"]),v_=new Set(["regexp","file"]),E_=new Set(["e","f","A","B","C","m"]),R_=new Set(["regexp","file","after-context","before-context","context","max-count"]),ja="__CC_SAFETY_NET_PIPE_INPUT__",Ka=/[\w./~@+-]*[./~][\w./~@+-]*/g,x_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,__=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,w_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,A_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,P_=/\b(?:system|exec)\s*$/,T_=/\b(?:eval|exec)\s*\(/g,I_=/\b(?:eval|exec)\s*$/,k_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Wf(e,t,n,r,o,i){for(let s of e){let a=s.target;if(Tw(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=Aw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&Iw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Kf(e,t,n,r,o={}){let i=Ff(e,n,r),s=Wf(i,t,e.invocation.context.configCwd,n,r);if(s===null)return null;let a=s.ruleId!=="secret.deny-path"&&o.strict===!1?Ff(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:Wf(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&O_(e,n))return null;return l}function O_(e,t){let n=pe(e,"input-candidate")??pe(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of Ro(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(Je(a.text,t))}let o=St(r);if(o.length===0)return!1;let i=st(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>f_.has(a))}function Ff(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=pe(e,"input-candidate");return[...s?xn(s.shell,e.store,r,t,o,n,M_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function M_(e){return e.program.dialect==="powershell"}function xn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new We;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...cw(Je(e.source,r),t,n,r,o,i)],l=(c)=>Je(H_(c,s),r);return Eo(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...mi(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...N_(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...qf(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>L_(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return Ys;return a.push({target:l(c.target),cwd:u.cwd}),null}}),a}function qa(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new We;return s.status==="complete"?xn(s,t,n,r,o,i):null}function mi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(Df.has(st(St(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...mi(p,t,n,r,o,i)]}let l=U_(e).map(a),c=St(e);if(c.length===0)return l;let u=c[0]??"",m=st(u).toLowerCase(),d=c.slice(1),f=D_(u,m,d);if(f)return[...l,...f.map(a)];if(Hf.has(m))return n.capturedOutput===!0?[...l,...Yf(e).map(a)]:l;if(m==="eval")return[...l,...qa(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:it(m,p)).map(a)];if(m==="git")return[...l,...V_(d).map(a)];if(Df.has(m))return[...l,...j_(d).map(a)];if(b_.has(m))return[...l,...yw(d).map(a)];if(u_.has(m))return[...l,...Z_(d,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...d.flatMap((p)=>it("awk",p)).map(a),...d.flatMap((p)=>J_(p,t,n,r,o,i)),...d.flatMap(Q_).map(a)];if(m==="curl")return[...l,...d.flatMap((p)=>it(m,p)).map(a),...K_(d).map(a)];if(nr(m)){let p=er.has(m)?Se([m,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new We;if(h.status==="complete")return[...l,...xn(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...X_(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>it(m,p)).map(a)]}function D_(e,t,n){let r=ai(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function N_(e,t,n,r,o,i,s){if(z_(t,n,r,o,i,s))return Yf(e).map((a)=>({target:a,cwd:i}));return qf(t,W_(e),n,r,o,i,s,()=>[])}function L_(e,t,n,r,o,i,s){let a=St(e);if(!nr(st(a[0]??"").toLowerCase()))return[];return qa(t,n,r,o,i,s)??[{target:t,cwd:i}]}function qf(e,t,n,r,o,i,s,a){let l=B_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>er.has(l)?xn(n.getShellSyntax(c),n,r,o,i,s):ui(l,c,n,r,o,i,s))}function Yf(e){let t=St(e);if(t.length===0)return[];let n=st(t[0]??"").toLowerCase();if(!Hf.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Ya(r.replaceAll("%%","%"))];return t.slice(1)}function W_(e){let t=St(e);if(t.length===0)return[];let n=st(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return F_(r);return[]}function F_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ya(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>G_(t,r.slice(i*n,(i+1)*n)))}function G_(e,t){let n=0;return Ya(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ya(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function z_(e,t,n,r,o,i){let s=St(e);if(s.length===0||st(s[0]??"").toLowerCase()!=="xargs")return!1;let a=$t(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,ja]:l.map((m)=>m.split(c).join(ja));return mi(u,t,n,r,o,i).some((m)=>m.target.includes(ja))}function B_(e){let t=St(e);if(t.length===0)return null;let n=st(t[0]??"").toLowerCase();if(!nr(n))return null;return $_(n,t.slice(1))?n:null}function $_(e,t){let n=Za(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Vf.has(o)||Zf(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(k_.get(n)?.has(o))r++;continue}return!1}return!0}function Za(e){return/^python\d/.test(e)?"python":e}function U_(e){let t=[];for(let n of e){if(Jf(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Gf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function H_(e,t){if(!t||!Gf.test(e))return e;return`~${e.replace(Gf,"").replace(/\\/g,"/")}`}function it(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function j_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>it("jq",i))}return e.flatMap((r,o)=>o===t?[]:it("jq",r))}function V_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>it("git",i))];if(t.push(...it("git",r)),!Ce.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:it("git",o)),n++}return t}function K_(e){return e.flatMap((t,n)=>{let r=Y_(t);if(r!==null)return zf(r.flag,r.value);let o=q_(e[n-1]);return o===null?[]:zf(o,t)})}function zf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Va(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Va(t.slice(n+1))}return t.startsWith("@")?Va(t.slice(1)):[]}function q_(e){if(e===void 0)return null;if(jf.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function Y_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return jf.has(r)?{flag:r,value:e.slice(n+1)}:null}function Va(e){return e===""||e==="-"?[]:[e]}function Z_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!d_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>m_.has(f)),m=u===-1?c:c.slice(0,u),d=mi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,h)=>{if(!p_.has(f))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function X_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Vf.has(c)||Zf(e,c)){let m=t[l+1];if(m!==void 0)a.push(...ui(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...ui(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Zf(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return y_.get(t[t.length-1]??"")?.has(Za(e))??!1}function J_(e,t,n,r,o,i){if(!e.includes("system"))return[];return la(e)?.commands.flatMap((s)=>xn(t.getShellSyntax(s),t,n,r,o,i))??[]}function Q_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function ew(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Xa),...e.match(Ka)??[]]}function ui(e,t,n,r,o,i,s){let a=(f)=>({target:f,cwd:i}),l=nw(t,tw(e));if(l===null)return ew(t).map(a);let c=l.masked.match(A_)!==null||l.literals.some((f)=>P_.test(l.masked.slice(0,f.start))),u=l.masked.match(T_)!==null||l.literals.some((f)=>I_.test(l.masked.slice(0,f.start))),m=r.refineInlineData===!0&&!er.has(e),d=m&&!(sw(l.masked)||c||u)?[]:l.literals;return[...d.map((f)=>f.text).filter((f)=>f!=="").map(a),...d.flatMap((f)=>Xa(f.text)).map(a),...m?[]:l.literals.flatMap((f)=>f.text.match(Ka)??[]).map(a),...c?l.literals.flatMap((f)=>qa(f.text,n,r,o,i,s)??[a(f.text)]):[],...u?l.literals.flatMap((f)=>ui(e,f.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
-`:h),n,r,o,i,s)):[],...(l.masked.match(Ka)??[]).map(a)]}function tw(e){let t=Za(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function nw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(__.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&iw(e,o))return null;let a=t==="python"?rw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=ow(e,c,l);if(u===null)return null;let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&w_.test(m))return null;r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function rw(e,t){return x_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function ow(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function iw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function sw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(g_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>h_.has(i)))continue;if(o.length>1)return!0;if(aw(e,r)===".")return!0;if(lw(e,r+n.length)==="(")return!0}return!1}function aw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function lw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function cw(e,t,n,r,o,i){return pw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...xn(a,t,{...n,capturedOutput:!0},r,o,i),...uw(a,r)?dw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function uw(e,t){let n=Ro(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||st(Je(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Je(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function dw(e,t){return Ro(e).flatMap((n)=>n.kind==="word"?[Je(n.text,t)]:n.kind==="redirection"&&n.target?[Je(n.target,t)]:[]).flatMap(Xa)}function Xa(e){let t=fw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||mw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function mw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function fw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function pw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Wn(o,n))continue;if(Xf(e,r,n)){let i=gw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=hw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function gw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Wn(i,n))continue;if(Xf(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function hw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Xf(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function yw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===C_)o=!0;if(v_.has(m))r=!0;if(d!==void 0){if(m===Lf)t.push(d);continue}if(R_.has(m)){let f=e[l+1];if(m===Lf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let h=0;h<m.length;h++){let g=m[h]??"";if(S_.has(g))r=!0;if(E_.has(g)){d=g,f=m.slice(h+1);break}}if(d==="")continue;if(f.length>0){if(d===Nf)t.push(f);continue}let p=e[l+1];if(d===Nf&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function St(e){let t=e.findIndex((n)=>!Jf(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Jf(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var bw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Cw=".env.",Sw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),vw=[".env.example.",".env.sample."];function Ew(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Rw(e){return e.length>0&&!