cc-safety-net 2.4.5 → 2.4.7

package/dist/openclaw/cc-safety-net/index.js

@@ -1,48 +1,48 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.4.5
-var al={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Ci="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",$e="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",_n="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var yi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Rn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...yi},processedCandidateBytes:{cap:4194304,...yi},pathEnvironmentExpansion:{cap:64,...yi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Rn},trackedHeredocFiles:{cap:64,...Rn},controlFlowStates:{cap:64,...Rn},wrapperPeelIterations:{cap:20,...Rn},derivedCommandShape:Rn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function ye(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var pp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function st(e){return gp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function gp(e){return pp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var hp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function yp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,hp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+// version: 2.4.7
+var hl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var bi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",He="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",_n="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Ci={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Rn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...Ci},processedCandidateBytes:{cap:4194304,...Ci},pathEnvironmentExpansion:{cap:64,...Ci},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Rn},trackedHeredocFiles:{cap:64,...Rn},controlFlowStates:{cap:64,...Rn},wrapperPeelIterations:{cap:20,...Rn},derivedCommandShape:Rn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function Ce(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var Ap=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function at(e){return Pp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Pp(e){return Ap.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Tp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Ip(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Tp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function ll(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function wn(e={}){return{reason:_n,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function cl(e){return yp({...e,redact:st})}function ul(e){return st(e instanceof Error?e.message:String(e))}import{isAbsolute as Ol,relative as jp,resolve as Vp,sep as Kp}from"node:path";import{basename as fl,dirname as Cp,isAbsolute as bp,join as Sp,normalize as vp,resolve as dl}from"node:path";var Ep=256,_r=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function at(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ei(e,t){return bi(e,0,t)}function bi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Si(e,o+2),a=xp(e,o,t);if(a===null){if(_r.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Rp(l,t,n),o=a+1;continue}let i=Si(e,o+1);if(!i){r+="$",o++;continue}r+=vi(i,n)??`$${i}`,o+=i.length+1}return r}function xp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Rp(e,t,n){let r=e.slice(2,-1),o=Si(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return vi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(_r.has(o))throw new N("pathEnvironmentExpansion");return e}if(!_r.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=vi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":bi(i.slice(s.length),t+1,n);return l?bi(i.slice(s.length),t+1,n):""}function Si(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function vi(e,t){if(!_r.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function F(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){pl(n,i);let s=t.realpath(i);if(s!==null)return ml(n,e,s,o);let a=Cp(i);if(a===i||o.length>=Ep)return ml(n,e,i,o);o.push(fl(i)),i=a}}function ml(e,t,n,r){let o=r.length===0?n:Sp(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function _p(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;pl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function pl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=hl(e,t,n);if(!o)return"";return F(o,n.paths,r).replace(/\\/g,"/")}function gl(e,t,n,r,o){let i=hl(e,t,n);if(!i)return null;if(o(fl(i)))return F(i,n.paths,r).replace(/\\/g,"/");let s=_p(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function hl(e,t,n){let r=n.home,o=Ei(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?dl(r,o.slice(2)):o,s=Ce(i);return vp(bp(s)?s:dl(t,s))}import{types as wp}from"node:util";var Pp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Ap=new Set(["command","diff","input","patch","patchtext"]),yl=new TextEncoder,Tp=new TextDecoder,Ip=/\s/,kp=64;class Ve extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Pn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Op(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Pr(e){return Pp.has(Op(e))}function Tn(e){if(!e||typeof e!=="object")return;Al(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ue();return}if(t.get||t.set)Ue();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function El(e,t){return xl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function xl(e,t,n,r){let o=Pl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=xl(a,t,n,r+1);return typeof a==="string"&&t.has(Rl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Rl(e){return e.replace(/-/g,"_").toLowerCase()}function _l(e){return wl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Np)}function wl(e,t,n,r){let o=Pl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>wl(a,o.array?t:Ap.has(Rl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Mp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Pn.maxDepth||t.nodes>Pn.maxNodes)Ue();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Pn.maxStringBytes||t.stringBytes>Pn.maxAggregateStringBytes)Ue()}function Pl(e,t,n){if(Mp(e,t,n),!e||typeof e!=="object")return null;let r=Al(e);if(t.ancestors.has(e))Ue();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Pn.maxKeys)Ue();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ue();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Al(e){if(wp.isProxy(e))Ue();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ue();return t}function Ue(){throw new Ve}function Np(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Dp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...xi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...xi(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(..._i(wr(c.slice(4),!0),wr(u.slice(4),!0))),l++;continue}if(!r)t.push(...xi(c))}return t}function Dp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function xi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return vl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return vl(n[1]);if(e.startsWith("diff --git "))return Lp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Sl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Sl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Up(i[1]);return[]}function Lp(e){let t=Wp(e);if(t.length===2&&t[0]&&t[1])return _i(t[0],t[1]);let n=Gp(e);return n?_i(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Wp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(xt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!xt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Tl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(xt(e[n]))n++;return n===e.length?t:[]}function Gp(e){let t=0;while(t<e.length&&xt(e[t]))t++;let n=e.length;while(n>t&&xt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!xt(e[o])){o++;continue}let i=o;while(o<n&&xt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>kp)Ue();if(Fp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Fp(e,t,n,r,o){if(Ri(e,t,n,r,o))return!0;let i=Cl(e,"/",t,n),s=Cl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ri(e,t,i,r,s))return!1;return Ri(e,i+1,n,s+1,o)}function Ri(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Cl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function xt(e){return e!==void 0&&Ip.test(e)}function Tl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Tp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...yl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...yl.encode(zp(s[0]??""))),o+=2}return null}function zp(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function Bp(e){return An(Hp(e))}function _i(e,t){if(e==="/dev/null")return bl(t);if(t==="/dev/null")return bl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(An);let n=$p(e,t)??(e===t?Il(e):null);return[e,t,...n?[n]:[]].flatMap(An)}function bl(e){let t=Il(e);return[e,...t?[t]:[]].flatMap(An)}function Il(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function $p(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Sl(e){return Bp(wr(e,!0))}function Up(e){return An(wr(e,!1))}function wr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Tl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Hp(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function An(e){return e===""||e==="/dev/null"?[]:[e]}function vl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function wi(e,t,n){if(at(e))return;let r=t.flatMap((i)=>kl(i,n));if(!r[0])return;let o=kl(Ol(e)?e:Vp(r[0],e),n)[0];if(!o)return;return r.some((i)=>qp(o,i))?o:void 0}function kl(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function qp(e,t){let n=jp(t,e);return n===""||n!==".."&&!n.startsWith(`..${Kp}`)&&!Ol(n)}function In(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Eg,realpathSync as xg,statSync as Rg}from"node:fs";import{homedir as _g,tmpdir as wg}from"node:os";import{statSync as bg}from"node:fs";import{join as Sg}from"node:path";import{spawnSync as Yp}from"node:child_process";import{existsSync as On,lstatSync as Zp,readFileSync as Mn,realpathSync as Yt,statSync as kn}from"node:fs";import{dirname as Pi,isAbsolute as Ai,join as Zt,resolve as Ar}from"node:path";var Xp=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Jp=5000;function Nl(e,t=gg(),n=Jp){let r=Qp(e),o=r===null?null:eg(r);if(r===null||o===null)return null;let i=fg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Qp(e){try{let t=Yt(Ar(e));return kn(t).isDirectory()?t:null}catch{return null}}function eg(e){let t=mg(e);if(!t)return null;try{let n=Zp(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Ti(t);if(!r?.commonDir)return null;if(!rg(r.gitDir,t))return null;return og(r.gitDir,Pi(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Ti(e){try{let t=tg(e);if(!t)return null;let n=Yt(Ai(t)?t:Ar(Pi(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:ng(n)}}catch{return null}}function tg(e){let t=Mn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function ng(e){try{let t=Mn(Zt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Yt(Ai(t)?t:Ar(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function rg(e,t){let n=ig(e);return n===null?!1:Dl(e,n,t)}function og(e,t){let n=sg(e);return n===null?!0:Dl(e,n,t)}function ig(e){let t=Zt(e,"gitdir");if(!On(t))return null;let n=Mn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function sg(e){let t=Zt(e,"config.worktree");return On(t)?lg(t):null}function Dl(e,t,n){try{return ag(Ai(t)?t:Ar(e,t),n)}catch{return!1}}function ag(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Ml(Yt.native(e))===Ml(Yt.native(t))}function Ml(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function lg(e){let t=Mn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=cg(s[1]??"")}return r}function cg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return dg(t.slice(1,-1))}var ug={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function dg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:ug[n]??t)}function mg(e){try{return Ii(Yt(e))}catch{return null}}function Ii(e){let t=e;while(!0){let n=Zt(t,".git");if(On(n))return n;let r=Pi(t);if(r===t)return null;t=r}}function fg(e,t,n,r){if(pg(t))return!0;if(n===null)return!0;let o=Yp(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:hg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Ll(o.stdout.trim())}function pg(e){return[Zt(e.commonDir,"config"),Zt(e.gitDir,"config.worktree")].filter((t)=>On(t)).some((t)=>yg(t))}function gg(){return Xp.find((e)=>On(e))??null}function Nn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function hg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Nn(t)))}function yg(e){let t;try{t=Mn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Cg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Ll(c)}return r}function Cg(e){return e==="include"||e.startsWith("includeif ")}function Ll(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Wl(e,t){if(e==="")return null;let n=ye(),r=Ii(se(e,e,t,n)),o=r?vg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function vg(e,t,n,r){try{let o=se(e,t,n,r),i=bg(e),s=i.isFile()?o:null,a=i.isFile()?Ti(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Xt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Xt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Xt(o),markerFile:s?Xt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=Xt(Sg(u,"hooks").replace(/\\/g,"/"));return[m,Xt(se(m,t,n,r))]}))]}}catch{return null}}function Xt(e){return process.platform==="win32"?e.toLowerCase():e}var Pg={realpath:(e)=>{try{return xg(e)}catch{return null}},entryKind:(e)=>{let t=Eg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Rg(e).isDirectory()}catch{return!1}}};function Fl(){return Ag({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ce(process.env.HOME||_g()),tmpdir:wg(),paths:Pg})}function Ag(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Gl(n,i,()=>Wl(i,o)),worktreeFacts:(i)=>Gl(r,i,()=>Nl(i)),...t};return o}function Gl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Jt=["fail_closed","paranoid_rm","paranoid_interpreters"],Tr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Ir=["standard","strict","paranoid"];function Tg(e,t){if(!t)return e;return Ir.indexOf(t)>Ir.indexOf(e)?t:e}function Ig(e){let t=Ni(Q.level,e);if(t===void 0||t==="")return;if(Ir.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Ir.join(", ")}.`);return}function kg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function zl(e){return kg(Ni(Q.auditScope,e))==="all"}function Oi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Mi(e={},t){let n=e.safety?.level??"standard",r=Ig(t),o=Tg(n,r),i=Tr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Rt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(Rt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(Rt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(Rt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Rt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Oi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Rt(e,t){let n=typeof e==="string"?ki(e,t):Ni(e,t);return n==="1"||n?.toLowerCase()==="true"}function ki(e,t){return t.get(e)}function Ni(e,t){let n=ki(e.name,t);if(n!==void 0)return n;if(e.legacyName)return ki(e.legacyName,t);return}import{dirname as Fr}from"node:path";import{closeSync as Og,constants as Bl,fstatSync as Mg,fsyncSync as eA,lstatSync as Wi,mkdirSync as tA,openSync as Ng,readdirSync as nA,readFileSync as Dg,realpathSync as Gi,renameSync as rA,rmdirSync as oA,statSync as Lg,unlinkSync as iA,writeFileSync as sA}from"node:fs";import{isAbsolute as $l,join as Fi,normalize as Wg,parse as Li,relative as zi,resolve as Bi,sep as $i}from"node:path";function Di(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Gg=Symbol("PolicyFilesystemScope"),Fg=Symbol("PolicyFilesystemTarget"),zg=Bl.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function _t(e,t){return{[Gg]:!0,root:Bi(e),label:t}}function Ul(e,t){let n=Wg(t);if(t===""||$l(t)||n===".."||n.startsWith(`..${$i}`))throw new ae(e.label);return{[Fg]:!0,scope:e,relativePath:n,path:Fi(e.root,n)}}function Dn(e,t){return Ul(e,zi(e.root,Bi(t)))}function Hl(e,t="rules policy"){let n=Bi(e),r=Li(n).dir;return Ul(_t(r,t),zi(r,n))}function Or(e){return Vl(e.scope.label,()=>{if(!kr(e))return null;let t=Ng(e.path,Bl.O_RDONLY|zg);return Bg(t,()=>{let n=Mg(t);if(!n.isFile())throw new ae(e.scope.label);let r=Dg(t,"utf-8"),o=Wi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return kr(e),r})})}function jl(e,t){if(e.path===t.path)return!0;return Vl(e.scope.label,()=>{if(!kr(e)||!kr(t))return!1;let n=(r)=>Fi(Gi(Li(r).dir),Li(r).base);return n(e.path)===n(t.path)})}function Vl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function Bg(e,t){try{return t()}finally{Og(e)}}function kr(e,t="file"){let n=$g(e.scope);if(!n)return!1;let r=e.relativePath.split($i);for(let o of r.keys()){let i=Fi(e.scope.root,...r.slice(0,o+1)),s=Wi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);Ug(n,Gi(i),e.scope.label)}return!0}function $g(e){if(!Wi(e.root,{throwIfNoEntry:!1}))return null;if(!Lg(e.root).isDirectory())throw new ae(e.label);return Gi(e.root)}function Ug(e,t,n){let r=zi(e,t);if(r===".."||r.startsWith(`..${$i}`)||$l(r))throw new ae(n)}import{dirname as Pt,isAbsolute as qg,join as Tt,relative as Yg,resolve as At,sep as Zg}from"node:path";var wt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Kl="rulebook.json",ql=".cc-safety-net/rules";var Yl=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Hg=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,jg=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Vg="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),uA=new RegExp(`^${jg}/(${wt.source.slice(1,-1)})/${Vg}$`);function Kg(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Zl(e){if(Mr(e))try{return Ui(e),null}catch(t){return t instanceof Error?t.message:String(t)}return wt.test(e)?null:`Local rulebook sources must be bare names matching ${wt}: ${e}`}function Ui(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Yl);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Hg.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!wt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Kg(o),name:o}}function Mr(e){return Yl.test(e)}var Xl="rule.json",Nr="policy.json",Jl=".cc-safety-net",Xg="rules",Jg="CC_SAFETY_NET_HOME",Ql="`cc-safety-net rule update`";function Qg(e){return At(e,ql)}function eh(e){return Tt(Qg(e),Xl)}function Ln(e){return Tt(At(e),Jl,Nr)}function Hi(e,t={}){return t.userConfigDir??(t.userConfigPath?Pt(t.userConfigPath):Tt(th(e),Xg))}function th(e){let t=e.env.get(Jg);return t?At(Ce(t)):Tt(e.home,Jl)}function nh(e,t={}){return Tt(Hi(e,t),Xl)}function Qt(e,t={}){return Tt(Pt(Hi(e,t)),Nr)}function ec(e,t){let n=t.userConfigPath??nh(e,t),r=t.projectConfigPath??eh(t.cwd),o=rh(e,t),i=oh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Dn(o,n),projectConfigTarget:Dn(i,r)}}function rh(e,t){let n=t.userConfigPath?Pt(Pt(At(t.userConfigPath))):Pt(At(t.userConfigDir??Hi(e,t)));return _t(n,"user policy")}function oh(e,t){let n=At(t),r=At(e),o=Yg(n,r);if(o!==".."&&!o.startsWith(`..${Zg}`)&&!qg(o))return _t(n,"project policy");return _t(Pt(Pt(r)),"project policy")}function tc(e,t){return Tt(e,t,Kl)}var be=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),lt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ct=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),nc=new Set(["python","python3","python2","node","ruby","perl"]),Dr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Lr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var rc="Rulebook exceeds CC Safety Net's safe validation limits.",oc="Additional rulebook validation errors were omitted.",ke=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function ic(e){if(ji(e.allowed_commands,ke.maxAllowedCommands)||ji(e.rules,ke.maxRules)||ji(e.tests,ke.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=ke,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>ke.maxStringCodeUnits||i&&o.length>ke.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>ke.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function ji(e,t){return Array.isArray(e)&&e.length>t}var Vi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ki=64,qi="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var ih={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Yi=new Set(["--init-file","--rcfile"]);function Zi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!ih[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Se(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Yi.has(l)&&!s.includes("="))i++;continue}let a=Zi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Wn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Wr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of sh(e))Wn(n,t);return t.inSingle||t.inDouble}function sh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Wn(s,n)}return t}var Xi=new Set(["rm","find","xargs","parallel"]),ah=new Set(["git","busybox",...Xi,...J,...nc,...we]),lh=new Set(["python","node","ruby","perl"]);function sc(e){let t=M(e);return ah.has(t)||Oe(t)}function Oe(e){return lh.has(ch(e))}function ch(e){let t=k(e).toLowerCase();return Dr.test(t)?"python":t}function Ji(e){try{let t=Or(uh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=fh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function uh(e){return typeof e==="string"?Hl(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function ac(e){let t=new Set;return e.flatMap((n,r)=>{let o=en(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Qi=`must be one of ${Vi.join(", ")}`,dh=/^[^/]+\/[^/]+$/,mh=["version","rules","overrides","transparent_wrappers"];function fh(e){let t=ph(e);return{errors:es(xh(t,mh,(n)=>n.kind==="custom"),": "," "),sources:Eh(e,t)}}function ph(e){if(!en(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Ki;return[...e.version===1?