/\s/.test(e)}function xw(e,t,n,r){try{let o=vr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof D)throw o;return!1}}var _w=new Set(["node_modules","__pycache__"]),ww=[["vendor","bundle"],["vendor","cache"]];function Aw(e,t,n,r,o){if(Ew(e))return null;let i=He(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>Rw(s)||xw(e,t,r,o);if(Sw.has(s)||vw.some((d)=>s.startsWith(d)))return null;let c=B(Mw(e,t,r,o));for(let d of as){let f=`~/${d.suffixParts.join("/")}`;if(($f(a,f)||$f(c,f))&&ot(d.id,n))return d.id}let u=Pw(i,t,n,r,o);if(u)return u;if(bw.has(s))return null;for(let d of ss)if(s===d.basename&&ot(d.id,n))return d.id;if(s.startsWith(Cw)&&ot(Br.id,n)&&l())return Br.id;for(let d of ls)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&ot(d.id,n)&&l())return d.id}for(let d of cs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&ot(d.id,n))return d.id}if(kw(a))return null;if(!s.includes(".")&&Fn.pattern.test(s)&&ot(Fn.id,n))return Fn.id;let m=Ow(s,n);if(m)return m;return null}function Pw(e,t,n,r,o){return $r.find((i)=>{if(!ot(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Sr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,He("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Cr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Sr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,He(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Cr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Cr(e,s,["credentials"])||Cr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>Sr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?z(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?Sr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,He(u,t,r,o),l))}case"secret.cli.pi":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=He("~",t,r,o);return[le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),le(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Cr(e,le(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),le(He("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Sr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=le(z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,He("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&jt(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,He("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Bf=new WeakMap;function z(e,t,n,r,o){let i=Bf.get(o)??new Map;Bf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=He(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>Qf(e,le(t,r)))}function Cr(e,t,n){return n.some((r)=>jt(B(e),B(le(t,r))))}function Sr(e,t,n,r,o){return Qf(e,He(t,n,r,o))}function Qf(e,t){return B(e)===B(t)}function le(e,...t){return Be([e,...t].filter(Boolean).join("/"))}function Tw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(vr(e,t,o,i));return n.some((a)=>jt(s,B(vr(a,r,o,i))))}function Iw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(vr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Be(G(be(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=B(u?Be(G(di(be(u)),o.paths,i)):l&&Be(G(`${l}/.cc-safety-net`,o.paths,i)));if(m&&jt(s,m))return!1;return n.some((d)=>{let f=B(vr(d,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return jt(s,f)})}function kw(e){let t=e.split("/");return t.some((n)=>_w.has(n))||ww.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Ow(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of us)if(r===o.extension&&ot(o.id,t))return o.id;for(let o of ds)if(o.pattern.test(r)&&ot(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function ot(e,t){return!t?.disabledRules?.includes(e)}function He(e,t,n,r){let{home:o,normalized:i}=Ja(e,n,r);if(!i)return"";if(!o)return i;let s=Qa(i,o),a=ci(s)?s:Be(di(t,s)),l=Be(G(a,n.paths,r));if(!jt(l,o)){if(ci(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function $f(e,t){return e===t||e.startsWith(`${t}/`)}function Mw(e,t,n,r){let{home:o,normalized:i}=Ja(e,n,r);if(!i||!o)return"";let s=Qa(i,o),a=a_.normalize(ci(s)?s:Be(di(t,s))),l=Be(be(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&jt(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function vr(e,t,n,r){let{home:o,normalized:i}=Ja(e,n,r);if(!i)return"";let s=o?Qa(i,o):i;return Be(G(ci(s)?s:di(t,s),n.paths,r))}function Ja(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Be(G(be(r),t.paths,n)):"",i=Be(be(Dw(Je(e,t))));return{home:o,normalized:i}}function Dw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return c_(e)}catch{return e}}function Qa(e,t){if(e==="~")return t;if(e.startsWith("~/"))return le(t,e.slice(2));return e}function Nw(e){if(process.platform==="win32")return!0;return l_.parse(e).root.length>1}function Be(e){let t=e.trim(),n=(t.includes("\\")&&Nw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function st(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Vt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Lw={findPolicyMutation:Of,findGitMetadataMutation:ud,resolveGitMetadata:Ww,loadPolicySnapshot:Xc,findSensitiveTarget:Kf,analyzeCommand:Rf,getModes:Ni};function ep(e,t){let n={...Lw,...t.dependencies},r=zw(e),o=Er(e)?e.command:r,i=vt("policy-protection",o,()=>rr(e)),s=pe(i,"input-candidate"),a=pe(i,"declared-command");if(Er(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:$e,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Td,intent:"stop_and_explain"}};let l=ye(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:kf,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=vt("policy-protection",o,()=>Af(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:wf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Pe,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let f=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...Fw(f)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:Er(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:Uf,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!Er(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...el("command-validation",o),...g};let v=vt("command-analysis",o,()=>xf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Gw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function Ww(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Fw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Gw(e){return pe(e,"declared-command")?.program}function zw(e){try{return In(e.input)}catch(t){let n=Er(e)?e.command:void 0;throw new Vt("policy-protection",el("policy-protection",t instanceof Ve?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Vt(e,el(e,r instanceof Ve?void 0:t,r),r)}}function el(e,t,n){let r=n instanceof D||n instanceof We;return{stage:e,decision:{kind:"deny",reason:r?bi:wn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Er(e){return e.route.kind==="command"}import{appendFileSync as Qw,mkdirSync as eA}from"fs";import{isAbsolute as tA,join as rl}from"path";import{lstatSync as np,readdirSync as Bw,readFileSync as $w,rmdirSync as Uw,statSync as rp,unlinkSync as Hw,utimesSync as jw,writeFileSync as Vw}from"fs";import{join as Rr}from"path";function tp(e,t={}){return Zr(en(e,t),e.home).policy.audit.retention_days}var nl=86400000,Kw=".last-prune",qw=/^\d{4}-\d{2}$/,Yw=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,op=(e)=>Math.floor(e/nl);function sp(e,t,n=()=>new Date){try{let r=n().getTime();if(!rp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Rr(t,Kw),i=rp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&op(i)===op(r))return;let s=r-tp(e)*nl,a=new Date(r).toISOString().slice(0,7);for(let l of tl(t)){if(l.isDirectory()){Zw(Rr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))Xw(Rr(t,l.name),s)}Vw(o,"",{mode:384}),jw(o,r/1000,r/1000)}catch{}}function Zw(e,t,n){for(let r of tl(e)){if(!r.isDirectory()||!qw.test(r.name))continue;let o=Rr(e,r.name);for(let i of tl(o)){if(!i.isFile())continue;let s=Yw.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+nl;if(!Number.isFinite(a)||a>=t)continue;ap(Rr(o,i.name))}if(r.name!==n)ip(o)}ip(e)}function Xw(e,t){try{let n=np(e);if(n.mtimeMs>=t)return;let r=$w(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(Jw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(np(e).mtimeMs!==n.mtimeMs)return;ap(e)}catch{}}function Jw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function tl(e){try{return Bw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function ap(e){try{Hw(e)}catch{}}function ip(e){try{Uw(e)}catch{}}var nA="2.4.5",rA=1e4,oA=2000,iA=256,sA=32768;function aA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function lA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function ol(e,t,n,r,o,i,s={}){let a=aA(t);if(!a)return;let l=uA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=fi(at(n),s.failureStage?Number.POSITIVE_INFINITY:rA),m=fi(at(r),oA),d=s.toolName?fi(at(s.toolName),iA):void 0,f=i===null?void 0:fi(at(i),sA),p=rl(l,lA(f?.value??null),c.slice(0,7));eA(p,{recursive:!0,mode:448});let h=rl(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Wi)(),v:nA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Qw(h,`${JSON.stringify(g)}
-`,{encoding:"utf-8",mode:384}),sp(e,l,s.now)}catch{}}function fi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function cA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&tA(n)?n:null}function uA(e){let t=cA(e);return t?rl(t,".cc-safety-net","logs"):null}function cp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=lp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?lp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function lp(e){return"command"in e?e.command??"":""}function up(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;ol(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function dp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;ol(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function fp(e,t,n){try{let r=ep(t,{environment:e,...n.guard});return mp(e,t,r,n),r}catch(r){if(!(r instanceof Vt))throw r;throw mp(e,t,r.evaluation,n,!(r.cause instanceof Ve),{stage:r.stage,errorCode:dA(r.cause)}),r}}function mp(e,t,n,r,o=!0,i){up(e,cp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function dA(e){if(e instanceof D)return V[e.kind].errorCode;if(e instanceof Ve)return"tool-input-limit";if(e instanceof We)return"structural-shell-syntax-limit";return"unexpected-error"}function Kt(e,t={}){return{malformed:!0,denial:An(t),cwd:e}}function pp(e,t={}){return(n,r)=>{try{return mA(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(An())}}}function mA(e,t,n,r){let o=$l();if(n.cancelled?.(t))return n.block(An());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return dp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=cl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=fp(o,i,{guard:{auditAllowed:Ul(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Vt))throw l;if(Rt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${dl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var fA={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>gA(e,t,n),getSessionId:(e)=>bA(e),allow:{action:"allow"},block:(e)=>CA(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},gp=pA();function pA(e={}){return pp(fA,e)}function gA(e,t,n){if(!e||typeof e!=="object")return Kt(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Kt(null);if(!r.input||typeof r.input!=="object")return Kt(null,{toolName:r.tool});let o=hA(t,n);if(!o)return Kt(null,{toolName:r.tool});let i=yA(t,e);if(!i.ok)return Kt(o,{toolName:r.tool});if(!i.command)return Yt(r.tool,r.input,{kind:Ei(r.tool)},{configCwd:o,executionCwd:o},null);if(typeof i.command.command!=="string"||i.command.command.trim()==="")return Kt(o,{toolName:r.tool});let s=typeof i.command.dir==="string"?Nl(i.command.dir,o,n):o;if(!s)return{malformed:!0,denial:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",command:i.command.command,segment:i.command.dir,toolName:r.tool},cwd:o};return Yt(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:o,executionCwd:s},i.command.command)}function hA(e,t){let n=e.system.workspaceRoot;if(!n)return;try{let r=e.helpers.filePathFromURI(n);if(typeof r!=="string"||r.trim()==="")return;return Dl(".",[r],t)}catch{return}}function yA(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function bA(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function CA(e){return{action:"reject-and-continue",message:ul(e)}}function SA(e){e.on("tool.call",(t)=>gp(t,e))}export{SA as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function qo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function fr(e){return e?w(e):""}function wx(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Oa(e,t){return Ia(De(e,"posix"),t)}function gr(e){return Oa(e,new Set(Array.from(e.matchAll(wm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Ia(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Ia(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Ia(o,n))||Im(r.words,n))return!0;kx(r,n)}return!1}function Im(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(pr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return _m(e[s],t)}if(J.has(o)){let s=e.slice(n),a=ve(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&_m(s[l],t)}let i=Ax(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Im(e.slice(i),t)}function Ax(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return Px(e,t+1);if(r==="exec")return Tx(e,t+1);if(r==="env")return Ix(e,t+1,n);return null}function Px(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function Tx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Ix(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return pr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return pr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function kx(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(pr(n,t))t.add(r.name)}}function pr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(wm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(yx.test(o)||t.has(o))}))}function _m(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||pr(e,t))}var Ox=["--init-file","--rcfile"],Mx=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function ot(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return km(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=km(e,t,!1);if(r!==null)return r}}return null}function it(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return ve(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function km(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Om(e){let t=k(e[0]??"").toLowerCase(),n=Dx(e,t),r=Mx.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Dx(e,t){let n=ve(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?Ox.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Ji.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Qi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var Ma="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Da="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Nx="__CC_SAFETY_NET_XARGS_INPUT__",Yo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Zo="rm",Lx=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Wx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Fx=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Gx=/^(?:[0-9]+|[@*])$/;function Nm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=$t(n),i=n.slice(r),s=C("xargs.shell-dynamic",Da);if(Bx(i,o,t)&&P(s,t.policy))return P(s,t.policy);for(let a of ze(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?P(s,t.policy):null;if(c)return c;let u=Bm(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&Gm(l,o),d=t.analyzeChild(l,{...Gt(a,t),dynamicInput:u,dynamicSourceInput:m||Wm(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:C("xargs.rm-recursive-force-dynamic",Ma)});if(d)return d;let f=zx(l,o,t.policy?.rules??[],P(s,t.policy));if(f)return f;if(a.head==="git"){let g=o===null?[...l,Nx]:l,h=o!==null&&(l.some((S)=>S.includes(o))||Array.from(a.envAssignments.values()).some((S)=>S.includes(o))),y=t.analyzeChild(g,{...Gt(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=tt(l,t.policy?.rules??[]);if(p)return p}return null}function zx(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=tt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Lm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=vm(e,r,t.length,n);return o===null?[]:[o]}function Wm(e,t,n,r,o,i,s){if(J.has(t)){if(it(e))return!1;if(n!==null&&$x(e,n,s))return!0;let a=ot(e);if(!a){let l=rt(K(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Fm(a,n,s))return!0;if(Ae(a))return!0;return Ux(a,n,r)}if(Me(t))return Mm(e,n,ho,Hu(t));if(we.has(t))return Mm(e,n,ma,Hd);if(t==="eval"){let a=Vo(K(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return Hx(e,n,i);if(t==="git"){let a=Re(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&gn.has(a.subcommand.toLowerCase())&&zm(a.rest,n).some((l)=>l.includes(n))}return!1}function Fm(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Ae(i)===null&&n(i)===null}function Mm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Yo]).sources.some((a)=>a.value===Yo);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Yo}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Yo}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Lm(l,t,a))));return Ho(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function Bx(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(ze(e,n),(i)=>i.head)),o=t===null?[...e,Zo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Zo));return Array.from(ze(o,n)).some((i)=>i.head===Zo&&!r.has(Zo))}function Gm(e,t){return zm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function zm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Bm(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function $x(e,t,n){let r=ve(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Fm(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Lm(a,t,s).some((u)=>{let m=e.map((f,p)=>p===l?f.replaceAll(t,u):f),d=ve(m);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(m[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(m[d.scriptIndex]??"").includes(u)})}))}function Ux(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Lx))if(Dm(o,r))return!0;for(let o of e.matchAll(Wx))for(let i of(o[1]??"").matchAll(Fx))if(Dm(i,r))return!0;return Oa(e,r)}function Dm(e,t){let n=e[1]??e[2];return n!==void 0&&(Gx.test(n)||t.has(n))}function Hx(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(nt(s)){let l=ur(e,i);i=l.nextIndex-1;for(let c of ze(l.tokens,{environment:n,cwd:void 0})){let u=Bm(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Gm(c.tokens,t)||Wm(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=yt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function $t(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var hr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",yr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Vx="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Kx="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Jo=/\{[^{}\s]*\}/g,$m=/\{\}|\{-?\d+\}/g,qx=["e","f","source","file","-e","-f","--source","--file"],Yx=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Zx=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Xx=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Um=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Jx=new Set(["--workdir","--wd"]),Hm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ie(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Ym(e){return Ie([...e],(t)=>Ae(t))}function Zm(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=yn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=sf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=yn(t);if(p)return p;let g=Ym(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=oR(t);if(p)return p}if(u!==void 0&&a){let p=yn(t);if(p)return p}let d=iR(u,t.cwd,t.environment.paths);if(d===null){let p=yn(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...ze(i,f)].flatMap((g)=>[...g.envAssignments.values()]).some(Wa)){let g=yn(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=ef(f.envAssignments,f.cwd,a);return Ie(p,(h)=>t.analyzeNested(h,g))}return Ie(ze(i,f),(p)=>Qx(p,o,t,f))}function Qx(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(rf)){let h=yn(n);if(h)return h}let u=Ym(c);if(u)return u;let m=c.some(F),d=i||m,f=a&&d,p=ef(e.envAssignments,e.wrapperCwd,s||f);if(J.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ie(o,(E)=>n.analyzeChild(Xo(l,E,n.budget),Gt(e,r)))};if(it(l))return h();let y=ot(l);if(y){if(of(y)){let x=St(n);if(x)return x;if(o.length===0)return null;return Ie(o,(A)=>n.analyzeNested(Km(y,A,n.budget),p))}if(F(y)){if(o.length>0)return Ie(o,(q)=>n.analyzeNested(Km(y,q,n.budget),p));let x=dr(y);if(x?.[0]&&M(x[0])==="rm"&&Be(x)){let q=Vm(n);if(q)return q}let A=x?n.analyzeChild(x,{...Gt(e,r),dynamicInput:a,shellDynamicMatch:C("parallel.shell-dynamic",yr),rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",hr)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>Ko(K(x===void 0?l:i?l.map((A)=>tf(A,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=St(n);if(x)return x}let v=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(v.length>0)return n.budget.charge("derivedTokens",v.length),Ie(v,(x)=>n.analyzeNested(x,p));if(gr(y)){let x=St(n);if(x)return x}let T=n.analyzeNested(y,p);if(T)return T;if(d)return St(n);return null}let S=rt(K(l));if(S.kind==="dynamic"||S.kind==="literal"&&F(S.source))return St(n)??h();if(S.kind==="literal")return h();if(o.length>0){let E=St(n);if(E)return E;let v=h();if(v)return v;if(i)return null;let T=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",T.length),Ie(T,(x)=>n.analyzeNested(x,p))}if(d||a)return St(n)??h();return null}if(e.head==="rm"&&Be(l)){if(i&&o.length>0)return Ie(o,(y)=>Na(Xo(l,y,n.budget,$m),e.cwd,r));if(o.length>0)return Ie(o,(y)=>Na(qm(l,y,n.budget),e.cwd,r));let h=Na(l.flatMap((y,S)=>{if(S===0||!F(y))return[y];return y.startsWith("-")?[y.replace($m,"")]:[]}),e.cwd,r);if(h)return h;return Vm(n)}let g=o.length>0?o:[void 0];return Ie(g,(h)=>{let y=h===void 0?l:i?Xo(l,h,n.budget):qm(l,h,n.budget),S=C("parallel.shell-dynamic",yr),E=a&&e.head==="find"?rR(y,r):null,v=Jm(y,a,n)??E?.customResult??null,T=M(e.head),x=a&&(T==="rm"&&La(y)||T==="xargs"&&Qm(y)||E?.rmOptions===!0),A=a&&(x||E?.executedSource===!0||E===null&&Xm(y,T)),q=n.analyzeChild(y,{...Gt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:x,dynamicSourceInput:v!==null||A,shellDynamicMatch:S,dynamicSourceMatch:S,rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",hr)});if(A){let Z=P(S,n.policy);if(Z)return Z}return q??v??tt(y,n.policy?.rules??