[]:[_(["version"],"must be 1")],...gh(e.rules,t),...Ch(e.overrides),...Sh(e.transparent_wrappers),...t?[]:yh(e.rules),...en(e.overrides)?Object.keys(e.overrides).filter((n)=>!dh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...vh(e.transparent_wrappers)]}function gh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...lc(e,Ki)?[_(["rules"],qi)]:[]];if(t)return[{path:["rules"],message:qi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...hh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function lc(e,t){let n=cc(e);return n!==void 0&&!(n<=t)}function hh(e,t){let n=cc(e);return n!==void 0&&!(n>=t)}function cc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function yh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=Zl(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Ch(e){if(e===void 0)return[];if(!en(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!en(n))return[_(["overrides",t],'must be "off" or an object')];return[...bh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||ns(n.intent)?[]:[_(["overrides",t,"intent"],Qi)]]})}function bh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...lc(e,ct)?[_(t,`must be at most ${ct} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ct?[_(t,`must be at most ${ct} characters`)]:[]}function Sh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return lt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function vh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(sc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Eh(e,t){let n=en(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function xh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function es(e,t,n){return[...new Set(e.map((r)=>{let o=ts(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ts(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function ns(e){return Vi.includes(e)}function en(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function dc(e){let t=wh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Rh=`required non-empty string up to ${ct} characters`,uc="must be a non-empty array of unique non-empty strings",_h="required non-empty array of non-empty strings";function wh(e){if(!ut(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!ic(e))return{errors:[rc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...es(Ph(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>ke.maxValidationErrors?[...t.slice(0,ke.maxValidationErrors),oc]:t,ruleNames:new Set(mc(e).map((n)=>n.toLowerCase()))}}function mc(e){let t=ut(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ut(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Ph(e,t){return[...typeof e.name==="string"&&wt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Ah(e.allowed_commands),...Th(e.rules,t),...Mh(e.tests),...Nh(e),...Dh(e)]}function Ah(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&lt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Th(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!ut(n))return[_(["rules",r],"must be an object")];return t?kh(n,["rules",r]):Ih(n,["rules",r])}),...ac(e)]}function Ih(e,t){return[...fc(e.name,t),...pc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&lt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Gr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...gc(e.reason,t),...hc(e.intent,t)]}function kh(e,t){return[...fc(e.name,t),...pc(e.command,t),...gc(e.reason,t),...hc(e.intent,t),...Oh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function fc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return wt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function pc(e,t){return typeof e==="string"&&lt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function gc(e,t){return typeof e==="string"&&e!==""&&e.length<=ct?[]:[_([...t,"reason"],Rh)]}function hc(e,t){return e===void 0||ns(e)?[]:[_([...t,"intent"],Qi)]}function Oh(e,t){if(!ut(e))return[_(t,"required object")];return[...Gr(e.command_path,[...t,"command_path"],_h,!1),...e.any_args===void 0?[]:Gr(e.any_args,[...t,"any_args"],uc,!0),...e.exclude_args===void 0?[]:Gr(e.exclude_args,[...t,"exclude_args"],uc,!0)]}function Gr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Mh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!ut(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Nh(e){if(!Array.isArray(e.tests))return[];let t=new Set(mc(e));return[...new Set(e.tests.flatMap((n)=>ut(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function Dh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=ut(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function ut(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ec(e,t){let n=ec(e,t),r=!1;try{r=jl(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ae)return Hh(n,f.message);throw f}let o=Ji(n.userConfigTarget),i=r?{config:null,errors:[]}:Ji(n.projectConfigTarget),s=Sc(n.userConfigPath,o.errors),a=Sc(n.projectConfigPath,i.errors),l=new Set,c=o.config?yc(o.config,Fr(n.userConfigPath),"user",n.userScope,l):vc(),u=i.config?yc(i.config,Fr(n.projectConfigPath),"project",n.projectScope,l):vc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Cc(c.rules,m),...Cc(u.rules,d)],transparent_wrappers:$h(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?bc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Uh(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?bc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function yc(e,t,n,r=_t(Fr(Fr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Wh(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:Lh(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Lh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Wh(e,t,n){let r=Gh(e),o=tc(t,r),i=zh(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Fh(e)}`]};let s=Bh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Gh(e){return Mr(e)?Ui(e).name:e}function Fh(e){return Mr(e)?`run ${Ql} to vendor ${e}`:"create that file or remove that source from the rules config"}function zh(e,t){try{return{content:Or(Dn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function Bh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:dc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function $h(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Cc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function bc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Uh(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Sc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Hh(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function vc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as ry,readFileSync as oy}from"node:fs";var xc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],rs=new Set(xc.map((e)=>e.id)),zr=xc,jh=new Map(zr.map((e)=>[e.id,e.intent]));function b(e,t){return{id:e,reason:t,intent:jh.get(e)??"manual_only"}}var os=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Br={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Vh=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Kh=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],is=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Kh.flatMap((e)=>Vh.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var $r=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Rc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],qh=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ss=Rc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),as=Rc.flatMap((e)=>qh.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Gn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ls=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),cs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Yh=[...os,Br,...is,...ss,...as,Gn,...ls,...cs,...$r].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Ur=new Set($r.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),us=new Set(Yh.map((e)=>e.id));import{isAbsolute as ds,join as Zh,normalize as Xh,sep as Hr}from"node:path";var _c=process.platform==="win32",Jh=/[*?]/;function Fn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ms(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Fn(e.trim(),t);if(!ds(n))return"must be an absolute path or start with ~/";return zn(n,t)}function fs(e,t){let n=wc(e,t);if(n===null)return"must be a non-empty path string";if(!ds(n))return null;if(zn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Qh="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",ey="cannot cover the guard's own configuration";function wc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Fn(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ps(e,t){let n=wc(e,t);if(n===null)return"must be a non-empty path string";if(Jh.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!ds(n))return null;if(zn(n,t)!==null)return Qh;return ty(n,t)?ey:null}function ty(e,t){let n=jr(e),r=jr(Zh(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Hr}`)}function zn(e,t){let n=jr(e),r=jr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Hr)?n:`${n}${Hr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function jr(e){let t=Xh(e);if(_c)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(_c?3:1)&&t.endsWith(Hr))t=t.slice(0,-1);return t}var Pc=30,Vr=1,Kr=365;function Ac(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Tc=new Set(zr.filter((e)=>e.catastrophic).map((e)=>e.id));function A(e,t){if(!e)return null;if(Tc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Tc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Ic(e,t){return Object.freeze(Object.fromEntries(zr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function kc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Ic(e,t)})}var Oc={standard:0,strict:1,paranoid:2};function Dc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:gs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:gs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:gs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:ny(e,t)}}function gs(e,t){return[...new Set([...e,...t??[]])]}function ny(e,t){let n=t.safety?.level,r=Tr[e.safety.level];return[...n&&Oc[n]<Oc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Jt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Mc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Mc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Ur.has(o))),...e.destructive_command_protection.enabled?Nc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Nc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Mc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Nc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Cs=new Set(["standard","strict","paranoid"]),Fc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Pc}};function zc(e,t){let n=py(Qt(e,t),e.home),r=Zr(Ln(t.cwd),e.home),o=sy(r.parsed,e.home),i=Object.keys(o.policy).length>0?Dc(n.gui??Fc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ys(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var iy="project policy audit settings are ignored; audit is user scope only";function sy(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...Cs.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Lc({overrides:Bc(n.overrides,Jt,["safety","overrides"],It)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Yr(o.overrides,rs,Uc,It)}:{},...o.allow_paths!==void 0?{allow_paths:nn(o.allow_paths,ms,t,["destructive_command_protection","allow_paths"],It)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Yr(i.overrides,us,Hc,It)}:{},...i.deny_paths!==void 0?{deny_paths:nn(i.deny_paths,fs,t,["secret_protection","deny_paths"],It)}:{},...i.allow_paths!==void 0?{allow_paths:nn(i.allow_paths,ps,t,["secret_protection","allow_paths"],It)}:{}};return{policy:Lc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[iy]}}function Bc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],bs));return[]}))}function Lc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var It=()=>{return},bs="must be a boolean",Ss="must be an object if provided",$c=`must be an integer between ${Vr} and ${Kr}`,Uc={path:["destructive_command_protection","overrides"],label:"destructive command"},Hc={path:["secret_protection","overrides"],label:"secret protection"},ay=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function ly(e,t){let n=[];return{policy:jc(e,t,(o)=>{n.push(o)}),issues:n}}function cy(e,t){return jc(e,t,It)}function jc(e,t,n){if(!ve(e))return n(_([],"Config must be an object")),qr();if(e.version!==1)n(_(["version"],"must be 1"));let r=tn(e.safety,["safety"],["level","overrides"],n),o=tn(r.overrides,["safety","overrides"],Jt,n),i=tn(e.workflow,["workflow"],["worktree_mode"],n),s=tn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=tn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=tn(e.audit,["audit"],["retention_days"],n);return Vc(e,ay,[],n),{version:1,safety:{level:uy(r.level,n),overrides:Bc(o,Jt,["safety","overrides"],n)},workflow:{worktree_mode:hs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:hs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Yr(s.overrides,rs,Uc,n),allow_paths:nn(s.allow_paths,ms,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:hs(a.enabled,["secret_protection","enabled"],!0,n),overrides:Yr(a.overrides,us,Hc,n),deny_paths:nn(a.deny_paths,fs,t,["secret_protection","deny_paths"],n),allow_paths:nn(a.allow_paths,ps,t,["secret_protection","allow_paths"],n)},audit:{retention_days:dy(l.retention_days,n)}}}function tn(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(t,Ss)),{};return Vc(e,n,t,r),e}function Vc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function uy(e,t){if(e===void 0)return"standard";if(Cs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function hs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,bs));return n}function dy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Vr&&e<=Kr))t(_(["audit","retention_days"],$c));return Ac(e)}function Yr(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(n.path,Ss)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function nn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function qr(){return structuredClone(Fc)}function Zr(e,t){if(!ry(e))return{exists:!1,policy:qr(),errors:[]};try{let n=oy(e,"utf-8");if(!n.trim())return{exists:!0,policy:qr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=ly(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${fy(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:qr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var my=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ss,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[bs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[$c,`not an integer between ${Vr} and ${Kr}`]]);function fy(e){let t=ts(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=my.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function py(e,t){let n=Zr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:Gc(),errors:[]};let o=cy(r,t);return{policy:ys(o),gui:o,errors:[],levelPresent:Wc(r)}}if(n.parsed===void 0)return{policy:Gc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ys(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Wc(n.parsed)}}function Wc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return Cs.has(t.level)}function Kc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Ur].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Gc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Kc({}),denyPaths:[],allowPaths:[]}}}function ys(e){return{safety:gy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Kc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function gy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function qc(e,t){let n=Ec(e,t),r=zc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...by(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Sy(o,hy(n,r),s,r.policyScopes)}function hy(e,t){let n=Cy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:vy(e.errors.length>0?yy(e.errors):void 0,e.warnings.length>0?Es(e.warnings.join("; ")):void 0,n)}}function yy(e){return`${Es(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Cy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function by(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Sy(e,t,n=Object.freeze({}),r){let o=vs(structuredClone(e)),i=r?{policyScopes:vs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function vs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))vs(t);return Object.freeze(e)}function vy(...e){return Es(e.filter((t)=>!!t).join("; "))}function Es(e){return/[.!?]$/.test(e)?e:`${e}.`}function Yc(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:xs(t.fail_closed,e.strict,"strict"),paranoid_rm:xs(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:xs(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:kc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Oi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function xs(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Bn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Ey=/^[A-Za-z_][A-Za-z0-9_]*=/;function Xr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function $n(e){let t=Xr(e.words[0],"time")?1:0,n=t===1&&Xr(e.words[t],"-p")?t+1:t,r=t===1&&Xr(e.words[n],"--")?n+1:n,o=Xr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Ey.test(s.text));return i?.provenance==="literal"?i.text:void 0}var dt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Jr(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function xy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>me(t)))})}function Qr(e,t,n){e.push(n),t.reset()}function eo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Rs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function rn(e,t,n,r,o,i,s){return Rs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function me(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return xy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:me(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function _s(e,t,n){if(t>=n||Xc(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!Xc(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Zc(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Zc(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function ws(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Ry(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?_y(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Zc(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function Xc(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Ry(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function _y(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var tu=new Set(["&&","||","|","|&"]);function nu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=ro(e,0,e.length,t,{used:0,max:t.maxWords},0);return me({kind:"program",dialect:"posix",source:e,span:n,status:so(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function ro(e,t,n,r,o,i,s){let a=[],l=[],c=Jr(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((h)=>h.text);Qr(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),eu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(io(f)){if(f===`
-`||f==="\r"){m();let S=f==="\r"&&e[d+1]===`
-`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!tu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,S),span:Object.freeze({start:d,end:S})}));if(u.length>0){let x=ws(e,S,n,u.splice(0));l.push(...x.issues),d=x.next;continue}d=S;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