[])})}function Xm(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return nR(e);if(t==="git")return eR(e);if(t==="find")return!0;if(we.has(t))return jm(e,qx,cr);if(Me(t))return jm(e,Yx,go);return!1}function La(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||of(o)))}function eR(e){if(tR(e))return!0;let t=Re(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!gn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function tR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function nR(e){if(it(e))return!1;let t=ot(e);if(t!==null)return F(t);let n=rt(K(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function jm(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,Hm]).some((o)=>o.value===Hm);return Ho(r,t,(o)=>n(e.map((i)=>tf(i,[o]))))}function Jm(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return St(n);return Ie(o,(i)=>tt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function rR(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of ze(i,t))n.executedSource||=Xm(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&La(a.tokens)||a.head==="xargs"&&Qm(a.tokens),n.customResult??=Jm(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(nt(a)){i=[],n.executedSource||=F(a);continue}let l=yt(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function Qm(e){let t=e.slice($t(e).childStart);return M(t[0]??"")==="rm"&&La(t)}function Qo(e,t){return(n)=>P(C(e,t),n.policy)}var St=Qo("parallel.shell-dynamic",yr),oR=Qo("parallel.command-stream-dynamic",Vx),yn=Qo("parallel.command-stream-dynamic",Kx),Vm=Qo("parallel.rm-recursive-force-dynamic",hr);function Na(e,t,n){return P(jo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Nt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function ef(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function tf(e,t){return e.replace(Jo,(n)=>nf(n,t))}function Xo(e,t,n,r=Jo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=nf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Km(e,t,n){return Xo([e],t,n)[0]??""}function qm(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function nf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(Jo)!==-1}function rf(e){if(Wa(e))return!0;for(let t of e.matchAll(Jo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Wa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function of(e){return/^\{[^{}\s]*\}$/.test(e)}function iR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!jx(e))return null;try{return ft(t??e,e,n)}catch{return null}}function sf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ga(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ga(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let g=e[t+1],h=p.indexOf("="),y=h===-1?p:p.slice(0,h),S=h===-1?void 0:p.slice(h+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?S:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||Xx.has(y)){c=!0,t+=S===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=S===void 0?2:1;continue}if(Um.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=Um.has(p)?2:1;continue}if(Jx.has(y)){c=!0;let E=S??g;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=S===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&S!==void 0){t++;continue}if(Zx.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Wa:rf);let u=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let h=e[g];if(h===":::"){u.push(p),p=[];continue}if(h!==void 0)p.push(h)}u.push(p)}c||=u.length>1;let m=sR(u),d=n.some(F),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function sR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");o.push([...i,s])}t=o}return t}function af(e){return sf(e).childStart}var aR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",ei="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ga(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Fa(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function cf(e,t,n,r,o=!1,i){let a=(Bn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?C("shell.dynamic-executable",aR):null;return P(a,i)??uf(e,t,n,o,i)}function uf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ga(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=an(e,t),l=cR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return P(C("shell.dynamic-structure",ei),o);if(P(Uo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&gn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return P(C("shell.dynamic-structure",ei),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&uR(t)?P(C("shell.dynamic-structure",ei),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=Be(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?P(C("shell.dynamic-structure",ei),o):null}if(s==="xargs")return lf(e,t.slice($t(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return lf(e,t.slice(af(t.map(w))),"parallel",n,r,o);return null}function lf(e,t,n,r,o,i){if(t.length===0)return null;let s=lR(t,r);if(Bn(e,s)){let l=P(C(`${n}.shell-dynamic`,n==="xargs"?Da:yr),i);if(l)return l}let a=uf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ga(l)&&Fa(l)))return P(C(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ma:hr),i);return null}function lR(e,t){let n=kt(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function cR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(Se.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function uR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ga(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Fa(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Fa(s)))return!0;continue}if(t=!0,a)return!0;let l=yt(s.text);if(l>0){n=l;continue}if(nt(s.text))o=!0,r=!0}return!1}function za(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!uo(t[n.tokenIndex],n.value)})}var dR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",mR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",fR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function df(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return C("dd.device-write",dR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return C("mkfs.device",mR);if(e==="shred"&&n.length>0)return C("shred.target",fR);return null}var ff=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Uo(e.words,Ba(e))},{heads:new Set(["find"]),analyze:(e)=>Zd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>Nm(e.words,{...mf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Zm(e.words,{...mf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})}];function mf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ut(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Ba(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function yf(e){return ff.find((t)=>t.heads.has(e))?.analyze}function Cn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=Co(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=kt(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let R=[...p,...i(f.words)].join(" "),I=Ae(R);if(I)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:I.reason}),de(I);if(n.strict)return ye(r);let L=So(p,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(te)return te}}let g=f.rewritten?K(i(f.words)):an(o,f.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>g.length){let R=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-g.length),output:h})}let S=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),E=h[0];if(!E)return null;if(Ft(E))throw new D("wrapperPeelIterations");let v=M(E),T=f.cwd===null?void 0:f.cwd??u,x=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,q=s?s.allowTmpdirVar:!or(S,n.environment),Z=cf(o,f.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),de(Z);let ee=Wo(h,n.policy);if(ee){for(let R of[ee.childIndex,...ee.alternativeChildIndices]){pf(y.wrapperNormalizationBudget);let I=g.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=Cn(I,t,{...y,effectiveCwd:A,envAssignments:S});if(L)return L}return null}let X=l?void 0:v==="eval"?Vo(g):v==="trap"&&!a?Pm(g):void 0;if(a&&s&&v==="eval"){if(X?.kind==="dynamic")return bn(s,n.policy);if(X?.kind==="literal"){let R=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:S});if(R)return R}return Sn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!ka(n.commandView)))return ye(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:v==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let R=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:S,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?J.has(v):Cf(E,v)){if(it(h))return null;if(a&&s){let R=ot(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=bn(s,n.policy);if(L)return L}if(gr(R)){let L=bn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:A,envAssignments:S})}let I=rt(g);if(I.kind==="dynamic")return bn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?bn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?bn(s,n.policy):null}if(l){let R=ot(h),I=R?n.analyzeNested(R,{effectiveCwd:A,envAssignments:S}):rt(g).kind==="dynamic"?ye(r):null;if(I)return I}if(s===void 0){let R=yR(h,S,A,n,r,t);if(R)return R;let I=ot(h);if(I){let qt=Ko(g,I);if(qt.kind==="dynamic")return ye(r);let yi=qt.kind==="literal"?qt.source:I,hl=bR(yi);r?.recordSegment({type:"shell-wrapper",wrapper:v,innerCommand:hl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:hl,depth:t+1});let yl=n.analyzeNested(yi,{effectiveCwd:A,envAssignments:S});if(yl)return yl;return gr(yi)?ye(r):null}let L=rt(g);if(L.kind==="dynamic")return ye(r);if(L.kind==="literal")return ti(L.source,A,S,n,r,t);let te=Tm(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:A,envAssignments:S})}}if(!s&&(v==="source"||v===".")){let R=h[1]==="-p"?2:null;if(R!==null){let qt=n.commandView?g[R]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return ye(r)}let I=R===null?1:3,L=h[I]==="--"?I+1:I,te=n.commandView?g[L]:void 0;if(!te)return null;if(te.provenance==="literal")return ti(te.text,A,S,n,r,t);if(n.strict||!n.commandView||!ka(n.commandView))return ye(r)}if(we.has(v)&&!l){if(!s&&n.strict&&za(cr(h),g))return ye(r);let R=jd(h,(L)=>Ut(n.analyzeNested(L,{effectiveCwd:A,envAssignments:S}))),I=P(R,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),de(I)}if(Me(v)&&!l){if(!s&&n.strict&&za(go(h),g))return ye(r);let R=Uu(h);if(a&&s)return gR(v,R,A,S,n,s);if(R){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:v,codeArg:R,paranoidBlocked:I}),I){let te=P(C("interpreter.one-liner-paranoid",Yn),n.policy);if(te)return de(te)}if(js(v,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:A,envAssignments:S});if(L&&!bf(L,R))return L;if(Zn(R,void 0,!n.strict)){let te=P(C("interpreter.dangerous-command",un),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:un}),de(te)}r=void 0}}if(v==="busybox"&&h.length>1)return pf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),Cn(g.slice(1),t,{...y,effectiveCwd:A,envAssignments:S});let N=s?null:P(df(v,h),n.policy);if(N)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:N.reason}),de(N);let ue=r===y.trace?y:{...y,trace:r},_e={words:g,head:v,cwd:T,originalCwd:x,envAssignments:S,allowTmpdirVar:q,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:ue,analyzeChildTokens:(R,I)=>a&&s?$a(R,t,ue,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ut(Cn(K(R),t+1,{...ue,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:S}))??tt(R,ue.policy.rules),analyzeChild:(R,I)=>$a(R,t,ue,I)},qe=s&&(v==="xargs"||v==="parallel")?void 0:yf(v);if(v==="rm"||v==="xargs"||v==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:S.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let ke=r&&v==="git"?Sm(_e.words,Ba(_e)):void 0,gi=gf(ke?ke.match:qe?.(_e)??null,n.policy);if(r)CR(_e,gi,ke?.relaxation??null);if(gi)return de(gi);if(a&&s&&(v==="rm"||v==="rmdir")){if(!(v==="rm"&&(Be(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Sn(s,n.policy):null)??hR(s,n.policy)}let pl=qe!==void 0,gl=!s&&!pl&&!Wr.has(v),hi=r&&gl?[]:void 0;if(gl)for(let R=1;R<h.length;R++){let I=h[R];if(!I)continue;hi?.push(I);let L=gf(pR(h,R,t,ue,T,x,A,S),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:hi??[],embeddedCommandFound:M(I)}),de(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:hi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&pl)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let _r=tt(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!_r,reason:_r?.reason}),_r)return de(_r);return a&&s?Sn(s,n.policy):null}function $a(e,t,n,r){return Ut(Cn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function pR(e,t,n,r,o,i,s,a){for(let l of ze(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=M(c);if(Cf(c,u)||yf(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=$a(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!or(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function gR(e,t,n,r,o,i){if(!t)return Sn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=P(C("interpreter.one-liner-paranoid",Yn),o.policy);if(a)return de(a)}if(js(e,t))return Sn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!bf(s,t))return s;if(Zn(t,void 0,!o.strict)){let a=P(C("interpreter.dangerous-command",un),o.policy);if(a)return de(a)}return Sn(i,o.policy)}function bf(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Do)||e.reason===pn)&&!Fr(t)}function bn(e,t){let n=e.shellDynamicMatch?P(e.shellDynamicMatch,t):null;return n?de(n):null}function Sn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?P(e.dynamicSourceMatch,t):null;return n?de(n):null}function hR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?P(e.rmDynamicMatch,t):null;return n?de(n):null}function yR(e,t,n,r,o,i){let s=Om(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ti(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ti(a,n,t,r,o,i,!0)}function ti(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=qn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function bR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function CR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function pf(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function de(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:ar}),de(SR())}function SR(){return{id:"",reason:ar,intent:"stop_and_explain"}}function Cf(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function gf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:P(e,t)}var vR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,ER=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function xR(e,t){let n=Ef(e,t);if(n.length===0)return!1;let r=n[vf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return vR.test(e.join(" "))}function Sf(e,t,n,r,o){if(e.dialect==="powershell"){let h=_R(e.words,o);if(h.kind==="none")return;if(!t||h.kind==="unknown")return null;return hf(TR(h.target),t,n.paths)}let i=e.words.map(w),s=i.some((h)=>/^CDPATH\+?=/.test(h));if(!xR(i,n))return s?null:void 0;if(!t)return null;let a=Ef(i,n,t),l=vf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((h)=>h.length<=1||!h.startsWith("-")||h==="--");if((u===-1?c:c.slice(0,u)).some((h)=>!/^-[LP]+$/.test(h)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length!==1)return null;let p=f[0]??"",g=e.words.some((h)=>h.provenance==="variable"&&h.text===p)?RR(p,r):p;if(g===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(g)&&(s||n.env.has("CDPATH")))return null;return hf(g,t,n.paths)}function RR(e,t){let n=mr(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function hf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return ft(t,e,n)}catch{return null}}function _R(e,t){let n=wR(e[0])?1:0,r=e[n];if(!AR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!ER.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return PR(e.slice(n+1),t)}function wR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function AR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function PR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function TR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function vf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Ef(e,t,n){let r=IR(e);return pt([...r],t,n)}function IR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var kR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Ht="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Ka(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??De(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Va(e,n);let u=`${Do}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return Pf(e,n),{reason:pn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Pf(e,n),{reason:pn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Va(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=lm(n.environment.env,n.envAssignments);return oi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function oi(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,d=OR(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,g=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,h=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],S=f||En(m);if(c.kind==="function"){let Z=g.flatMap((X)=>{let U=xn(X);return U.functionDefinitions.set(c.name,c.body),Ua(X,[U],d,m==="&",En(m))}),ee=Ha(Z,[],h,y,a,m);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of g){let N=oi(c.body,t,n,r,[xn(U)]);if(N.result)return N;if(Z.push(...Ua(U,N.states,d,m==="&",En(m))),S)ee.push(U,...d?N.states.map((ue)=>ni(U,ue)):N.states)}let X=Ha(Z,ee,h,y,a,m);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),v=e.nodes[l-2],T=ii(a)&&v?.kind==="command"?Am(v)??DR(v):void 0,x=[],A=[];for(let Z of g){let ee=NR(c,t,n,r,[xn(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ni(Z,U));for(let U of X){let N=xn(U),ue=FR(c,t,n.trace?{...n,trace:Tf(n.trace,E)}:n,r,N,ii(a),T);if(ue)return{result:ue,states:i};let _e=e_(c,N.functionDefinitions);if(_e)n.budget.charge("derivedTokens",si(_e));let qe=_e?t+1>=V.recursionDepth.cap?ja(c.displayText,n,[N]):oi(_e,t+1,n,r,[N]):{result:null,states:JR(c,N)};if(qe.result)return qe;if(x.push(...Ua(Z,qe.states,d,m==="&",En(m))),S)A.push(Z),A.push(...qe.states.map((ke)=>d?ni(Z,ke):ke))}}let q=Ha(x,A,h,y,a,m);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function OR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ii(r)||ii(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&MR(e,t)}function Ua(e,t,n,r,o){let i=n?t.map((a)=>ni(e,a)):[...t],s=o?i.flatMap((a)=>vn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ni(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function MR(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(LR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ii(e){return e==="|"||e==="|&"}function DR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function En(e){return e==="&&"||e==="||"}function Ha(e,t,n,r,o,i){let s={success:ri([...n,...e]),failure:ri([...r,...t])},a=En(i)?s:void 0;return{states:En(o)||a?ri([...s.success,...s.failure]):s.success,conditionalStates:a}}function Tf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function NR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=WR(e);if(s){if(t+1>=V.recursionDepth.cap)return ja(s,n,o);let a=De(s,"powershell");if(a.status==="limited")return ja(s,n,o);if(a.status!=="complete")return xf(i,n,r,o);n.budget.charge("derivedTokens",si(a)),i.push({program:a,depth:t+1})}}return xf(i,n,r,o)}function LR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function xf(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=oi(i.program,i.depth,t,n,[xn(a)]);if(l.result)return l;s.push(...l.states)}o=ri(s)}return{result:null,states:o}}function WR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function si(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+si(o),0):n.kind==="group"||n.kind==="function"?si(n.body):0),0)}function ja(e,t,n){return t.trace?.recordSegment({type:"error",message:He}),{result:{reason:He,segment:e,intent:"stop_and_explain"},states:[...n]}}function FR(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=jR(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};If(e,o,"before-consumer",a.environment.paths,a.budget);let c=an(e.dialect,e.words),u=c.map(w),m=e.displayText,d=am(c,o.shellGitContextState),f=um(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=P(Wd(e,i,n_(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return t_(m,h)}if(u.length===1&&u[0]?.includes(" ")&&!Bn(e.dialect,e.words)){let h=P(Ae(u[0]),a.policy),y=h!==null&&!a.strict&&Gu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let S=Rf(e,l,o,f,s,a);if(S)return S;return _a(d,o.shellGitContextState),null}let p=Cn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let S=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=Ka(h,t+1,{...a,effectiveCwd:S,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?Tf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:m};let g=Rf(e,l,o,f,s,a);if(g)return g;return _a(d,o.shellGitContextState),null}function Rf(e,t,n,r,o,i){let s=VR(e,t,n,r??new Map,i);if(s)return s;return If(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),BR(e,t,n,i.environment.paths,i.budget),YR(e,n,o,i.environment,i.trace),null}var GR=new Set([">>","<>"]);function If(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?zR(s):GR.has(s.operator)))continue;_f(s.target,t,r,o)}if(n!=="before-consumer"||!le(e.words[0],"tee"))return;let i=kf(e.words.slice(1));if(!i)return;for(let s of i.operands)_f(s,t,r,o)}function zR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function _f(e,t,n,r){let o=e?.provenance==="literal"?qn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function BR(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of $R(e)){let a=qn(s.text,n.effectiveCwd,r,o);if(!a||!$u(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new D("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function $R(e){let t=HR(e.redirections)?.target,n=wf(t)?[t]:[];if(le(e.words[0],"cat"))return UR(e.words)?n:[];if(!le(e.words[0],"tee"))return[];let r=kf(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(wf))return[];return[...r.operands,...n]}function UR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function HR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function kf(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&le(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=Array.from(i.text.slice(1)).some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function wf(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function le(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function qa(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function jR(e,t){let n=e.redirections.filter((a)=>a.operator==="<<"||a.operator==="<<-");if(n.length===0)return;if(n.length!