-`&&e[d]!=="\r")d++;continue}let p=c.start===-1?Vy(e,d,n):void 0;if(p){if(As(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);if(!Ps(o))return on(a,l,d,"word-limit",r.maxWords);let S=ro(e,p.braceIndex+1,n,r,o,i+1,"}"),T=S.next,x={start:p.braceIndex+1,end:S.closed?T-1:T},P=Jc(e,x,S);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:P}),l.push(...S.issues),S.pendingHeredocs.length>0||Hn(S.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...S.pendingHeredocs),S.limited)return no(a,l,S.next);if(!S.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let h=oo(e,d);if(h){if(m(),!uu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:d,end:d+h.length})})),d+=h.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&My(e,d,n))&&c.start===-1){if(As(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);let S=f==="("?")":"}",T=ro(e,d+1,n,r,o,i+1,S),x=T.next,P={start:d+1,end:T.closed?x-1:x},q=Jc(e,P,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:x},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Hn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return no(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=x;continue}let g=(f==="<"||f===">")&&e[d+1]!=="("?Ty(e,d):null;if(g){let S=c.words.at(-1),T=S&&S.span.end===d&&/^[0-9]+$/.test(S.raw)?Number(S.raw):void 0;if(T!==void 0)c.words.pop();let x=T===void 0?d:S?.span.start??d;c.start=c.start===-1?d:c.start;let P=d+g.length;while(P<n&&/[ \t]/.test(e[P]??""))P++;let q=e[P],Z=P>d+g.length&&q==="#",ee=!q||io(q)||!!oo(e,P)||q===s||q===")"||Z||(q==="<"||q===">")&&e[P+1]!=="(",X=g==="<<"||g==="<<-",U=X?_s(e,P,n):void 0,D=U?{word:rn(e,P,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Ts(e,P,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return no(a,l,D.next);if(!Ps(o))return on(a,l,D.next,"word-limit",r.maxWords)}let ce=D?.next??d+g.length,_e={kind:"redirection",operator:g,span:{start:x,end:ce},...T===void 0?{}:{fd:T},...D?{target:D.word}:{}};if(c.redirections.push(_e),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let je=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:g==="<<-",attach:(Ie)=>{if(_e.heredoc=Ie,Ie.quotedDelimiter)return;je.push(...Py(e,Ie.bodySpan.start,Ie.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`});if(D)c.nested.push(...D.nested);c.end=ce,d=ce;continue}if(c.start===-1)As(a,l);let y=Ts(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return no(a,l,y.next);let v=Ly(c.words)?By(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return on(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let S of E){if(!Ps(o))return on(a,l,y.next,"word-limit",r.maxWords);c.words.push(S)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return m(),eu(a,l),l.push(...Ky(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Jc(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:so(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ts(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||io(f)||(f===";"||f==="|"||f==="&")&&oo(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(f==='"'){l=!0;let g=wy(e,a,n,r,o,i);if(s+=g.text,u.push(...g.nested),m.push(...g.issues),d||=g.limited,c=Un(c,g.provenance),a=g.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Iy(e,a+2,n);if(s+=g.text,m.push(...g.issues),!g.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=g.next;continue}if(f==="\\"){let g=e[a+1];if(!g){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(g===`
-`){a+=2;continue}s+=g,a+=2;continue}let h=f==="$"||f==="<"||f===">"||f==="`"?ao(e,a,n,r,o,i):null;if(h){let g=ru(h,u,m);if(d||=g.limited,c=Un(c,g.provenance),a=g.next,d)break;continue}if(f==="$"){let g=su(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(f==="*"||f==="?"||f==="[")c=Un(c,"glob");s+=f,a++}return{word:rn(e,t,a,s,c,l,c==="literal"?void 0:Oy(e,t,a)),nested:u,issues:m,next:a,limited:d}}function wy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
-`){m+=2;continue}if(p==="\r"&&e[m+2]===`
-`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=Is(e,m+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(m,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=h;continue}let f=ao(e,m,n,r,o,i);if(f){let p=ru(f,l,c);if(m=p.next,u||=p.limited,a=Un(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=su(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function ao(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=Is(e,t+u,n,m),f=d===-1?n:d,p=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:jy(e,t+u,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],S=!1,T=t+u;while(T<f){let x=ao(e,T,f,r,o,i+1);if(!x){T++;continue}if(v.push(...x.program.nodes),E.push(...x.program.issues),S||=x.program.status==="limited",T=x.next,S)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:so(E,S),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=ro(e,t+u,f,r,o,i+1),g=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Hn(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:so([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function Py(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?ao(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function ru(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Is(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`)}function yl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.ask?{ask:!0}:{}}}function wn(e={}){return{reason:_n,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function Cl(e){return Ip({...e,redact:at})}function bl(e){return at(e instanceof Error?e.message:String(e))}import{isAbsolute as Bl,relative as og,resolve as ig,sep as sg}from"node:path";import{basename as El,dirname as kp,isAbsolute as Op,join as Mp,normalize as Np,resolve as Sl}from"node:path";var Dp=256,wr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function be(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function lt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function xi(e,t){return Si(e,0,t)}function Si(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=vi(e,o+2),a=Lp(e,o,t);if(a===null){if(wr.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Wp(l,t,n),o=a+1;continue}let i=vi(e,o+1);if(!i){r+="$",o++;continue}r+=Ei(i,n)??`$${i}`,o+=i.length+1}return r}function Lp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Wp(e,t,n){let r=e.slice(2,-1),o=vi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ei(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(wr.has(o))throw new N("pathEnvironmentExpansion");return e}if(!wr.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=Ei(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Si(i.slice(s.length),t+1,n);return l?Si(i.slice(s.length),t+1,n):""}function vi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ei(e,t){if(!wr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function z(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){xl(n,i);let s=t.realpath(i);if(s!==null)return vl(n,e,s,o);let a=kp(i);if(a===i||o.length>=Dp)return vl(n,e,i,o);o.push(El(i)),i=a}}function vl(e,t,n,r){let o=r.length===0?n:Mp(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Gp(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;xl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function xl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=_l(e,t,n);if(!o)return"";return z(o,n.paths,r).replace(/\\/g,"/")}function Rl(e,t,n,r,o){let i=_l(e,t,n);if(!i)return null;if(o(El(i)))return z(i,n.paths,r).replace(/\\/g,"/");let s=Gp(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function _l(e,t,n){let r=n.home,o=xi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Sl(r,o.slice(2)):o,s=be(i);return Np(Op(s)?s:Sl(t,s))}import{types as Fp}from"node:util";var zp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Bp=new Set(["command","diff","input","patch","patchtext"]),wl=new TextEncoder,$p=new TextDecoder,Up=/\s/,Hp=64;class Ye extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var An=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function jp(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Pr(e){return zp.has(jp(e))}function Tn(e){if(!e||typeof e!=="object")return;Wl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)je();return}if(t.get||t.set)je();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function kl(e,t){return Ol(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Ol(e,t,n,r){let o=Ll(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Ol(a,t,n,r+1);return typeof a==="string"&&t.has(Ml(s))?[a]:l});return n.ancestors.delete(o.object),i}function Ml(e){return e.replace(/-/g,"_").toLowerCase()}function Nl(e){return Dl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Kp)}function Dl(e,t,n,r){let o=Ll(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Dl(a,o.array?t:Bp.has(Ml(s)),n,r+1));return n.ancestors.delete(o.object),i}function Vp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>An.maxDepth||t.nodes>An.maxNodes)je();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>An.maxStringBytes||t.stringBytes>An.maxAggregateStringBytes)je()}function Ll(e,t,n){if(Vp(e,t,n),!e||typeof e!=="object")return null;let r=Wl(e);if(t.ancestors.has(e))je();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>An.maxKeys)je();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)je();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Wl(e){if(Fp.isProxy(e))je();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)je();return t}function je(){throw new Ye}function Kp(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=qp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ri(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ri(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...wi(Ar(c.slice(4),!0),Ar(u.slice(4),!0))),l++;continue}if(!r)t.push(...Ri(c))}return t}function qp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ri(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Il(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Il(n[1]);if(e.startsWith("diff --git "))return Yp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Tl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Tl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return ng(i[1]);return[]}function Yp(e){let t=Zp(e);if(t.length===2&&t[0]&&t[1])return wi(t[0],t[1]);let n=Xp(e);return n?wi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Zp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(xt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!xt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Gl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(xt(e[n]))n++;return n===e.length?t:[]}function Xp(e){let t=0;while(t<e.length&&xt(e[t]))t++;let n=e.length;while(n>t&&xt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!xt(e[o])){o++;continue}let i=o;while(o<n&&xt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Hp)je();if(Jp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Jp(e,t,n,r,o){if(_i(e,t,n,r,o))return!0;let i=Al(e,"/",t,n),s=Al(e,"/",r,o);if(i<=t||s<=r)return!1;if(_i(e,t,i,r,s))return!1;return _i(e,i+1,n,s+1,o)}function _i(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Al(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function xt(e){return e!==void 0&&Up.test(e)}function Gl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:$p.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...wl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...wl.encode(Qp(s[0]??""))),o+=2}return null}function Qp(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function eg(e){return Pn(rg(e))}function wi(e,t){if(e==="/dev/null")return Pl(t);if(t==="/dev/null")return Pl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Pn);let n=tg(e,t)??(e===t?Fl(e):null);return[e,t,...n?[n]:[]].flatMap(Pn)}function Pl(e){let t=Fl(e);return[e,...t?[t]:[]].flatMap(Pn)}function Fl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function tg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Tl(e){return eg(Ar(e,!0))}function ng(e){return Pn(Ar(e,!1))}function Ar(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Gl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function rg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Pn(e){return e===""||e==="/dev/null"?[]:[e]}function Il(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function Ai(e,t,n){if(lt(e))return;let r=t.flatMap((i)=>zl(i,n));if(!r[0])return;let o=zl(Bl(e)?e:ig(r[0],e),n)[0];if(!o)return;return r.some((i)=>ag(o,i))?o:void 0}function zl(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function ag(e,t){let n=og(t,e);return n===""||n!==".."&&!n.startsWith(`..${sg}`)&&!Bl(n)}function In(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Dg,realpathSync as Lg,statSync as Wg}from"node:fs";import{homedir as Gg,tmpdir as Fg}from"node:os";import{statSync as Og}from"node:fs";import{join as Mg}from"node:path";import{spawnSync as lg}from"node:child_process";import{existsSync as On,lstatSync as cg,readFileSync as Mn,realpathSync as Yt,statSync as kn}from"node:fs";import{dirname as Pi,isAbsolute as Ti,join as Zt,resolve as Tr}from"node:path";var ug=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],dg=5000;function Ul(e,t=Pg(),n=dg){let r=fg(e),o=r===null?null:mg(r);if(r===null||o===null)return null;let i=wg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function fg(e){try{let t=Yt(Tr(e));return kn(t).isDirectory()?t:null}catch{return null}}function mg(e){let t=_g(e);if(!t)return null;try{let n=cg(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Ii(t);if(!r?.commonDir)return null;if(!hg(r.gitDir,t))return null;return yg(r.gitDir,Pi(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Ii(e){try{let t=pg(e);if(!t)return null;let n=Yt(Ti(t)?t:Tr(Pi(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:gg(n)}}catch{return null}}function pg(e){let t=Mn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function gg(e){try{let t=Mn(Zt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Yt(Ti(t)?t:Tr(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function hg(e,t){let n=Cg(e);return n===null?!1:Hl(e,n,t)}function yg(e,t){let n=bg(e);return n===null?!0:Hl(e,n,t)}function Cg(e){let t=Zt(e,"gitdir");if(!On(t))return null;let n=Mn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function bg(e){let t=Zt(e,"config.worktree");return On(t)?vg(t):null}function Hl(e,t,n){try{return Sg(Ti(t)?t:Tr(e,t),n)}catch{return!1}}function Sg(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return $l(Yt.native(e))===$l(Yt.native(t))}function $l(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function vg(e){let t=Mn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Eg(s[1]??"")}return r}function Eg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Rg(t.slice(1,-1))}var xg={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function Rg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:xg[n]??t)}function _g(e){try{return ki(Yt(e))}catch{return null}}function ki(e){let t=e;while(!0){let n=Zt(t,".git");if(On(n))return n;let r=Pi(t);if(r===t)return null;t=r}}function wg(e,t,n,r){if(Ag(t))return!0;if(n===null)return!0;let o=lg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Tg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&jl(o.stdout.trim())}function Ag(e){return[Zt(e.commonDir,"config"),Zt(e.gitDir,"config.worktree")].filter((t)=>On(t)).some((t)=>Ig(t))}function Pg(){return ug.find((e)=>On(e))??null}function Nn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Tg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Nn(t)))}function Ig(e){let t;try{t=Mn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(kg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=jl(c)}return r}function kg(e){return e==="include"||e.startsWith("includeif ")}function jl(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Vl(e,t){if(e==="")return null;let n=Ce(),r=ki(se(e,e,t,n)),o=r?Ng(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Ng(e,t,n,r){try{let o=se(e,t,n,r),i=Og(e),s=i.isFile()?o:null,a=i.isFile()?Ii(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Xt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Xt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Xt(o),markerFile:s?Xt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let f=Xt(Mg(u,"hooks").replace(/\\/g,"/"));return[f,Xt(se(f,t,n,r))]}))]}}catch{return null}}function Xt(e){return process.platform==="win32"?e.toLowerCase():e}var zg={realpath:(e)=>{try{return Lg(e)}catch{return null}},entryKind:(e)=>{let t=Dg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Wg(e).isDirectory()}catch{return!1}}};function ql(){return Bg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:be(process.env.HOME||Gg()),tmpdir:Fg(),paths:zg})}function Bg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Kl(n,i,()=>Vl(i,o)),worktreeFacts:(i)=>Kl(r,i,()=>Ul(i)),...t};return o}function Kl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Jt=["fail_closed","paranoid_rm","paranoid_interpreters"],Ir={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},kr=["standard","strict","paranoid"];function $g(e,t){if(!t)return e;return kr.indexOf(t)>kr.indexOf(e)?t:e}function Ug(e){let t=Di(Q.level,e);if(t===void 0||t==="")return;if(kr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${kr.join(", ")}.`);return}function Hg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Yl(e){return Hg(Di(Q.auditScope,e))==="all"}function Mi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Ni(e={},t){let n=e.safety?.level??"standard",r=Ug(t),o=$g(n,r),i=Ir[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Rt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(Rt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(Rt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(Rt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Rt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Mi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Rt(e,t){let n=typeof e==="string"?Oi(e,t):Di(e,t);return n==="1"||n?.toLowerCase()==="true"}function Oi(e,t){return t.get(e)}function Di(e,t){let n=Oi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Oi(e.legacyName,t);return}import{dirname as zr}from"node:path";import{closeSync as jg,constants as Zl,fstatSync as Vg,fsyncSync as mP,lstatSync as Gi,mkdirSync as pP,openSync as Kg,readdirSync as gP,readFileSync as qg,realpathSync as Fi,renameSync as hP,rmdirSync as yP,statSync as Yg,unlinkSync as CP,writeFileSync as bP}from"node:fs";import{isAbsolute as Xl,join as zi,normalize as Zg,parse as Wi,relative as Bi,resolve as $i,sep as Ui}from"node:path";function Li(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Xg=Symbol("PolicyFilesystemScope"),Jg=Symbol("PolicyFilesystemTarget"),Qg=Zl.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function _t(e,t){return{[Xg]:!0,root:$i(e),label:t}}function Jl(e,t){let n=Zg(t);if(t===""||Xl(t)||n===".."||n.startsWith(`..${Ui}`))throw new ae(e.label);return{[Jg]:!0,scope:e,relativePath:n,path:zi(e.root,n)}}function Dn(e,t){return Jl(e,Bi(e.root,$i(t)))}function Ql(e,t="rules policy"){let n=$i(e),r=Wi(n).dir;return Jl(_t(r,t),Bi(r,n))}function Mr(e){return tc(e.scope.label,()=>{if(!Or(e))return null;let t=Kg(e.path,Zl.O_RDONLY|Qg);return eh(t,()=>{let n=Vg(t);if(!n.isFile())throw new ae(e.scope.label);let r=qg(t,"utf-8"),o=Gi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return Or(e),r})})}function ec(e,t){if(e.path===t.path)return!0;return tc(e.scope.label,()=>{if(!Or(e)||!Or(t))return!1;let n=(r)=>zi(Fi(Wi(r).dir),Wi(r).base);return n(e.path)===n(t.path)})}function tc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function eh(e,t){try{return t()}finally{jg(e)}}function Or(e,t="file"){let n=th(e.scope);if(!n)return!1;let r=e.relativePath.split(Ui);for(let o of r.keys()){let i=zi(e.scope.root,...r.slice(0,o+1)),s=Gi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);nh(n,Fi(i),e.scope.label)}return!0}function th(e){if(!Gi(e.root,{throwIfNoEntry:!1}))return null;if(!Yg(e.root).isDirectory())throw new ae(e.label);return Fi(e.root)}function nh(e,t,n){let r=Bi(e,t);if(r===".."||r.startsWith(`..${Ui}`)||Xl(r))throw new ae(n)}import{dirname as At,isAbsolute as ah,join as Tt,relative as lh,resolve as Pt,sep as ch}from"node:path";var wt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,nc="rulebook.json",rc=".cc-safety-net/rules";var oc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var rh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,oh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),ih="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),xP=new RegExp(`^${oh}/(${wt.source.slice(1,-1)})/${ih}$`);function sh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function ic(e){if(Nr(e))try{return Hi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return wt.test(e)?null:`Local rulebook sources must be bare names matching ${wt}: ${e}`}function Hi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(oc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!rh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!wt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:sh(o),name:o}}function Nr(e){return oc.test(e)}var sc="rule.json",Dr="policy.json",ac=".cc-safety-net",uh="rules",dh="CC_SAFETY_NET_HOME",lc="`cc-safety-net rule update`";function fh(e){return Pt(e,rc)}function mh(e){return Tt(fh(e),sc)}function Ln(e){return Tt(Pt(e),ac,Dr)}function ji(e,t={}){return t.userConfigDir??(t.userConfigPath?At(t.userConfigPath):Tt(ph(e),uh))}function ph(e){let t=e.env.get(dh);return t?Pt(be(t)):Tt(e.home,ac)}function gh(e,t={}){return Tt(ji(e,t),sc)}function Qt(e,t={}){return Tt(At(ji(e,t)),Dr)}function cc(e,t){let n=t.userConfigPath??gh(e,t),r=t.projectConfigPath??mh(t.cwd),o=hh(e,t),i=yh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Dn(o,n),projectConfigTarget:Dn(i,r)}}function hh(e,t){let n=t.userConfigPath?At(At(Pt(t.userConfigPath))):At(Pt(t.userConfigDir??ji(e,t)));return _t(n,"user policy")}function yh(e,t){let n=Pt(t),r=Pt(e),o=lh(n,r);if(o!==".."