==1)return Ht;let r=n[0];if(!r?.heredoc)return Ht;if(!qa(r.heredoc)&&!(t&&!/\$\(|`/.test(r.heredoc.body)))return kR;if(r.fd!==void 0&&r.fd!==0)return Ht;if(e.redirections.some((a)=>a!==r&&["<","<<","<<-","<<<","<&","<>"].includes(a.operator)))return Ht;let o=e.redirections.some((a)=>a!==r&&Af(a.target));if(le(e.words[0],"cat"))return o?Ht:void 0;if(le(e.words[0],"tee"))return o||e.words.slice(1).some(Af)?Ht:void 0;let i=e.words[0],s=e.words[1];if(le(i,"git")&&(le(s,"apply")||le(s,"commit")))return;if(le(i,"gh")&&(le(s,"pr")||le(s,"issue"))&&le(e.words[2],"create"))return;return Ht}function Af(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function VR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(qR(e,i,n,r,o))return null;let a=KR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Va(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function KR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!qa(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=le(e.words[0],"uv")&&le(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Me(i.text))return;let s=o.findIndex((m)=>le(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=P(C("interpreter.one-liner-paranoid",Yn),n.policy);if(m)return m}if(!Zn(l,void 0,!n.strict))return null;let u=P(C("interpreter.dangerous-command",un),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function qR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!qa(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=kt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return it(a)}function YR(e,t,n,r,o){let i=Sf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var ZR=/^[A-Za-z_][A-Za-z0-9_]*$/,XR=8;function JR(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!ZR.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=XR&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=xn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function xn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:cm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ri(e){let t=[];for(let n of e){if(!t.some((r)=>QR(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new D("controlFlowStates")}return t}function QR(e,t){return e.effectiveCwd===t.effectiveCwd&&vn(e.shellGitContextState.env,t.shellGitContextState.env)&&vn(e.literalHeredocFiles,t.literalHeredocFiles)&&vn(e.functionDefinitions,t.functionDefinitions)&&vn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&vn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function vn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function e_(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function t_(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function n_(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Va(e,t){let n=P(Ae(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Pf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:pn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var r_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Of(e,t,n,r){let o=Ka(e,0,{...t,...au(t),budget:t.budget??be(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function Mf(e,t,n){try{return{decision:e()}}catch(r){let o=o_(r,t,n);if(!o)throw r;return o}}function o_(e,t,n){if(!(e instanceof D)||!r_.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var i_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Za=new Set(["cc-safety-net","ccsn"]),s_=new Set(["bunx","npx","pnpx"]),a_=new Set(["pnpm","yarn"]),l_=new Set(["npm","pnpm","yarn"]),c_=new Set(["bun","node"]);function li(e,t,n={}){if(Za.has(e))return 0;if(s_.has(e)){if(n.broad)return Ya(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return ai(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&l_.has(e)&&n.broad&&t[r]==="exec"){let o=Ya(t.slice(r+1));return o===null?null:r+1+o}if(a_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&ai(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ya(t.slice(r+1));return o===null?null:r+1+o}if(c_.has(e)){let o=n.broad&&r!==-1?r:0;if(Df(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Df(t[o+1]))return o+2}return null}function Ya(e){let t=e.findIndex((r)=>ai(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!ai(r))break;n++}return n}function ai(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return Za.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return Za.has(e.slice(0,t))}function Df(e){let t=e?.replaceAll("\\","/");return[...i_].some((n)=>t===n||t?.endsWith(`/${n}`))}var Nf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Lf(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=mn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>u_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function u_(e,t){let n=pt([...e],t),r=n.slice(1),o=li(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ci}from"path";var zf="This path contains the protected policy config and you must not modify or delete it.",d_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Bf(e,t,n){let r=y_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Wf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Ff(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Ff(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Wf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Ar(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Wf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>br(a,n,r,o,i));return s?{target:s}:null}function Ff(e,t,n,r,o){let i=mn(e,t,r,o,{findSegmentTarget:(s,a)=>m_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>br(s,a.cwd,n,r,o),findMalformedTarget:(s)=>h_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function m_(e,t,n,r,o){if(tr(e))return null;let i=Ot([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&f_(a)){let l=p_(a).find((c)=>Gf(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(zo(i,1)||ya(i,r)){let c=(Go(K(i))??K(["."])).find((u)=>{let m=pe(u.text,t.variables);return br(m,t.cwd,n,r,o)||Gf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=wo(a).sources.find((c)=>b_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(g_(i,s))return null;for(let l of[...e,...i])for(let c of $f(l))if(br(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function f_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function p_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function g_(e,t){if(!d_.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function h_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of $f(i))if(br(s,t,n,r,o))return{target:s};return null}function $f(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function y_(e,t,n){let r=(a)=>Cr(se(a,e.executionCwd,t,n)),o=r(en(t)),i=[r(Ln(e.executionCwd)),r(Ln(e.configCwd))],s=new Set(i.map((a)=>ci(a)));for(let a=ci(o);;a=ci(a))if(s.add(a),ci(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function br(e,t,n,r,o){let i=zl(e,t,r,o,(s)=>Cr(s)===Nr);return i!==null&&n.files.has(Cr(i))}function Gf(e,t,n,r,o){return n.directoriesAndAncestors.has(Cr(se(e,t,r,o)))}function b_(e,t,n,r,o){let i=Cr(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Cr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ui,posix as ep,resolve as mi,win32 as C_}from"path";import{fileURLToPath as S_}from"url";var tp="Access to a sensitive path is not allowed.",np=new Set(["echo","printf"]),v_=new Set(["find"]),E_=new Set(["!","do","elif","else","if","then","until","while"]),x_=new Set(["-exec","-execdir"]),R_=new Set([";","+"]),__=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),w_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),rp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),A_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),P_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),op=new Set(["-c","-e","-r","-E","--eval","--exec"]),T_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),I_=new Set(["grep","rg"]),k_=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),O_=new Set(["commit","merge","notes","stash","tag"]),M_=new Set(["-m","--message"]),D_=new Set(["--grep"]),Uf=new Set(["jq","gojq","jaq"]),Hf="f",jf="file",N_="files",L_=new Set(["e","f"]),W_=new Set(["regexp","file"]),F_=new Set(["e","f","A","B","C","m"]),G_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Xa="__CC_SAFETY_NET_PIPE_INPUT__",Qa=/[\w./~@+-]*[./~][\w./~@+-]*/g,z_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,B_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,$_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Vf=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Kf=/\b(?:system|exec|spawn|popen)\s*$/,U_=/\b(?:eval|exec)\s*\(/g,H_=/\b(?:eval|exec)\s*$/,j_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function qf(e,t,n,r,o,i){for(let s of e){let a=s.target;if($w(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=zw(a,s.cwd,t,r,o);if(l){let c=!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(i&&(c&&r.paths.isDirectory(dp(a,s.cwd,r,o))||c&&s.written===!0&&!a.includes("$")&&!tl(a,s.cwd,r,o)||c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!tl(a,s.cwd,r,o)))continue;if(!l.startsWith("secret.cli.")&&Uw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function ip(e,t,n,r,o={}){let i=Yf(e,n,r),s=qf(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=qf(i,t,e.invocation.context.configCwd,n,r,new Set(Yf(e,n,r,{standard:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&V_(e,n)?null:a}function V_(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of _o(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(et(s.text,t))}let o=at(r);if(o.length===0)return!1;let i=Ue(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return nl(i,o.slice(1))}function nl(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>__.has(n))}function Yf(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?Rn(s.shell,e.store,r,t,o,n,K_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function K_(e){return e.program.dialect==="powershell"}function Rn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Fe;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...xw(et(e.source,r),t,n,r,o,i)],l=(c)=>et(ow(c,s),r);return Ro(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...fi(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...Y_(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...sp(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>Z_(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return ea;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{written:!0}:{}}),null}}),a}function rl(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Fe;return s.status==="complete"?Rn(s,t,n,r,o,i):null}function fi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:o});if(s?.size){let g=e.filter((h,y)=>!s.has(y));if(Uf.has(Ue(at(g)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...fi(g,t,n,r,o,i)]}let l=rw(e).map(a),c=at(e);if(c.length===0)return l;let u=c[0]??"",m=Ue(u).toLowerCase(),d=c.slice(1),f=c.findIndex((g)=>!E_.has(g));if(n.standard===!0&&f!==-1&&nl(Ue(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let p=q_(u,m,d);if(p)return[...l,...p.map(a)];if(np.has(m))return n.capturedOutput===!0?