&&!o.startsWith(`..${ch}`)&&!ah(o))return _t(n,"project policy");return _t(At(At(r)),"project policy")}function uc(e,t){return Tt(e,t,nc)}var Se=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ct=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ut=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),dc=new Set(["python","python3","python2","node","ruby","perl"]),Lr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Wr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var fc="Rulebook exceeds CC Safety Net's safe validation limits.",mc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function pc(e){if(Vi(e.allowed_commands,Oe.maxAllowedCommands)||Vi(e.rules,Oe.maxRules)||Vi(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Vi(e,t){return Array.isArray(e)&&e.length>t}var Ki=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var qi=64,Yi="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function fe(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Ch={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Zi=new Set(["--init-file","--rcfile"]);function Xi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let f=t.slice(c+1);if(t[0]==="-"&&(f==="c"||f[0]==="-"&&f.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!Ch[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function ve(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Zi.has(l)&&!s.includes("="))i++;continue}let a=Xi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Wn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Gr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of bh(e))Wn(n,t);return t.inSingle||t.inDouble}function bh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Wn(s,n)}return t}var Ji=new Set(["rm","find","xargs","parallel"]),Sh=new Set(["git","busybox",...Ji,...J,...dc,...we]),vh=new Set(["python","node","ruby","perl"]);function gc(e){let t=M(e);return Sh.has(t)||Me(t)}function Me(e){return vh.has(Eh(e))}function Eh(e){let t=k(e).toLowerCase();return Lr.test(t)?"python":t}function Qi(e){try{let t=Mr(xh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=wh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function xh(e){return typeof e==="string"?Ql(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function hc(e){let t=new Set;return e.flatMap((n,r)=>{let o=en(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var es=`must be one of ${Ki.join(", ")}`,Rh=/^[^/]+\/[^/]+$/,_h=["version","rules","overrides","transparent_wrappers"];function wh(e){let t=Ah(e);return{errors:ts(Lh(t,_h,(n)=>n.kind==="custom"),": "," "),sources:Dh(e,t)}}function Ah(e){if(!en(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>qi;return[...e.version===1?[]:[_(["version"],"must be 1")],...Ph(e.rules,t),...kh(e.overrides),...Mh(e.transparent_wrappers),...t?[]:Ih(e.rules),...en(e.overrides)?Object.keys(e.overrides).filter((n)=>!Rh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Nh(e.transparent_wrappers)]}function Ph(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...yc(e,qi)?[_(["rules"],Yi)]:[]];if(t)return[{path:["rules"],message:Yi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...Th(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function yc(e,t){let n=Cc(e);return n!==void 0&&!(n<=t)}function Th(e,t){let n=Cc(e);return n!==void 0&&!(n>=t)}function Cc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Ih(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=ic(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function kh(e){if(e===void 0)return[];if(!en(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!en(n))return[_(["overrides",t],'must be "off" or an object')];return[...Oh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||rs(n.intent)?[]:[_(["overrides",t,"intent"],es)]]})}function Oh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...yc(e,ut)?[_(t,`must be at most ${ut} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ut?[_(t,`must be at most ${ut} characters`)]:[]}function Mh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return ct.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Nh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ct.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(gc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Dh(e,t){let n=en(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Lh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function ts(e,t,n){return[...new Set(e.map((r)=>{let o=ns(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ns(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function rs(e){return Ki.includes(e)}function en(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Sc(e){let t=Fh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Wh=`required non-empty string up to ${ut} characters`,bc="must be a non-empty array of unique non-empty strings",Gh="required non-empty array of non-empty strings";function Fh(e){if(!dt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!pc(e))return{errors:[fc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ts(zh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),mc]:t,ruleNames:new Set(vc(e).map((n)=>n.toLowerCase()))}}function vc(e){let t=dt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=dt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function zh(e,t){return[...typeof e.name==="string"&&wt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Bh(e.allowed_commands),...$h(e.rules,t),...Vh(e.tests),...Kh(e),...qh(e)]}function Bh(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ct.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ct.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function $h(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!dt(n))return[_(["rules",r],"must be an object")];return t?Hh(n,["rules",r]):Uh(n,["rules",r])}),...hc(e)]}function Uh(e,t){return[...Ec(e.name,t),...xc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ct.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Fr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Rc(e.reason,t),..._c(e.intent,t)]}function Hh(e,t){return[...Ec(e.name,t),...xc(e.command,t),...Rc(e.reason,t),..._c(e.intent,t),...jh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function Ec(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return wt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function xc(e,t){return typeof e==="string"&&ct.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function Rc(e,t){return typeof e==="string"&&e!==""&&e.length<=ut?[]:[_([...t,"reason"],Wh)]}function _c(e,t){return e===void 0||rs(e)?[]:[_([...t,"intent"],es)]}function jh(e,t){if(!dt(e))return[_(t,"required object")];return[...Fr(e.command_path,[...t,"command_path"],Gh,!1),...e.any_args===void 0?[]:Fr(e.any_args,[...t,"any_args"],bc,!0),...e.exclude_args===void 0?[]:Fr(e.exclude_args,[...t,"exclude_args"],bc,!0)]}function Fr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Vh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!dt(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Kh(e){if(!Array.isArray(e.tests))return[];let t=new Set(vc(e));return[...new Set(e.tests.flatMap((n)=>dt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function qh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=dt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function dt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function kc(e,t){let n=cc(e,t),r;try{r=ec(n.userConfigTarget,n.projectConfigTarget)}catch(m){if(m instanceof ae)return ry(n,m.message);throw m}let o=Qi(n.userConfigTarget),i=r?{config:null,errors:[]}:Qi(n.projectConfigTarget),s=Tc(n.userConfigPath,o.errors),a=Tc(n.projectConfigPath,i.errors),l=new Set,c=o.config?wc(o.config,zr(n.userConfigPath),"user",n.userScope,l):Ic(),u=i.config?wc(i.config,zr(n.projectConfigPath),"project",n.projectScope,l):Ic(),f=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Ac(c.rules,f),...Ac(u.rules,d)],transparent_wrappers:ty(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?Pc(f,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?ny(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?Pc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function wc(e,t,n,r=_t(zr(zr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Zh(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let f=u.rulebook;if(o.has(f.name))return s.push(`duplicate active rulebook name "${f.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(f.name),[{rules:Yh(f),rulebook:{source:n,spec:c,name:f.name,version:f.version,rules:f.rules.map((d)=>`${f.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Yh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Zh(e,t,n){let r=Xh(e),o=uc(t,r),i=Qh(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Jh(e)}`]};let s=ey(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Xh(e){return Nr(e)?Hi(e).name:e}function Jh(e){return Nr(e)?`run ${lc} to vendor ${e}`:"create that file or remove that source from the rules config"}function Qh(e,t){try{return{content:Mr(Dn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function ey(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Sc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function ty(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Ac(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Pc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function ny(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Tc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function ry(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Ic(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as gy,readFileSync as hy}from"node:fs";var Oc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],os=new Set(Oc.map((e)=>e.id)),Br=Oc,oy=new Map(Br.map((e)=>[e.id,e.intent]));function b(e,t){return{id:e,reason:t,intent:oy.get(e)??"manual_only"}}var is=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],$r={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},iy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],sy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ss=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...sy.flatMap((e)=>iy.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Ur=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Mc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],ay=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],as=Mc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ls=Mc.flatMap((e)=>ay.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Gn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},cs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),us=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],ly=[...is,$r,...ss,...as,...ls,Gn,...cs,...us,...Ur].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Hr=new Set(Ur.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),ds=new Set(ly.map((e)=>e.id));import{isAbsolute as fs,join as cy,normalize as uy,sep as jr}from"node:path";var Vr=process.platform==="win32",Nc=/[*?]/;function ms(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Vr?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(Nc.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Fn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ps(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Fn(e.trim(),t);if(!fs(n))return"must be an absolute path or start with ~/";return zn(n,t)}function gs(e,t){let n=Dc(e,t);if(n===null)return"must be a non-empty path string";if(!fs(n))return null;if(zn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var dy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",fy="cannot cover the guard's own configuration";function Dc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=Vr?n.replaceAll("\\","/"):n;return Fn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function hs(e,t){let n=Dc(e,t);if(n===null)return"must be a non-empty path string";let r=ms(n)?.root??n;if(Nc.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!fs(r))return null;if(zn(r,t)!==null)return dy;return my(r,t)?fy:null}function my(e,t){let n=Kr(e),r=Kr(cy(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${jr}`)}function zn(e,t){let n=Kr(e),r=Kr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(jr)?n:`${n}${jr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Kr(e){let t=uy(e);if(Vr)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Vr?3:1)&&t.endsWith(jr))t=t.slice(0,-1);return t}var Lc=30,qr=1,Yr=365;function Wc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Gc=new Set(Br.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(Gc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Gc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Fc(e,t){return Object.freeze(Object.fromEntries(Br.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function zc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Fc(e,t)})}var Bc={standard:0,strict:1,paranoid:2};function Hc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:ys(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:ys(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:ys(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:py(e,t)}}function ys(e,t){return[...new Set([...e,...t??[]])]}function py(e,t){let n=t.safety?.level,r=Ir[e.safety.level];return[...n&&Bc[n]<Bc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Jt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...$c(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...$c(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Hr.has(o))),...e.destructive_command_protection.enabled?Uc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Uc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function $c(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Uc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Ss=new Set(["standard","strict","paranoid"]),qc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Lc}};function Yc(e,t){let n=wy(Qt(e,t),e.home),r=Jr(Ln(t.cwd),e.home),o=Cy(r.parsed,e.home),i=Object.keys(o.policy).length>0?Hc(n.gui??qc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?bs(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var yy="project policy audit settings are ignored; audit is user scope only";function Cy(e,t){if(!Ee(e))return{policy:{},diagnostics:[]};let n=Ee(e.safety)?e.safety:{},r=Ee(e.workflow)?e.workflow:{},o=Ee(e.destructive_command_protection)?e.destructive_command_protection:{},i=Ee(e.secret_protection)?e.secret_protection:{},s={...Ss.has(n.level)?{level:n.level}:{},...Ee(n.overrides)?jc({overrides:Zc(n.overrides,Jt,["safety","overrides"],It)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Xr(o.overrides,os,Jc,It)}:{},...o.allow_paths!==void 0?{allow_paths:nn(o.allow_paths,ps,t,["destructive_command_protection","allow_paths"],It)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Xr(i.overrides,ds,Qc,It)}:{},...i.deny_paths!==void 0?{deny_paths:nn(i.deny_paths,gs,t,["secret_protection","deny_paths"],It)}:{},...i.allow_paths!==void 0?{allow_paths:nn(i.allow_paths,hs,t,["secret_protection","allow_paths"],It)}:{}};return{policy:jc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[yy]}}function Zc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],vs));return[]}))}function jc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var It=()=>{return},vs="must be a boolean",Es="must be an object if provided",Xc=`must be an integer between ${qr} and ${Yr}`,Jc={path:["destructive_command_protection","overrides"],label:"destructive command"},Qc={path:["secret_protection","overrides"],label:"secret protection"},by=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Sy(e,t){let n=[];return{policy:eu(e,t,(o)=>{n.push(o)}),issues:n}}function vy(e,t){return eu(e,t,It)}function eu(e,t,n){if(!Ee(e))return n(_([],"Config must be an object")),Zr();if(e.version!==1)n(_(["version"],"must be 1"));let r=tn(e.safety,["safety"],["level","overrides"],n),o=tn(r.overrides,["safety","overrides"],Jt,n),i=tn(e.workflow,["workflow"],["worktree_mode"],n),s=tn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=tn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=tn(e.audit,["audit"],["retention_days"],n);return tu(e,by,[],n),{version:1,safety:{level:Ey(r.level,n),overrides:Zc(o,Jt,["safety","overrides"],n)},workflow:{worktree_mode:Cs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Cs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Xr(s.overrides,os,Jc,n),allow_paths:nn(s.allow_paths,ps,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Cs(a.enabled,["secret_protection","enabled"],!0,n),overrides:Xr(a.overrides,ds,Qc,n),deny_paths:nn(a.deny_paths,gs,t,["secret_protection","deny_paths"],n),allow_paths:nn(a.allow_paths,hs,t,["secret_protection","allow_paths"],n)},audit:{retention_days:xy(l.retention_days,n)}}}function tn(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(t,Es)),{};return tu(e,n,t,r),e}function tu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function Ey(e,t){if(e===void 0)return"standard";if(Ss.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Cs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,vs));return n}function xy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=qr&&e<=Yr))t(_(["audit","retention_days"],Xc));return Wc(e)}function Xr(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(n.path,Es)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function nn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function Ee(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Zr(){return structuredClone(qc)}function Jr(e,t){if(!gy(e))return{exists:!1,policy:Zr(),errors:[]};try{let n=hy(e,"utf-8");if(!n.trim())return{exists:!0,policy:Zr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Sy(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${_y(i)}`),fallback:Ee(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Zr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var Ry=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Es,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[vs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Xc,`not an integer between ${qr} and ${Yr}`]]);function _y(e){let t=ns(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=Ry.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function wy(e,t){let n=Jr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ee(r))return{policy:Kc(),errors:[]};let o=vy(r,t);return{policy:bs(o),gui:o,errors:[],levelPresent:Vc(r)}}if(n.parsed===void 0)return{policy:Kc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:bs(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Vc(n.parsed)}}function Vc(e){let t=Ee(e)&&Ee(e.safety)?e.safety:{};return Ss.has(t.level)}function nu(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Hr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Kc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:nu({}),denyPaths:[],allowPaths:[]}}}function bs(e){return{safety:Ay(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:nu(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function Ay(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function ru(e,t){let n=kc(e,t),r=Yc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...ky(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Oy(o,Py(n,r),s,r.policyScopes)}function Py(e,t){let n=Iy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:My(e.errors.length>0?Ty(e.errors):void 0,e.warnings.length>0?Rs(e.warnings.join("; ")):void 0,n)}}function Ty(e){return`${Rs(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Iy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function ky(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Oy(e,t,n=Object.freeze({}),r){let o=xs(structuredClone(e)),i=r?{policyScopes:xs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function xs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))xs(t);return Object.freeze(e)}function My(...e){return Rs(e.filter((t)=>!!t).join("; "))}function Rs(e){return/[.!?]$/.test(e)?e:`${e}.`}function ou(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:_s(t.fail_closed,e.strict,"strict"),paranoid_rm:_s(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:_s(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:zc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Mi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function _s(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Bn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Ny=/^[A-Za-z_][A-Za-z0-9_]*=/;function Qr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function $n(e){let t=Qr(e.words[0],"time")?1:0,n=t===1&&Qr(e.words[t],"-p")?t+1:t,r=t===1&&Qr(e.words[n],"--")?n+1:n,o=Qr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Ny.test(s.text));return i?.provenance==="literal"?i.text:void 0}var ft=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function eo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Dy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>me(t)))})}function to(e,t,n){e.push(n),t.reset()}function no(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function ws(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function rn(e,t,n,r,o,i,s){return ws({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function me(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Dy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:me(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function As(e,t,n){if(t>=n||su(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!su(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=iu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=iu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ps(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Ly(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?Wy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function iu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function su(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Ly(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function Wy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var uu=new Set(["&&","||","|","|&"]);function du(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=io(e,0,e.length,t,{used:0,max:t.maxWords},0);return me({kind:"program",dialect:"posix",source:e,span:n,status:lo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function io(e,t,n,r,o,i,s){let a=[],l=[],c=eo(),u=[],f=()=>{if(c.words.length===0&&c.redirections.length===0)return;let m={start:c.start,end:c.end},p=c.words.map((g)=>g.text);to(a,c,{kind:"command",dialect:"posix",source:e.slice(m.start,m.end),span:m,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let m=e[d];if(!m)break;if(s&&m===s)return f(),cu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(ao(m)){if(m===`
+`||m==="\r"){f();let v=m==="\r"&&e[d+1]===`
+`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!uu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,v),span:Object.freeze({start:d,end:v})}));if(u.length>0){let x=Ps(e,v,n,u.splice(0));l.push(...x.issues),d=x.next;continue}d=v;continue}d++;continue}if(m==="#"){while(d<n&&e[d]!==`
+`&&e[d]!=="\r")d++;continue}let p=c.start===-1?oC(e,d,n):void 0;if(p){if(Is(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);if(!Ts(o))return on(a,l,d,"word-limit",r.maxWords);let v=io(e,p.braceIndex+1,n,r,o,i+1,"}"),T=v.next,x={start:p.braceIndex+1,end:v.closed?T-1:T},A=au(e,x,v);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:A}),l.push(...v.issues),v.pendingHeredocs.length>0||Hn(v.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...v.pendingHeredocs),v.limited)return oo(a,l,v.next);if(!v.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let g=so(e,d);if(g){if(f(),!bu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:g,span:Object.freeze({start:d,end:d+g.length})})),d+=g.length;continue}if(m===")"){f(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:m,span:{start:d,end:d+1}}),d++;continue}if((m==="("||m==="{"&&jy(e,d,n))&&c.start===-1){if(Is(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);let v=m==="("?")":"}",T=io(e,d+1,n,r,o,i+1,v),x=T.next,A={start:d+1,end:T.closed?x-1:x},q=au(e,A,T);if(a.push({kind:"group",style:m==="("?"subshell":"brace",span:{start:d,end:x},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Hn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return oo(a,l,T.next);if(!T.closed)l.push({code:m==="("?"unclosed-subshell":"unclosed-brace-group",message:`${m} group is not closed`});d=x;continue}let h=(m==="<"||m===">")&&e[d+1]!=="("?By(e,d):null;if(h){let v=c.words.at(-1),T=v&&v.span.end===d&&/^[0-9]+$/.test(v.raw)?Number(v.raw):void 0;if(T!==void 0)c.words.pop();let x=T===void 0?d:v?.span.start??d;c.start=c.start===-1?d:c.start;let A=d+h.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let q=e[A],Z=A>d+h.length&&q==="#",ee=!q||ao(q)||!!so(e,A)||q===s||q===")"||Z||(q==="<"||q===">")&&e[A+1]!=="(",X=h==="<<"||h==="<<-",U=X?As(e,A,n):void 0,D=U?{word:rn(e,A,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?ks(e,A,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return oo(a,l,D.next);if(!Ts(o))return on(a,l,D.next,"word-limit",r.maxWords)}let ue=D?.next??d+h.length,_e={kind:"redirection",operator:h,span:{start:x,end:ue},...T===void 0?{}:{fd:T},...D?{target:D.word}:{}};if(c.redirections.push(_e),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let qe=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:h==="<<-",attach:(ke)=>{if(_e.heredoc=ke,ke.quotedDelimiter)return;qe.push(...Fy(e,ke.bodySpan.start,ke.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(D)c.nested.push(...D.nested);c.end=ue,d=ue;continue}if(c.start===-1)Is(a,l);let y=ks(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return oo(a,l,y.next);let S=qy(c.words)?Qy(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(S?.limitCode)return on(a,l,y.next,S.limitCode,S.limitCode==="word-limit"?r.maxWords:S.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=S?.words??[y.word];for(let v of E){if(!Ts(o))return on(a,l,y.next,"word-limit",r.maxWords);c.words.push(v)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return f(),cu(a,l),l.push(...iC(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function au(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:lo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function ks(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],f=[],d=!1;while(a<n){let m=e[a],p=(m==="<"||m===">")&&e[a+1]==="(";if(!m||ao(m)||(m===";"||m==="|"||m==="&")&&so(e,a)||(m==="<"||m===">")&&!p)break;if(m===")")break;if(m==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),f.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(m==='"'){l=!0;let h=Gy(e,a,n,r,o,i);if(s+=h.text,u.push(...h.nested),f.push(...h.issues),d||=h.limited,c=Un(c,h.provenance),a=h.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let h=$y(e,a+2,n);if(s+=h.text,f.push(...h.issues),!h.closed)f.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(m==="\\"){let h=e[a+1];if(!h){f.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
+`){a+=2;continue}s+=h,a+=2;continue}let g=m==="$"||m==="<"||m===">"||m==="`"?co(e,a,n,r,o,i):null;if(g){let h=fu(g,u,f);if(d||=h.limited,c=Un(c,h.provenance),a=h.next,d)break;continue}if(m==="$"){let h=gu(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(m==="*"||m==="?"||m==="[")c=Un(c,"glob");s+=m,a++}return{word:rn(e,t,a,s,c,l,c==="literal"?void 0:Hy(e,t,a)),nested:u,issues:f,next:a,limited:d}}function Gy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,f=t+1;while(f<n){let d=e[f];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:f+1,limited:u};if(d==="\\"&&e[f+1]){let p=e[f+1]??"";if(p===`
+`){f+=2;continue}if(p==="\r"&&e[f+2]===`
+`){f+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,f+=2;continue}if(e.startsWith("$((",f)){let p=Os(e,f+3,n,"))"),g=p===-1?n:p+2;if(s+=e.slice(f,g),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});f=g;continue}let m=co(e,f,n,r,o,i);if(m){let p=fu(m,l,c);if(f=p.next,u||=p.limited,a=Un(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:f,limited:u};continue}if(d==="$"){let p=gu(e,f,n,s,a);s=p.text,a=p.provenance,f=p.next;continue}s+=d??"",f++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function co(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,f=s?"))":c?"`":")",d=Os(e,t+u,n,f),m=d===-1?n:d,p=d===-1?n:d+f.length;if(i>=r.maxDepth)return{program:rC(e,t+u,m,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let S=[],E=[],v=!1,T=t+u;while(T<m){let x=co(e,T,m,r,o,i+1);if(!x){T++;continue}if(S.push(...x.program.nodes),E.push(...x.program.issues),v||=x.program.status==="limited",T=x.next,v)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,m),span:{start:t+u,end:m},status:lo(E,v),issues:E,nodes:S}),next:p,provenance:"arithmetic"}}let g=io(e,t+u,m,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Hn(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,m),span:{start:t+u,end:m},status:lo([...g.issues,...h,...y],g.limited),issues:[...g.issues,...h,...y],nodes:g.nodes}),next:p,provenance:"command-substitution"}}function Fy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?co(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function fu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Os(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
 `||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=ws(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=ou(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=Ay(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=_s(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Ay(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=ou(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function ou(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!qy(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function oo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Ty(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function io(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function iu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Iy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=ky(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function ky(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return to(e,t+1,n,16,2,t+1);if(r==="u")return to(e,t+1,n,16,4,t+1);if(r==="U")return to(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return to(e,t,n,8,3,t+1);return{text:r,next:t+1}}function to(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function so(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function su(e,t,n,r,o){let i=iu(e,t,n);return{text:r+e.slice(t,i),provenance:Un(o,"variable"),next:i}}function Oy(e,t,n){let r=eo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,p=c?"))":d?"`":")",h=Is(e,a+f,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let f=iu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Un(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function My(e,t,n){return t+1>=n||io(e[t+1]??"")||oo(e,t+1)!==null}var Ny=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Dy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Ly(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Wy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Wy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Gy(e,t);if(n==="env")return Fy(e,t);if(n==="sudo")return zy(e,t);return}function Gy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Fy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Ny.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function zy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Dy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function au(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=lu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>cu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function By(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=lu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>cu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>rn(e,t.span.start,t.span.end,a,"literal",!1))}}function lu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>Qc(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=Qc(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...$y(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function Qc(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Hy(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:Uy(e,r)}}function $y(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function Uy(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Hy(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function cu(e,t){let n=`x${e}`,r=Ts(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function jy(e,t,n,r){return me({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function on(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function no(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ps(e){return e.used++,e.used<=e.max}function Vy(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Hn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Hn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Hn(t.body.nodes)})}function Ky(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function uu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function eu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!tu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function As(e,t){if(!uu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function qy(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var mu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Yy=new Set(["gc","cat","type","cp","mv","rm"]),fu=["-rec","-for","-path","-literalpath","-whatif"],Zy=/^\$env:\w/i,Xy=/^(?:\$\{?\w+\}?|~)\\./;function pu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...mu].some((o)=>n.includes(o))&&!(n.includes("rm")&&fu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!Jy(n))return!1;let r=Ns(e,t);if(gu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ms(r).some(Qy)}function gu(e){return e.nodes.some((t)=>{if(t.kind==="group")return gu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function Jy(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Qy(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&mu.has(n))return!0;let r=e.slice(t+1);if(n&&Yy.has(n)&&r.some(eC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return fu.some((s)=>i.startsWith(s))})}function eC(e){return Zy.test(e)||Xy.test(e)}function Ns(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ds(e,0,e.length,t,0);return me({kind:"program",dialect:"powershell",source:e,span:n,status:iC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ds(e,t,n,r,o,i=!1){let s=[],a=[],l=Jr(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};Qr(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=oC(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
-`){m();let y=f==="\r"&&e[d+1]===`
-`?d+2:d+1;s.push(ks(e,d,y)),d=y;continue}d++;continue}let h=Cu(e,d);if(h){m(),s.push(ks(e,d,d+h.length)),d+=h.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(yu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ds(e,d+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=me({kind:"program",dialect:"powershell",source:e.slice(d+1,v),span:{start:d+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(ks(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?du(e,v,n,r,o):void 0,S=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:S}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=S,d=S;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Rs({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let g=du(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,u||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next>d?g.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function du(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(p)=>{let h=tC(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),u+=Os(h.program),m||=h.program.status==="limited",s="command-substitution",h.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||Cu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[f+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=h,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(p==="'"){a=!0,f++;let h=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){h=!0,f++;break}i+=e[f]??"",f++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let h=!1;while(f<n){let g=e[f];if(g==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(g==='"'){h=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=g??"",f++}if(!h)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:rn(e,t,f,i,s,a,s==="literal"?void 0:nC(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function tC(e,t,n,r,o){let i=hu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[yu(r.maxDepth)],nodes:[]}),next:a};let l=Ds(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function hu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Os(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Os(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Os(r)}}return t}function nC(e,t,n){let r=eo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=hu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=rC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function rC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function yu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ms(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ms(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ms)]})}function Cu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function oC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function iC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ks(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Me(e,t="auto",n=dt){if(t==="powershell"||t==="auto"&&pu(e.slice(0,n.maxInputLength),n))return Ns(e,n);return nu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function sn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function lo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Ls(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function jn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){jn(e,t)}function kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Ws(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Y(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function Ke(e,t,n){return!kt(C(e,t-1))&&j(e,t,n)&&!kt(C(e,t+n.length))}function qe(e,t){return kt(C(e,t-1))!==kt(C(e,t))}function oe(e){return e===`
-`||e===";"||e==="&"||e==="|"}function an(e){return e==="|"||e===";"}function co(e,t,n){let r=Ls(e,n);if(t==="rm")return sC(r);if(t==="dd")return lC(r);return Ru(r,!0)}function uo(e,t,n){let r=Ls(e,n);if(t==="rm")return cC(r);if(t==="reset-hard")return Eu(r,"--ha","rd");if(t==="reset-merge")return Eu(r,"--me","rge");if(t==="clean")return fC(r);if(t==="checkout")return gC(r);if(t==="push-force")return hC(r);if(t==="push-refspec")return yC(r);if(t==="push-delete")return CC(r);if(t==="branch")return bC(r);if(t==="tag")return EC(r);if(t==="restore")return xC(r);return Ru(r,!1)}function sC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Ke(e,i,"rm")&&H(l)&&l!==`