[...l,...ap(e).map(a)]:l;if(m==="eval")return[...l,...rl(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((g)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(g)?[g.slice(g.indexOf("=")+1)]:Ke(m,g)).map(a)];if(m==="git")return[...l,...sw(d).map(a)];if(m==="gh")return[...l,...el(m,d,k_).map(a)];if(Uf.has(m))return[...l,...iw(d).map(a)];if(I_.has(m))return[...l,...kw(d).map(a)];if(v_.has(m))return[...l,...uw(d,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...d.flatMap((g)=>Ke("awk",g)).map(a),...d.flatMap((g)=>mw(g,t,n,r,o,i)),...d.flatMap(fw).map(a)];if(m==="curl")return[...l,...d.flatMap((g)=>Ke(m,g)).map(a),...aw(d).map(a)];if(nr(m)){let g=er.has(m)?ve([m,...d]):null;if(g!==null&&g.command!==null&&g.commandIndex!==null){let h=t.getShellSyntax(g.command);if(h.status==="structural-limit")throw new Fe;if(h.status==="complete")return[...l,...Rn(h,t,n,r,o,i),...d.slice(g.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...dw(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((g)=>Ke(m,g)).map(a)]}function q_(e,t,n){let r=li(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function Y_(e,t,n,r,o,i,s){if(ew(t,n,r,o,i,s)){let a=at(e),l=nl(Ue(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...ap(e),...l].map((c)=>({target:c,cwd:i}))}return sp(t,X_(e),n,r,o,i,s,()=>[])}function Z_(e,t,n,r,o,i,s){let a=at(e);if(!nr(Ue(a[0]??"").toLowerCase()))return[];return rl(t,n,r,o,i,s)??[{target:t,cwd:i}]}function sp(e,t,n,r,o,i,s,a){let l=tw(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>er.has(l)?Rn(n.getShellSyntax(c),n,r,o,i,s):di(l,c,n,r,o,i,s))}function ap(e){let t=at(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase();if(!np.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[ol(r.replaceAll("%%","%"))];return t.slice(1)}function X_(e){let t=at(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return J_(r);return[]}function J_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[ol(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>Q_(t,r.slice(i*n,(i+1)*n)))}function Q_(e,t){let n=0;return ol(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function ol(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function ew(e,t,n,r,o,i){let s=at(e);if(s.length===0||Ue(s[0]??"").toLowerCase()!=="xargs")return!1;let a=$t(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Xa]:l.map((m)=>m.split(c).join(Xa));return fi(u,t,n,r,o,i).some((m)=>m.target.includes(Xa))}function tw(e){let t=at(e);if(t.length===0)return null;let n=Ue(t[0]??"").toLowerCase();if(!nr(n))return null;return nw(n,t.slice(1))?n:null}function nw(e,t){let n=il(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(op.has(o)||lp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(j_.get(n)?.has(o))r++;continue}return!1}return!0}function il(e){return/^python\d/.test(e)?"python":e}function rw(e){let t=[];for(let n of e){if(up(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Zf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function ow(e,t){if(!t||!Zf.test(e))return e;return`~${e.replace(Zf,"").replace(/\\/g,"/")}`}function Ke(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function iw(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Ke("jq",i))}return e.flatMap((r,o)=>o===t?[]:Ke("jq",r))}function sw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...O_.has(r)?el("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),M_):el("git",e.slice(n),D_)];if(t.push(...Ke("git",r)),!Se.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Ke("git",o)),n++}return t}function el(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Ke(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Ke(e,i))}return r}function aw(e){return e.flatMap((t,n)=>{let r=cw(t);if(r!==null)return Xf(r.flag,r.value);let o=lw(e[n-1]);return o===null?[]:Xf(o,t)})}function Xf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ja(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ja(t.slice(n+1))}return t.startsWith("@")?Ja(t.slice(1)):[]}function lw(e){if(e===void 0)return null;if(rp.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function cw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return rp.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ja(e){return e===""||e==="-"?[]:[e]}function uw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!x_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>R_.has(f)),m=u===-1?c:c.slice(0,u),d=fi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,g)=>{if(!w_.has(f))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function dw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(op.has(c)||lp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...di(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...di(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function lp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return T_.get(t[t.length-1]??"")?.has(il(e))??!1}function mw(e,t,n,r,o,i){if(!e.includes("system"))return[];return fa(e)?.commands.flatMap((s)=>Rn(t.getShellSyntax(s),t,n,r,o,i))??[]}function fw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function pw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(sl),...e.match(Qa)??[]]}function di(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=hw(t,gw(e));if(l===null)return pw(t).map(a);let c=l.masked.match(Vf)!==null||l.literals.some((g)=>Kf.test(l.masked.slice(0,g.start))),u=l.masked.match(U_)!==null||l.literals.some((g)=>H_.test(l.masked.slice(0,g.start))),m=r.standard===!0&&!er.has(e),d=m&&!(Sw(l.masked)||c||u)?[]:l.literals,f=m?Array.from(l.masked.matchAll(Vf),(g)=>{let h=g.index+g[0].length;return{start:h,end:Ks(l.masked,h)}}):[],p=!m||f.some((g)=>qs(l.masked,g.start))?l.literals:l.literals.filter((g)=>Kf.test(l.masked.slice(0,g.start))||f.some((h)=>g.start>=h.start&&g.start<h.end));return[...d.map((g)=>g.text).filter((g)=>g!=="").map(a),...d.flatMap((g)=>sl(g.text)).map(a),...m?[]:l.literals.flatMap((g)=>g.text.match(Qa)??[]).map(a),...c?p.flatMap((g)=>rl(g.text,n,r,o,i,s)??[a(g.text)]):[],...u?l.literals.flatMap((g)=>di(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
+`:y),n,r,o,i,s)):[],...(l.masked.match(Qa)??[]).map(a)]}function gw(e){let t=il(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function hw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(B_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&Cw(e,o))return null;let a=t==="python"?yw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=bw(e,c,l);if(u===null)return null;let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&$_.test(m))return null;r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function yw(e,t){return z_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function bw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function Cw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Sw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(A_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>P_.has(i)))continue;if(o.length>1)return!0;if(vw(e,r)===".")return!0;if(Ew(e,r+n.length)==="(")return!0}return!1}function vw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function Ew(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function xw(e,t,n,r,o,i){return Pw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Rn(a,t,{...n,capturedOutput:!0},r,o,i),...Rw(a,r)?_w(a,r).map((l)=>({target:l,cwd:o})):[]]})}function Rw(e,t){let n=_o(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||Ue(et(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=et(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function _w(e,t){return _o(e).flatMap((n)=>n.kind==="word"?[et(n.text,t)]:n.kind==="redirection"&&n.target?[et(n.target,t)]:[]).flatMap(sl)}function sl(e){let t=Aw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||ww(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function ww(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function Aw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function Pw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Wn(o,n))continue;if(cp(e,r,n)){let i=Tw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=Iw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Tw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Wn(i,n))continue;if(cp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function Iw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function cp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function kw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===N_)o=!0;if(W_.has(m))r=!0;if(d!==void 0){if(m===jf)t.push(d);continue}if(G_.has(m)){let f=e[l+1];if(m===jf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let g=0;g<m.length;g++){let h=m[g]??"";if(L_.has(h))r=!0;if(F_.has(h)){d=h,f=m.slice(g+1);break}}if(d==="")continue;if(f.length>0){if(d===Hf)t.push(f);continue}let p=e[l+1];if(d===Hf&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function at(e){let t=e.findIndex((n)=>!up(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function up(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var Ow=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Mw=".env.",Dw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Nw=[".env.example.",".env.sample."];function Lw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Ww(e){return e.length>0&&!/\s/.test(e)}function tl(e,t,n,r){let o=dp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function dp(e,t,n,r){try{return Er(e,t,n,r)}catch(o){if(o instanceof D)throw o;return""}}var Fw=new Set(["node_modules","__pycache__"]),Gw=[["vendor","bundle"],["vendor","cache"]];function zw(e,t,n,r,o){if(Lw(e))return null;let i=Ve(e,t,r,o);if(!i)return null;let s=G(i.split("/").pop()??""),a=G(i),l=()=>Ww(s)||tl(e,t,r,o);if(Dw.has(s)||Nw.some((d)=>s.startsWith(d)))return null;let c=G(Vw(e,t,r,o));for(let d of ls){let f=`~/${d.suffixParts.join("/")}`;if((Qf(a,f)||Qf(c,f))&&st(d.id,n))return d.id}let u=Bw(i,t,n,r,o);if(u)return u;if(Ow.has(s))return null;for(let d of as)if(s===d.basename&&st(d.id,n))return d.id;if(s.startsWith(Mw)&&st($r.id,n)&&l())return $r.id;for(let d of cs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&st(d.id,n)&&l())return d.id}for(let d of us)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&st(d.id,n))return d.id}if(Hw(a))return null;if(!s.includes(".")