-`)t=!0,i++;continue}let a=aC(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=bu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=bu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function aC(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function bu(e,t,n){if(Su(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Su(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Su(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function lC(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(C(e,n))){t=!1;continue}if(Ke(e,n,"dd")){t=!0,n++;continue}if(!t||!Ke(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function cC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=C(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=dC(e,o);if(s>=0){if(uC(e,s))return!0;let a=s,l=!1;while(H(C(e,a)))l||=C(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(C(e,o-1)))&&(!C(e,o+2)||H(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&qe(e,o+11)||Gs(e,o,"recursive"),r||=j(e,o,"--force")&&qe(e,o+7)||Gs(e,o,"force"),n&&r)return!0;o++}return!1}function Gs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&qe(e,t+r+2)}function uC(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(C(e,n)))n++;let i=n;while(n<Y(e)&&!H(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=vu(e,i,"recursive"),a=vu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=mC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function vu(e,t,n){return j(e,t,`--${n}`)&&qe(e,t+n.length+2)||Gs(e,t,n)}function dC(e,t){if(t>0&&kt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!H(C(e,n+1)))return-1;return n+1}function mC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=C(e,c)??"",m=(u==="r"||u==="f")&&qe(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Eu(e,t,n){return Kn(e,"reset",an,!0,(r)=>C(e,r)==="-"&&ln(e,r,t,n)?!0:r)}function fC(e){return Kn(e,"clean",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(ln(e,t,"--fo","rce"))return!0;let n=Vn(e,t,an);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function mo(e,t,n){if(!Ke(e,t,"git"))return null;let r=t+3;if(!H(C(e,r)))return{commandEnd:-1,next:r};while(H(C(e,r)))r++;while(r<Y(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=Vn(e,r,oe);if(Ke(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=pC(e,r,o);r=o;while(H(C(e,r)))r++;if(i)return{commandEnd:Ke(e,r,n)?r+n.length:-1,next:Vn(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=Vn(e,r,oe);while(H(C(e,r)))r++}return{commandEnd:-1,next:r}}function pC(e,t,n){for(let r of be)if(n-t===r.length&&j(e,t,r))return!0;return!1}function gC(e){return xu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function hC(e){return Kn(e,"push",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!kt(C(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=_u(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function yC(e){return Kn(e,"push",oe,!1,(t)=>{if(H(C(e,t))&&C(e,t+1)==="+"&&t+2<Y(e)&&!oe(C(e,t+2))&&!H(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function CC(e){return Kn(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&ln(e,t,"--de","lete"))return!0;if(H(C(e,t))&&C(e,t+1)===":"&&t+2<Y(e)&&!H(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function bC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=mo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=Vn(e,o,oe),s=SC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function SC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(ln(e,i,"--de","lete"))r=!0;if(ln(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&vC(C(e,s))){let u=C(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!qe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function vC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function EC(e){return xu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function xu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=mo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(ln(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&qe(e,r+1))return!0;if(an(o))i.outerActive=!1}return!1}function Kn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=mo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(C(e,u)))i=!1;s=c}if(l)i=!1}return!1}function xC(e){let t=!1;for(let n=0;n<Y(e);n++){if(Ws(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=mo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Ru(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=C(e,r),i=t?Ws(o):oe(o);if(n&&H(o)&&C(e,r+1)==="-"&&Ke(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Ke(e,r,"find"))n=!0,r+=3}return!1}function Vn(e,t,n){let r=t;while(r<Y(e)&&!H(C(e,r))&&!n(C(e,r)))r++;return r}function _u(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return qe(e,o)?o:-1}function ln(e,t,n,r){return _u(e,t,n,r)>=0}function Ye(e,t){jn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&uo(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var RC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;jn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Au(t.nodes,r,i)}function Au(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Au(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return _C(r,t,n)})}function _C(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!RC.test(o.text));return e.words.every((o,i)=>o===t||wu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||wu(o.target.raw,n.anchored,!0)))}function wu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as wC,resolve as Tu}from"node:path";function qn(e,t,n,r){let o=wC(e)?Tu(e):t?Tu(t,e):void 0;if(!o)return;try{return F(o,n,r)}catch{return o}}function Iu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var cn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Yn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Fs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),PC=new Set(["-p","--print"]),AC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),TC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),IC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),kC=new Map([["python",new Set(["m"])]]),OC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),MC=new Set(["always","default","never"]),NC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),DC=/\\\r?\n/g,LC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Ou(e){return po(e).code}function fo(e){return po(e).sources}function Mu(e){return LC.get(Bs(e))??[]}function po(e){let t=Bs(e[0]??"");if(!Fs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&PC.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(GC(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(FC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=WC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(OC.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&NC.has(s))||t==="python"&&!MC.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(kC.get(t)?.has(d)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(AC.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(TC.get(t)?.has(d)){if(m+1===s.length)i++;break}if(IC.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function WC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function zs(e,t){return Bs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Bs(e){let t=k(e).toLowerCase();return Dr.test(t)?"python":t}function GC(e,t){return Fs.get(e)?.has(t)??!1}function FC(e){return Fs.get(e)?.has("--eval")??!1}function Zn(e,t){let n=$C(e,t);if(!ku(n,t))return!1;Ee(t,n);let r=BC(n);if(ku(r,t))return!0;return Ee(t,r),zC.test(r)}var zC=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function BC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function ku(e,t){if(co(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(co(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(co(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>uo(o,r))))}function $C(e,t){return Ee(t,e),e.replace(DC,"")}import{isAbsolute as id,relative as sd}from"node:path";import{isAbsolute as zu,parse as JC}from"node:path";import{dirname as UC,isAbsolute as HC,parse as jC,sep as VC}from"node:path";function mt(e,t,n){if(at(t))throw Error("Unsupported Windows namespace path");let r=HC(t)?jC(t).root:"",o=r||e;for(let i of qC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=UC(o);continue}let s=KC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function KC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${VC}${t}`}function qC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var $s=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],YC=new Set($s),ZC=1024,Nu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Du=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),XC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function go(e){return YC.has(e)}function Us(e){return go(e)||Nu.has(e)||Du.has(e)||Nn(e)}function Ze(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Lu(e,t){let n=Ze("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=ZC?{state:"valid",count:r}:{state:"invalid"}}function ho(e,t,n){let o=e.match(XC)?.[1];if(!o||!Us(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ze(o,t,n)??""}${e.slice(i+1)}`}}function Wu(e){return Fu(e,Du)}function Gu(e){return Fu(e,Nu)}function Fu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var $u=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!$u.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function yo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Uu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Ot(e,t,n,r){if(!Uu(un(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let d=Bu(i),f=yo(i);for(let[h,g]of f.envAssignments)s.set(h,g),a.set(h,g);if(i=f.words,i.length===0)break;while(i.length>0&&un(i).includes("=")&&!eb(i)){let h=tb(un(i),a,t.env)??ho(un(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=un(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=rb(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=sb(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=ab(i);if(p==="builtin")i=i.slice(De(i,1)==="--"?2:1);if(Bu(i)===d)break}let u=yo(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:QC(u.words,o)}}function QC(e,t){return e.some((n)=>!t.has(n))}function Bu(e){return e.map(w).join(" ")}function un(e){let t=e[0];return t?w(t):""}function De(e,t){let n=e[t];return n?w(n):void 0}function eb(e){return $u.test(un(e))}function tb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var nb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function rb(e,t,n){let r=1,o=n;while(r<e.length){let i=De(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=De(e,r+1);o=s?Xn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Xn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Xn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(nb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var ob=new Set(["-i","-0","--null"]),ib=new Set(["-u","--unset","-C","--chdir","-P"]);function sb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=De(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(ob.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=De(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:De(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(ib.has(c)){if(c==="-C"||c==="--chdir"){let m=De(e,a+1);s=m?Xn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Xn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(De(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(De(e,a)==="--")a++;return l(a)}return l(a)}function Xn(e,t,n){if(t==="")return null;if(!e&&!zu(t))return null;let r=zu(t)?JC(t).root:n.realpath(e??"/");if(r===null)return null;try{return mt(r,t,n)}catch{return null}}function ab(e){if(De(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=De(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var lb=/['"\\$`{}#]/;function Co(e,t){if(e.some((r)=>lb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function ft(e,t,n){return bo(e,t,n).tokens}function cb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Mt(e,t,n,r=0){let o=bo(e,t,n),i=(o.envSplitValues??[]).flatMap(cb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Mt(s,t,n,r+1)}function bo(e,t,n,r){if(!Uu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Ot(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Ks=Symbol("adopt-as-operand"),ub=new Set(["env","sudo","command","builtin"]),db=new Set(["&&","||","|&","|","&",";"]),mb=new Set(["<<","<<<",">|"]),fb=new Set(["|","|&"]),pb=/[*@#?$!_-]/,gb=/^\w+(?::\w+)*/,hb=Object.freeze([]),Jn=Object.freeze({kind:"scope",edge:"enter"}),Qn=Object.freeze({kind:"scope",edge:"exit"}),yb=Object.freeze([]),Cb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),er=new Set(["bash","sh","zsh","dash","ksh"]),bb=256,qu=new WeakMap;function Yu(e,t){let n=t.status==="complete"?new Set(Vs(t)):new Set,r=Eb(e,n);if(Wr(r))return So("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Nt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return So("structural-limit",r,t);if(o.invalid)return So("invalid",r,t);let s=So("complete",r,t,o.assignmentFallbacks);return qu.set(s,Object.freeze(i)),s}function Eo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of Zu(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=Sb(a,s,n,r),c=a.length>0&&fb.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===Ks){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function xo(e){return Zu(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function fe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:fe(i,t);return a?fe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function Sb(e,t,n,r){let o=tr(e)?new Map([...t.variables,...vb(e,t.variables)]):t.variables,i=ft([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(fe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function vb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],fe(o,t)]]:[]})}function Zu(e){return qu.get(e)??hb}function Eb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function So(e,t,n,r=yb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Nt(e,t){return e.nodes.flatMap((n,r)=>xb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function xb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Le(Ab(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Le(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[vo("{"),...Nt(e.body,a),...s?[vo("}")]:[]]:[Jn,Le("("),...Nt(e.body,a),...s?[Le(")")]:[],Qn]}]}let o=Ob(e,r.functions);if(o){if(r.depth>=dt.maxDepth||++r.flags.expansions>bb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Hu(e,r),vo(";"),...Nt(o,{...r,depth:r.depth+1}),vo(";")]},...ju(e,t,n,r)]}return[{start:e.span.start,events:Hu(e,r)},...ju(e,t,n,r)]}function Hu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Ju(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:Rb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function Rb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Ju(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[qs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:Tb(r),targetOrder:mb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:ed(t)}:{}}),...s===void 0?o:o.slice(1)]}function ju(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[qs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Le(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...Xu(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?_b(t,n,r):[]]}function _b(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:Xu(n.source.slice(r.span.end,e.span.end),n)}]}function Xu(e,t){if(t.depth>=dt.maxDepth)return t.flags.limited=!0,[];let n=Me(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Nt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Ju(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Le("glob"):s!==""||e.quoted&&o.length===0?qs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of Hs(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Le(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=Hs(f,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=u?Nt(u,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(Jn,...p,Qn);continue}let m=u?Nt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Jn,...m,Qn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Le("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Jn,...m,...c.raw.endsWith(")")?[Le(")")]:[],Qn);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>Le("(")),...d===1?[Jn]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>Le(")")):[],...d===1?[Qn]:[])}return l(),o}function Hs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Vu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Vu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Vu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=Pb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return wb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&pb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?gb:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function wb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Hs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function Pb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Ab(e){return/^[\r\n]+$/.test(e)?";":e}function Le(e){return Object.freeze({kind:"operator",operator:e,boundary:db.has(e)})}function vo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function qs(e){return Object.freeze({kind:"word",text:e})}function Tb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function nr(e){return Cb.has(e)||/^python\d/.test(e)}var Ib=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Qu(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=Ib.get(e)?.has(n)??!1;return Qu(e,t.slice(r?2:1))}function js(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return js(e.slice(1));if(!ub.has(t))return[...e];return js(Qu(t,e.slice(1)))}function ed(e){let t=$n(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return js(n<0?[]:e.words.slice(n).map((r)=>r.text))}function kb(e){let t=ed(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return nr(n)&&!er.has(n)}function Vs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Vs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Vs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(kb(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!Nb(t))return r;return[...r,...o]})}function Ob(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function pt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function Mb(e){if(pt(e.words[0],"git"))return pt(e.words[1],"commit");if(!pt(e.words[0],"gh")||!pt(e.words[2],"create"))return!1;return pt(e.words[1],"pr")||pt(e.words[1],"issue")}function Nb(e){return(pt(e.words[0],"cat")||pt(e.words[0],"tee")||Mb(e))&&!e.words.some(Ku)&&!e.redirections.some((n)=>Ku(n.target))}function Ku(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var td=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),nd=new Set([...td,"glob"]),Db=new Set([...nd,"pattern"]);class We extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function rr(e){let t=Lb(),n=Tn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:Wb(e),store:t}}function pe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Xe(e,t){if(!e.includes("$"))return e;return Ei(e,t)}function Lb(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Me(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=Yu(i,a);return e.set(i,c),c},getCommandProgram:r}}function Wb(e){let t=e.route.kind==="grep"?nd:e.route.kind==="glob"?Db:td;return[...El(e.input,t),...e.route.kind==="patch"?_l(e.input):[]]}var Gb=new Set(["-S","--suffix"]);function dn(e,t,n,r,o){if(e.status==="structural-limit")throw new We;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Eo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(fe(i.target,s.variables),s)?i.target:null})}function Ro(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Gb.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Ae="Git metadata and hooks are protected. Ask the user before modifying them.";function ad(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Pr(e.invocation.toolName))return null;let a=e.paths.find((l)=>rd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=pe(e,"input-candidate");if(!i)return null;let s=dn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>$b(a,l,t,n,r),isRedirectionTarget:(a,l)=>rd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=wo(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Ys(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?_o(m,l):Fb(m,l);if(n.markerFiles.some(u))return!0;return r&&od(n).some(u)}if(Ys(a,n))return!0;return r&&od(n).some((c)=>_o(c,a))}function Fb(e,t){let n=sd(t,e);if(n===""||n.startsWith("..")||id(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function zb(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function Bb(e,t,n,r,o){if(!n)return!1;return Ys(wo(se(e,t,r,o)),n)}function rd(e,t,n,r,o,i){let s=wo(se(e,t,r,o));return i.includes(s)||cd(s,n)}function ld(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>_o(i,wo(se(s,t,r,o)))))}function Ys(e,t){return t.entries.includes(e)||t.directories.includes(e)||cd(e,t)}function cd(e,t){return t.hooksDirectories.some((n)=>_o(e,n))}function od(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function _o(e,t){let n=sd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!id(n)}function wo(e){return process.platform==="win32"?e.toLowerCase():e}function $b(e,t,n,r,o){if(tr(e))return null;let i=Mt([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=Ro(i.slice(1)),a=s.sources.find((l)=>zb(fe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&Bb(fe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as ko,normalize as Zb,parse as Xb,posix as yd,resolve as Wt,sep as Qs}from"node:path";import{isAbsolute as Ub,join as ud,normalize as fd,parse as Hb,sep as dd}from"node:path";var jb=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Vb=` 	
-`;function or(e,t){if(gt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Zs(e.get("TMPDIR")??"",t)}function Lt(e,t){if(e.has("TMPDIR"))return Zs(e.get("TMPDIR")??"",t);let n=Xs(e,t);if(n===void 0)return!0;return Zs(n,t)}function Xs(e,t){return gd(e,t,"TMPDIR")}function Zs(e,t){if(!e)return!1;if(qb(e))return!1;return mn(e,t)}function gt(e,t){let n=gd(e,t,"IFS");return n!==void 0&&n!==""&&n!==Vb}function mn(e,t){let n=Po(e,t.paths);if(n===null)return!1;return pd(t).some((r)=>Io(n,r))}function To(e,t){let n=Po(e,t.paths);if(n===null)return!1;return pd(t).some((r)=>Ao(r)===Ao(n))}var md=new WeakMap;function pd(e){let t=md.get(e);if(t)return t;let n=Kb(e);return md.set(e,n),n}function Kb(e){let t=jb.map((r)=>Po(r,e.paths)??fd(r)),n=Po(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&Yb(n))return[...t,n];return t}function qb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function gd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function Yb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Po(e,t){try{let n=fd(e);if(!Ub(n))return n;let r=Hb(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=ud(i,o[s]??"");if(t.entryKind(a)==="missing")return ud(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Io(e,t){let n=Ao(e),r=Ao(t);if(n===r)return!0;let o=r.endsWith(dd)?r:`${r}${dd}`;return n.startsWith(o)}function Ao(e){return process.platform==="win32"?e.toLowerCase():e}var Jb=process.platform==="win32",hd=64,Qb=16384;function ir(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return b(o.id,o.reason)}function sr(e){let t=au(e,hd,hd,Qb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:eS(e)}}function eS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>tS(e.raw,n.span.start-e.span.start))}function tS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Gt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??ye();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:aS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&cS(e))return{kind:"outside_anchored_cwd"};let o=!r&&bd(e,t.posixShell);if(at(e))return{kind:"outside_anchored_cwd"};if(ea(e,r))return{kind:"root_or_home_target"};if(rS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(oS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(lS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&fS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>pS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(gS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(nS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function nS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(ko(r)||r.startsWith("~"))return!1;if(ta(r))return!1;if(Sd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return mn(Wt(t.resolvedCwd,r),t.environment)}function Cd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(sS(i))return!1;if(To(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Sd(r??i,s,t.environment.paths,t.budget))}function ea(e,t=!1){let n=e.trim(),r=yd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function rS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=ko(o)?o:t.resolvedCwd?Wt(t.resolvedCwd,o):null;if(!i)return!1;let s=ge(F(i,t.environment.paths,t.budget));if(s===Xb(s).root)return!0;return s===ge(F(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function ge(e){let t=Zb(e);if(Jb){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function oS(e,t,n,r,o,i,s,a){let l=e.trim();if(ta(l))return!1;if(!r&&mn(l,a))return!0;return(t||i&&s)&&n&&!o&&iS(l,n)}function iS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!bd(e.slice(n.length+1),t)})}function sS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return yd.normalize(`/${t[1]??""}`)==="/"}function ta(e){return e.split(/[\\/]+/).includes("..")}function aS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Fn(o.trim(),t);if(!ko(i))return[];try{let s=F(i,n,r);if(zn(s,F(t,n,r)))return[];return[ge(s)]}catch{return[]}})}function lS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(ta(r))return!1;let o=n?r:Fn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=ko(o)?o:i?Wt(i,o):null;if(!s)return!1;try{let a=ge(F(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Qs)?l:`${l}${Qs}`))}catch{return!1}}function cS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function bd(e,t=!1){return e.includes("$")||e.includes("`")||uS(e)||t&&dS(e)}function uS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function dS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&mS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function mS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function fS(e,t,n,r){try{return ge(F(e,n,r))===ge(F(t,n,r))}catch{try{return ge(e)===ge(t)}catch{return!1}}}function pS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return ge(F(Wt(t,e),n,r))===ge(F(o,n,r))}catch{try{return ge(Wt(t,e))===ge(o)}catch{return!1}}}function gS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Js(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Js(Wt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Js(Wt(a,e),t,i,s)}catch{return!1}}function Js(e,t,n,r){try{return vd(F(e,n,r),F(t,n,r))}catch{return!1}}function Sd(e,t,n,r){if(!t)return!1;try{return vd(F(t,n,r),F(e,n,r))}catch{return!0}}function vd(e,t){let n=ge(e),r=ge(t);return n.startsWith(`${r}${Qs}`)||n===r}var hS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Ed="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",yS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",xd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Rd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",CS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",bS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",SS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Rd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Ae},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:xd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:CS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Ed},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:yS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Ed}};function _d(e,t,n,r=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return vS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function vS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=xS(o),s=o[i];if(!s||!hS.has(OS(s.text)))return null;let a=ES(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",bS);for(let l of a.targets)if(!at(l.text)&&ea(ra(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Rd);for(let l of a.targets)if(n.resolvedCwd&&Dt(ra(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return b("powershell.remove-item-git-metadata",Ae);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",xd);for(let l of a.targets){let c=ir(Ge(ra(l.text),n),n,r,SS);if(c)return c}return null}function ES(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(RS(l))continue;if(s){t.push(na(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=wS(l.text);if(!c){t.push(na(l)),i=i||l.dynamic;continue}if(PS(c.name)){let u=c.value?_S(c.value,l):e[++a];if(u?.kind==="word"){t.push(na(u)),i=i||u.dynamic;continue}i=!0;continue}if(AS(c.name)){n=!0;continue}if(TS(c.name)){r=!0;continue}if(IS(c.name))o=kS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function xS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function na(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function RS(e){return e.kind==="word"&&e.text===","}function ra(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function _S(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function wS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function PS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function AS(e){return"recurse".startsWith(e)}function TS(e){return e.length>=2&&"force".startsWith(e)}function IS(e){return e==="wi"||"whatif".startsWith(e)}function kS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function OS(e){return e.toLowerCase()}var fn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Oo="Unsupported heredoc syntax",wd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var MS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),NS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),DS=new Set(["-o","--output","--query","--subscription"]),LS=new Set;function Pd(e){if(e==="aws")return MS;if(e==="gcloud")return NS;if(e==="az")return DS;return LS}var WS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),GS=new Set;function Ad(e){if(e==="git")return be;if(e==="docker")return WS;return GS}function Je(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=de(e);for(let o of t){if(!BS(n,o.command))continue;if(o.match){if(FS(n,e,o.match))return Td(o);continue}if(!$S(n,e,o.subcommand))continue;if(HS(e,new Set(o.block_args),r))return Td(o)}return null}function Td(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function FS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return zS(r,n.command_path,Pd(e))}function zS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function BS(e,t){return e===M(t)}function $S(e,t,n){if(!n)return!0;return Id(t,1,n,Ad(e))}function Id(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&US(e,i,n,r))return!0;continue}return s===n}return!1}function US(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Id(e,t+2,n,r)}function HS(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var jS=new Set(["-e","--source"]),VS=new Set(["-F","-v","--assign","--field-separator"]),kd=new Set(["-f","--file"]),KS=new Set(["print","printf","return"]),Od=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],qS="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Md(e,t,n){let r=!1;for(let o of YS(e)){let i=ZS(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",qS):null}function ia(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&jS.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(VS.has(a)||kd.has(a))){let l=e[s+1];if(i&&=l!==void 0,kd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function lr(e){return ia(e).sources}function YS(e){return lr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function ZS(e,t){Ee(t,e);let n=e.includes("system")?sa(e,t):null,r=XS(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function sa(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=No(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Nd(e,i+1);continue}if(s==="/"&&Dd(e,i)){i=Ld(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,ar(e[a-1])||ar(e[i]))continue;let l=Mo(e,i);if(e[l]!=="(")continue;l=Mo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=No(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Mo(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function XS(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=No(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=Nd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Dd(e,i)){let f=Ld(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(oa(e,i,"print")||oa(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=Mo(e,m);if(oa(e,d,"getline")){o=!0;let f=ev(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(nv(s,a)){o=!0;let f=QS(e,d);if(!f){r=!0,c=m,i=m;continue}if(!JS(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function ar(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Mo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function JS(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function No(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=tv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function QS(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return No(e,t,n)}function ev(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function tv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function oa(e,t,n){return e.startsWith(n,t)&&!ar(e[t-1])&&!ar(e[t+n.length])}function nv(e,t){return t!==null&&t>=e}function Nd(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Dd(e,t){let n=rv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(ar(e[r-1]))r--;return KS.has(e.slice(r,n+1))}function rv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Ld(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var ov=new Set(["sudo","env","command","builtin"]);function Do(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=iv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function iv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&sv(a,r);if(l)i.push(s);if(!l&&Lr.has(M(a)))break;if(o)break}return i}function sv(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||Xi.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Oe(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return ov.has(e.toLowerCase())}function zt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Fe(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Lo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Lo(e,t,n,r,o,i,s,a,l){let c=bo(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=Co(c.envSplitValues,u);if(!f)throw new N("derivedCommandShape");aa(a),yield*Lo(f,t,m,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new N("wrapperPeelIterations");let d=Do(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])aa(a),yield*Lo(f===d.childIndex?d.tokens:[...u.slice(f)],t,m,r,new Map(o),new Map(i),s,a,!0);return}if(lv(u)){aa(a),yield*Lo([...u.slice(1)],t,m,r,o,i,s,a,l);return}yield av(u,m,r,o,i,l)}function av(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function aa(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function lv(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function la(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function ze(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||ca(r,"recursive")){t=!0;continue}if(r==="-f"||ca(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Wd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>ca(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function ca(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var cv="find -delete permanently removes files. Use -print first to preview.",uv="find -exec rm -rf is dangerous. Use explicit file list instead.",dv=new Set(["-exec","-execdir","-ok","-okdir"]),mv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Gd(e,t){let n=e.map(w),r=fv(e,n,t);if(r)return r;if(Go(n,1)&&!gv(e,n,t)){let s=A(b("find.delete",cv),t.policy);if(s)return s}let o=t.budget??ye(),i=0;while(i<n.length){let s=n[i],a=ht(s??"");if(a>0){i+=a+1;continue}if(!Qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=cr(n,i);i=l.nextIndex;let c=yv(l.tokens,t.environment);if(c){let f=A(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=m?.id.startsWith("custom.")?m:A(m,t.policy);if(d)return d}return null}function fv(e,t,n){if(!Go(t,1)&&!ua(t,n.environment))return null;let o=Wo(e)??K(["."]),i=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=sr(s);for(let l of a.expandedTargets??[w(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Ae)}}if(pv(t)&&i.resolvedCwd&&ld(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return b("find.delete-git-metadata",Ae);return null}function ua(e,t){let n=0;while(n<e.length){if(!Qe(e[n])){n++;continue}let r=cr(e,n),o=Mt([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function pv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function gv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Wo(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Xs(o,n.environment),s=n.trustedTmpdirValue??Lt(o,n.environment),a=n.allowTmpdirVar??!or(o,n.environment),l=Gt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??gt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=sr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((m)=>Cd(m,l,{containmentTarget:hv(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function hv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Wo(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function yv(e,t){let n=ft([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&ze(n))return b("find.exec-rm-recursive-force",uv);return null}function cr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Go(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Qe(r)){n=cr(e,n).nextIndex;continue}let o=ht(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ht(e){return mv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Qe(e){return e!==void 0&&dv.has(e)}import{resolve as UE}from"node:path";function ur(e){let t=Me(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Cv=5,da="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function zd(e,t,n){let r=Fo(e,t,n),o=bv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Cv;a++){let{subcommand:l,rest:c}=xe(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=Rv(m);if(d===null||d.length===0)return{blockedReason:da,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:da,expanded:!0,tokens:i}}function Bd(e,t,n){return Fo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function xe(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=be.has(o)?2:1}return{subcommand:null,rest:[]}}function bv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Fo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=vv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Sv(e,t,n)]}}function Sv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=ma(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=ma(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Fd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Fd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(be.has(i)){o+=2;continue}o++}return r}function vv(e,t){let n=Ev(e,t),r=xv(e,t);return{blockedReason:n===null||r===null?da:null,entries:[...n??[],...r??[]]}}function Ev(e,t){let n=Ze("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=ur(n);if(!o)return null;for(let i of o){let s=ma(i);if(!s)return null;r.push(s)}return r}function xv(e,t){let n=Lu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ze(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ze(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function ma(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Fd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ze(e.slice(r+1),t,n)}}function Rv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return ur(t)}var _v="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",wv="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",Pv="git checkout --force discards uncommitted changes. Use 'git stash' first.",Av="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Tv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Iv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",kv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Ov="git switch --force discards uncommitted changes. Use 'git stash' first.",Mv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Nv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Dv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Lv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Wv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Gv="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Fv="git push --force destroys remote history. Use --force-with-lease for safer force push.",zv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",Bv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",$v="git branch -D force-deletes without merge check. Use -d for safe delete.",Uv="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",Hv="git merge --abort discards merge conflict resolutions. Use 'git status' first.",jv="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Vv="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Kv="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",qv="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Yv="git worktree remove --force can delete uncommitted changes. Remove --force flag.",Zv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Xv=new Set(["--recurse-submodules","--track","-t"]),fa=new Set(["-b","-B","-U"]),pa=new Set(["-c","-C"]),Jv=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var pn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Ud(e,t){let{subcommand:n,rest:r}=xe(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return yt(Qv(r,t));case"switch":return yt(tE(r));case"restore":return yt(rE(r));case"reset":return iE(r);case"clean":return yt(aE(r));case"rm":return yt(lE(r));case"push":return Bt(cE(r));case"branch":return Bt(mE(r));case"stash":return Bt(yE(r));case"worktree":return Bt(CE(r));case"rebase":return yt(fE(r));case"merge":return yt(pE(r));case"tag":return Bt(gE(r));case"reflog":return Bt(hE(r));default:return null}}function yt(e){return e?{...e,localDiscard:!0}:null}function Bt(e){return e?{...e,localDiscard:!1}:null}function Qv(e,t){let{index:n,before:r}=ie(e),o=de(r,{shortOptsWithValue:fa});if(r.some((a)=>O(a,"--force"))||o.has("-f"))return b("git.checkout-force",Pv);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(O(a,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",Tv)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return b("git.checkout-ref-path",Av);return b("git.checkout-double-dash",_v)}let i=nE(e);if(i.length>=2)return b("git.checkout-ambiguous",Iv);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>O(a,"--detach")||O(a,"--track")))return null;if(eE(s)||t(s))return b("git.checkout-double-dash",wv);return null}function eE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function tE(e){let{before:t}=ie(e);if(t.some((r)=>O(r,"--discard-changes")))return b("git.switch-discard-changes",kv);let n=de(t,{shortOptsWithValue:pa});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return b("git.switch-force",Ov);return null}function nE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(Zv.has(r)){n+=2;continue}if(Xv.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function rE(e){let t=oE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",Nv):b("git.restore-unstaged",Mv)}function oE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(Jv.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function iE(e){let t=null;for(let n of e){if(O(n,"--hard")){t=b("git.reset-hard",Dv);break}if(O(n,"--merge")){t=b("git.reset-merge",Lv);break}}if(!t)return null;return sE(e)?Bt(t):yt(t)}function sE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function aE(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return b("git.clean-force",Wv);return null}function lE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",Gv):null}function cE(e){let{before:t,after:n}=ie(e),r=de(t);if(t.some((s)=>O(s,"--mirror")))return b("git.push-mirror",Bv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||$d(t,n).some(uE))return b("git.push-force",Fv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||$d(t,n).some(dE))return b("git.push-delete",zv);return null}function $d(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function uE(e){return e.startsWith("+")||e.includes(":+")}function dE(e){return e.length>1&&e.startsWith(":")}function mE(e){let{before:t}=ie(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return b("git.branch-force-delete",$v);return null}function fE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.rebase-abort",Uv):null}function pE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.merge-abort",Hv):null}function gE(e){let{before:t}=ie(e);return de(t).has("-d")||t.some((r)=>O(r,"--delete"))?b("git.tag-delete",jv):null}function hE(e){return e[0]==="delete"?b("git.reflog-delete",Vv):null}function yE(e){for(let t of e){if(t==="drop")return b("git.stash-drop",Kv);if(t==="clear")return b("git.stash-clear",qv)}return null}function CE(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",Yv);return null}import{dirname as GE,isAbsolute as FE,join as om,resolve as zE}from"node:path";var ha="TMPDIR",ya="IFS",jd=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Vd=/^[A-Za-z_][A-Za-z0-9_]*$/,Kd=new Set(["export","typeset","declare","readonly"]),bE=new Set(["builtin","command","time"]),qd=new Set(["do","then","else"]),SE=new Set(["do","then","case"]),Hd=new Set(["done","fi","esac"]),vE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function Yd(e,t){return e.map((n)=>n.provenance==="variable"&&tm(n.text)?dr(n.text,t.shellAssignments):w(n))}function dr(e,t){return e.replace(vE,(n,r,o)=>t.get(r??o??"")