&&Fn.pattern.test(s)&&st(Fn.id,n))return Fn.id;let m=jw(s,n);if(m)return m;return null}function Bw(e,t,n,r,o){return Ur.find((i)=>{if(!st(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=G(e).split("/");return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||vr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,Ve("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Sr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=G(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=G(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?vr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,Ve(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Sr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Sr(e,s,["credentials"])||Sr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=G(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=G(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>vr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?B(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(G(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?vr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,Ve(u,t,r,o),l))}case"secret.cli.pi":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ve("~",t,r,o);return[ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Sr(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(Ve("~",t,r,o),".config","amp")],l=G(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?vr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(B(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,Ve("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||G(e).split("/").at(-1)==="mcp-auth.json"&&jt(G(e),G(a))}case"secret.cli.cursor.config":{let s=G(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=G(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,Ve("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Jf=new WeakMap;function B(e,t,n,r,o){let i=Jf.get(o)??new Map;Jf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ve(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>mp(e,ce(t,r)))}function Sr(e,t,n){return n.some((r)=>jt(G(e),G(ce(t,r))))}function vr(e,t,n,r,o){return mp(e,Ve(t,n,r,o))}function mp(e,t){return G(e)===G(t)}function ce(e,...t){return $e([e,...t].filter(Boolean).join("/"))}function $w(e,t,n,r,o,i){if(n.length===0)return!1;let s=G(Er(e,t,o,i));return n.some((a)=>jt(s,G(Er(a,r,o,i))))}function Uw(e,t,n,r,o,i){if(n.length===0)return!1;let s=G(Er(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?$e(z(Ce(a),o.paths,i)):"",c=G(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=G(u?$e(z(mi(Ce(u)),o.paths,i)):l&&$e(z(`${l}/.cc-safety-net`,o.paths,i)));if(m&&jt(s,m))return!1;return n.some((d)=>{let f=gs(d);if(f&&ep.basename(s)!==G(f.name))return!1;let p=G(Er(f?.root??d,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return jt(s,p)&&!(f&&s===p)})}function Hw(e){let t=e.split("/");return t.some((n)=>Fw.has(n))||Gw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function jw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ds)if(r===o.extension&&st(o.id,t))return o.id;for(let o of ms)if(o.pattern.test(r)&&st(o.id,t))return o.id;return null}function G(e){return e.toLowerCase()}function st(e,t){return!t?.disabledRules?.includes(e)}function Ve(e,t,n,r){let{home:o,normalized:i}=al(e,n,r);if(!i)return"";if(!o)return i;let s=ll(i,o),a=ui(s)?s:$e(mi(t,s)),l=$e(z(a,n.paths,r));if(!jt(l,o)){if(ui(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Qf(e,t){return e===t||e.startsWith(`${t}/`)}function Vw(e,t,n,r){let{home:o,normalized:i}=al(e,n,r);if(!i||!o)return"";let s=ll(i,o),a=ep.normalize(ui(s)?s:$e(mi(t,s))),l=$e(Ce(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&jt(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function Er(e,t,n,r){let{home:o,normalized:i}=al(e,n,r);if(!i)return"";let s=o?ll(i,o):i;return $e(z(ui(s)?s:mi(t,s),n.paths,r))}function al(e,t,n){let r=t.env.get("HOME")??t.home,o=r?$e(z(Ce(r),t.paths,n)):"",i=$e(Ce(Kw(et(e,t))));return{home:o,normalized:i}}function Kw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return S_(e)}catch{return e}}function ll(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function qw(e){if(process.platform==="win32")return!0;return C_.parse(e).root.length>1}function $e(e){let t=e.trim(),n=(t.includes("\\")&&qw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function Ue(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Vt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Yw={findPolicyMutation:Bf,findGitMetadataMutation:Cd,resolveGitMetadata:Zw,loadPolicySnapshot:su,findSensitiveTarget:ip,analyzeCommand:Of,getModes:Li};function fp(e,t){let n={...Yw,...t.dependencies},r=Qw(e),o=xr(e)?e.command:r,i=vt("policy-protection",o,()=>rr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(xr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:He,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Fd,intent:"stop_and_explain"}};let l=be(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:zf,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=vt("policy-protection",o,()=>Lf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Nf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let f=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...Xw(f)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:xr(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:tp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!xr(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...cl("command-validation",o),...h};let S=vt("command-analysis",o,()=>Mf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Jw(i),i.store),e.command,t.trace));if(S.decision){let E=!g.strict&&S.decision.kind==="deny"&&(S.decision.ruleId==="raw-text.dangerous-command"||S.decision.reason===ar&&!/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/.test(S.decision.evidence?.segment??"")&&Ae(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in S?{errorCode:S.errorCode}:{},decision:E?{...S.decision,ask:!0}:S.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function Zw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Xw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Jw(e){return ge(e,"declared-command")?.program}function Qw(e){try{return In(e.input)}catch(t){let n=xr(e)?e.command:void 0;throw new Vt("policy-protection",cl("policy-protection",t instanceof Ye?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Vt(e,cl(e,r instanceof Ye?void 0:t,r),r)}}function cl(e,t,n){let r=n instanceof D||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?Ci:wn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function xr(e){return e.route.kind==="command"}import{appendFileSync as mA,mkdirSync as fA}from"fs";import{isAbsolute as pA,join as ml}from"path";import{lstatSync as gp,readdirSync as eA,readFileSync as tA,rmdirSync as nA,statSync as hp,unlinkSync as rA,utimesSync as oA,writeFileSync as iA}from"fs";import{join as Rr}from"path";function pp(e,t={}){return Jr(en(e,t),e.home).policy.audit.retention_days}var dl=86400000,sA=".last-prune",aA=/^\d{4}-\d{2}$/,lA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,yp=(e)=>Math.floor(e/dl);function Cp(e,t,n=()=>new Date){try{let r=n().getTime();if(!hp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Rr(t,sA),i=hp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&yp(i)===yp(r))return;let s=r-pp(e)*dl,a=new Date(r).toISOString().slice(0,7);for(let l of ul(t)){if(l.isDirectory()){cA(Rr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))uA(Rr(t,l.name),s)}iA(o,"",{mode:384}),oA(o,r/1000,r/1000)}catch{}}function cA(e,t,n){for(let r of ul(e)){if(!r.isDirectory()||!aA.test(r.name))continue;let o=Rr(e,r.name);for(let i of ul(o)){if(!i.isFile())continue;let s=lA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+dl;if(!Number.isFinite(a)||a>=t)continue;Sp(Rr(o,i.name))}if(r.name!==n)bp(o)}bp(e)}function uA(e,t){try{let n=gp(e);if(n.mtimeMs>=t)return;let r=tA(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(dA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(gp(e).mtimeMs!==n.mtimeMs)return;Sp(e)}catch{}}function dA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function ul(e){try{return eA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Sp(e){try{rA(e)}catch{}}function bp(e){try{nA(e)}catch{}}var gA="2.4.7",hA=1e4,yA=2000,bA=256,CA=32768;function SA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function vA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function fl(e,t,n,r,o,i,s={}){let a=SA(t);if(!a)return;let l=xA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=pi(lt(n),s.failureStage?Number.POSITIVE_INFINITY:hA),m=pi(lt(r),yA),d=s.toolName?pi(lt(s.toolName),bA):void 0,f=i===null?void 0:pi(lt(i),CA),p=ml(l,vA(f?.value??null),c.slice(0,7));fA(p,{recursive:!0,mode:448});let g=ml(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Fi)(),v:gA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};mA(g,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),Cp(e,l,s.now)}catch{}}function pi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function EA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&pA(n)?n:null}function xA(e){let t=EA(e);return t?ml(t,".cc-safety-net","logs"):null}function Ep(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=vp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?vp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function vp(e){return"command"in e?e.command??"":""}function xp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;fl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Rp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;fl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function wp(e,t,n){try{let r=fp(t,{environment:e,...n.guard});return _p(e,t,r,n),r}catch(r){if(!(r instanceof Vt))throw r;throw _p(e,t,r.evaluation,n,!(r.cause instanceof Ye),{stage:r.stage,errorCode:RA(r.cause)}),r}}function _p(e,t,n,r,o=!0,i){xp(e,Ep(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function RA(e){if(e instanceof D)return V[e.kind].errorCode;if(e instanceof Ye)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}function Kt(e,t={}){return{malformed:!0,denial:An(t),cwd:e}}function Ap(e,t={}){return(n,r)=>{try{return _A(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(An())}}}function _A(e,t,n,r){let o=Xl();if(n.cancelled?.(t))return n.block(An());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Rp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=bl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=wp(o,i,{guard:{auditAllowed:Jl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Vt))throw l;if(xt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${Sl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var wA={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>PA(e,t,n),getSessionId:(e)=>kA(e),allow:{action:"allow"},block:(e)=>OA(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},Pp=AA();function AA(e={}){return Ap(wA,e)}function PA(e,t,n){if(!e||typeof e!=="object")return Kt(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Kt(null);if(!r.input||typeof r.input!=="object")return Kt(null,{toolName:r.tool});let o=TA(t,n);if(!o)return Kt(null,{toolName:r.tool});let i=IA(t,e);if(!i.ok)return Kt(o,{toolName:r.tool});if(!i.command)return Yt(r.tool,r.input,{kind:xi(r.tool)},{configCwd:o,executionCwd:o},null);if(typeof i.command.command!=="string"||i.command.command.trim()==="")return Kt(o,{toolName:r.tool});let s=typeof i.command.dir==="string"?Hl(i.command.dir,o,n):o;if(!s)return{malformed:!0,denial:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",command:i.command.command,segment:i.command.dir,toolName:r.tool},cwd:o};return Yt(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:o,executionCwd:s},i.command.command)}function TA(e,t){let n=e.system.workspaceRoot;if(!n)return;try{let r=e.helpers.filePathFromURI(n);if(typeof r!=="string"||r.trim()==="")return;return Ul(".",[r],t)}catch{return}}function IA(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function kA(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function OA(e){return{action:"reject-and-continue",message:Cl(e)}}function MA(e){e.on("tool.call",(t)=>Pp(t,e))}export{MA as default};