??n)}function Zd(e,t){return{env:e,effectiveEnvAssignments:_E(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Xd(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ca(e,t){let n=Qd(e,t),r=e[0]??"";if(SE.has(r))t.bodyDepth+=1;if(r==="elif"||Hd.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(Hd.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);ba(t,a)});let o=n.commandIndex;if(o!==-1&&Kd.has(e[o]??""))e.filter((a)=>Vd.test(a)&&ga(a)).forEach((a)=>{wE(t,a)});let i=o===-1?-1:em(e,o);if(i===-1||e[i]!=="unset")return;let s=AE(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(qd.has(r)){t.shellAssignments.set(a,"");return}PE(t,a)})}function Jd(e,t){let n=Qd(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Qd(e,t){let n=qd.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!tm(a)),o=r!==-1&&Kd.has(e[em(e,r)]??""),i=RE(t);return{assignments:e.flatMap((a,l)=>{let c=EE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!go(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function em(e,t){let n=t;while(bE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function tm(e){return Pe(e)!==null||jd.test(e)}function EE(e,t,n){return Pe(e)??xE(e,t,n)}function xE(e,t,n){let r=ho(e,n,t);if(r)return r;let o=e.match(jd)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function ga(e){return e===ha||e===ya||Us(e)}function RE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function _E(e,t){let n=[ha,ya].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ba(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function wE(e,t){ba(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function PE(e,t){if(!ga(t)&&!Vd.test(t))return;if(e.shellAssignments.set(t,""),go(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!ga(t)||t===ha||t===ya||Nn(t)){ba(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function AE(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as TE}from"node:path";function zo(e,t){return $s.some((n)=>t?.has(n)||e.has(n))}function gn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(TE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=nm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=nm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=be.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function nm(e,t,n){try{let r=mt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function rm(e,t,n){if(!t.localDiscard||!n.worktreeMode||zo(n.environment.env,n.envAssignments))return null;let r=gn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Sa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Sa(e,t,n){let{subcommand:r,rest:o}=xe(e),i=r?.toLowerCase();if(t.dynamicArguments||IE(o)||DE(e,t.environment.env,t.envAssignments,n)||ME(o)||kE(i,o))return!0;return i==="clean"&&NE(o)>1}function IE(e){return e.some((t)=>/[$*?[]/.test(t))}function kE(e,t){if(e==="checkout"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:fa}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=de(n,{shortOptsWithValue:pa}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||OE(s))||r.has("-C");return o&&i}return!1}function OE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function ME(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function NE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function DE(e,t,n,r){if(Ze("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Fo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>WE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||LE(s.value);if(Gu(n))return!0;return r.recursiveSubmodules}function LE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function WE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function im(e,t,n){let r=e.map(w),o=n.environment.paths,i=gn(r,n.cwd,o),s=n.originalCwd?o.realpath(zE(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||zo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?$E(e,n.shellAssignments,o):sm(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!BE(a,r,t,n)||!mn(a,n.environment)||To(a,n.environment)||Io(s,a)||Io(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function BE(e,t,n,r){let o=r.environment.paths,i=om(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!Sa(t,r,s)}function $E(e,t,n){let r=xe(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?dr(a,t??new Map):a;if(!FE(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function sm(e,t){if(t.entryKind(om(e,".git"))!=="missing")return e;let n=GE(e);return n===e?null:sm(n,t)}var HE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",jE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Bo(e,t){return am(e,t)}function am(e,t,n){let r=e.map(w),o=zd(r,t.environment.env,t.envAssignments),i=o.blockedReason?A(b("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Wu(t.envAssignments)||Bd(r,t.environment.env,t.envAssignments))&&VE(s))return b("git.ssh-env",HE);let a=Ud(s,(c)=>{let u=gn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(UE(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=rm(r,a,t)??im(e,a,t);if(!l)return a;return n?.(l),null}function lm(e,t){let n=null;return{match:am(e,t,(o)=>{n=o}),relaxation:n}}function VE(e){let{subcommand:t,rest:n}=xe(e),r=t?.toLowerCase();if(!r)return!1;if(jE.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&KE(n)}function KE(e){return e.find((t)=>!qE(t))?.toLowerCase()==="update"}function qE(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as Tx}from"node:path";function cm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function $o(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var um="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",YE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ZE="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",mm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",XE="rm -rf in home directory is dangerous. Change to a project directory first.",dm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:mm},git_metadata_target:{id:"rm.git-metadata",reason:Ae},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:ZE},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:XE},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:um},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:YE},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:um}};function Uo(e,t){let n=Gt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=ze(r),i=Wd(r),s=QE(e);for(let a of s){let l=sr(a.word);if(o&&l.unsafeBraceExpansion){let c=A(ir({kind:"outside_anchored_cwd"},n,t.policy,dm),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=Ce(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return b("rm.git-metadata",Ae);if(i&&!o){let d=Ge(u,n,m);if(d.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",mm);if(d.kind==="git_metadata_target")return b("rm.git-metadata",Ae);continue}if(!o)continue;for(let d of JE(u,n,m)){let f=ir(d,n,t.policy,dm),p=A(f,t.policy);if(p)return p}}}return null}function JE(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function QE(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},$t={kind:"dynamic"},ex=new Set(["<","<<","<<-","<<<","<&","<>"]),pm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,tx=/^(?:[0-9]+|[@*])$/,nx=dt.maxWords,rx=dt.maxInputLength;function gm(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`?a+2:a+1,f=Ps(e,u,n,s.splice(0));if(!f.terminated)return-1;a=f.next-1;continue}let c=mu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=zy(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",f=a+(u?3:2);while(f<n&&/[ \t]/.test(e[f]??""))f++;let d=As(e,f,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function zy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=mu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function mu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!sC(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function so(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function By(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function ao(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function pu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function $y(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Uy(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Uy(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return ro(e,t+1,n,16,2,t+1);if(r==="u")return ro(e,t+1,n,16,4,t+1);if(r==="U")return ro(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return ro(e,t,n,8,3,t+1);return{text:r,next:t+1}}function ro(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function lo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function gu(e,t,n,r,o){let i=pu(e,t,n);return{text:r+e.slice(t,i),provenance:Un(o,"variable"),next:i}}function Hy(e,t,n){let r=no(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,f=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||f||d){let m=c?3:d?1:2,p=c?"))":d?"`":")",g=Os(e,a+m,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let m=pu(e,a,n);if(m>a+1){r.push(o,a,"literal"),r.push(a,m,"variable"),a=m,o=m;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Un(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function jy(e,t,n){return t+1>=n||ao(e[t+1]??"")||so(e,t+1)!==null}var Vy=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Ky=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function qy(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Yy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Yy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Zy(e,t);if(n==="env")return Xy(e,t);if(n==="sudo")return Jy(e,t);return}function Zy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Xy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Vy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function Jy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Ky.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function hu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=yu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>Cu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function Qy(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=yu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>Cu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>rn(e,t.span.start,t.span.end,a,"literal",!1))}}function yu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((m)=>lu(m,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=lu(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let f=u.start+c.length-u.end,d=u.alternatives.reduce((m,p)=>m+f+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...eC(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function lu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&nC(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:tC(e,r)}}function eC(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function tC(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function nC(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function Cu(e,t){let n=`x${e}`,r=ks(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function rC(e,t,n,r){return me({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function on(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function oo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ts(e){return e.used++,e.used<=e.max}function oC(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Hn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Hn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Hn(t.body.nodes)})}function iC(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function bu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function cu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!uu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Is(e,t){if(!bu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function sC(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var vu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),aC=new Set(["gc","cat","type","cp","mv","rm"]),Eu=["-rec","-for","-path","-literalpath","-whatif"],lC=/^\$env:\w/i,cC=/^(?:\$\{?\w+\}?|~)\\./;function xu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...vu].some((o)=>n.includes(o))&&!(n.includes("rm")&&Eu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!uC(n))return!1;let r=Ls(e,t);if(Ru(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ds(r).some(dC)}function Ru(e){return e.nodes.some((t)=>{if(t.kind==="group")return Ru(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function uC(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function dC(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&vu.has(n))return!0;let r=e.slice(t+1);if(n&&aC.has(n)&&r.some(fC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Eu.some((s)=>i.startsWith(s))})}function fC(e){return lC.test(e)||cC.test(e)}function Ls(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ws(e,0,e.length,t,0);return me({kind:"program",dialect:"powershell",source:e,span:n,status:yC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ws(e,t,n,r,o,i=!1){let s=[],a=[],l=eo(),c=0,u=!1,f=()=>{if(l.words.length===0&&l.redirections.length===0)return;let m={start:l.start,end:l.end};to(s,l,{kind:"command",dialect:"powershell",source:e.slice(m.start,m.end),span:m,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let m=e[d];if(!m)break;if(i&&m==="}")return f(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=hC(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return f(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(m)){if(m==="\r"||m===`
+`){f();let y=m==="\r"&&e[d+1]===`
+`?d+2:d+1;s.push(Ms(e,d,y)),d=y;continue}d++;continue}let g=Au(e,d);if(g){f(),s.push(Ms(e,d,d+g.length)),d+=g.length;continue}if(m==="{"){if(f(),o>=r.maxDepth)return a.push(wu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ws(e,d+1,n,r,o+1,!0),S=y.closed?y.next-1:y.next,E=me({kind:"program",dialect:"powershell",source:e.slice(d+1,S),span:{start:d+1,end:S},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(m==="}"){f(),s.push(Ms(e,d,d+1)),d++;continue}if(m===">"||m==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===m?d+2:d+1,S=y;while(/[ \t]/.test(e[S]??""))S++;let E=S<n?Su(e,S,n,r,o):void 0,v=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:v}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=v,d=v;continue}if(m===","){l.start=l.start===-1?d:l.start,l.words.push(ws({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=Su(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),f(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return f(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function Su(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,f=!1,d=(p)=>{let g=mC(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),u+=Ns(g.program),f||=g.program.status==="limited",s="command-substitution",g.next},m=t;while(m<n){let p=e[m];if(!p||/\s/.test(p)||Au(e,m)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[m+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),m++;break}i+=g,m+=2;continue}if(e.startsWith("$(",m)){m=d(m);continue}if(p==="'"){a=!0,m++;let g=!1;while(m<e.length){if(e[m]==="'"&&e[m+1]==="'"){i+="'",m+=2;continue}if(e[m]==="'"){g=!0,m++;break}i+=e[m]??"",m++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,m++;let g=!1;while(m<n){let h=e[m];if(h==="`"&&e[m+1]){i+=e[m+1],m+=2;continue}if(h==='"'){g=!0,m++;break}if(e.startsWith("$(",m)){m=d(m);continue}if(h==="$")s=e[m+1]==="("?"command-substitution":"variable";i+=h??"",m++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[m+1]==="("?"command-substitution":"variable";if(p==="@"&&m===t)s="variable";i+=p,m++}return{word:rn(e,t,m,i,s,a,s==="literal"?void 0:pC(e,t,m)),next:m,issues:l,nested:c,words:u,limited:f}}function mC(e,t,n,r,o){let i=_u(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[wu(r.maxDepth)],nodes:[]}),next:a};let l=Ws(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function _u(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Ns(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Ns(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Ns(r)}}return t}function pC(e,t,n){let r=no(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=_u(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=gC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function gC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function wu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ds(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ds(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ds)]})}function Au(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function hC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function yC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Ms(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Ne(e,t="auto",n=ft){if(t==="powershell"||t==="auto"&&xu(e.slice(0,n.maxInputLength),n))return Ls(e,n);return du(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function sn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function uo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Gs(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function jn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function xe(e,t){jn(e,t)}function kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Fs(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Y(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function Ze(e,t,n){return!kt(C(e,t-1))&&j(e,t,n)&&!kt(C(e,t+n.length))}function Xe(e,t){return kt(C(e,t-1))!==kt(C(e,t))}function oe(e){return e===`
+`||e===";"||e==="&"||e==="|"}function an(e){return e==="|"||e===";"}function fo(e,t,n){let r=Gs(e,n);if(t==="rm")return CC(r);if(t==="dd")return SC(r);return Mu(r,!0)}function mo(e,t,n){let r=Gs(e,n);if(t==="rm")return vC(r);if(t==="reset-hard")return ku(r,"--ha","rd");if(t==="reset-merge")return ku(r,"--me","rge");if(t==="clean")return _C(r);if(t==="checkout")return AC(r);if(t==="push-force")return PC(r);if(t==="push-refspec")return TC(r);if(t==="push-delete")return IC(r);if(t==="branch")return kC(r);if(t==="tag")return NC(r);if(t==="restore")return DC(r);return Mu(r,!1)}function CC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Ze(e,i,"rm")&&H(l)&&l!==`
+`)t=!0,i++;continue}let a=bC(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=Pu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Pu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function bC(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function Pu(e,t,n){if(Tu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Tu(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Tu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function SC(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(C(e,n))){t=!1;continue}if(Ze(e,n,"dd")){t=!0,n++;continue}if(!t||!Ze(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function vC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=C(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=xC(e,o);if(s>=0){if(EC(e,s))return!0;let a=s,l=!1;while(H(C(e,a)))l||=C(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(C(e,o-1)))&&(!C(e,o+2)||H(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&Xe(e,o+11)||zs(e,o,"recursive"),r||=j(e,o,"--force")&&Xe(e,o+7)||zs(e,o,"force"),n&&r)return!0;o++}return!1}function zs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&Xe(e,t+r+2)}function EC(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(C(e,n)))n++;let i=n;while(n<Y(e)&&!H(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=Iu(e,i,"recursive"),a=Iu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=RC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Iu(e,t,n){return j(e,t,`--${n}`)&&Xe(e,t+n.length+2)||zs(e,t,n)}function xC(e,t){if(t>0&&kt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!H(C(e,n+1)))return-1;return n+1}function RC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=C(e,c)??"",f=(u==="r"||u==="f")&&Xe(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&f,s||=u==="f"&&f,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&f,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function ku(e,t,n){return Kn(e,"reset",an,!0,(r)=>C(e,r)==="-"&&ln(e,r,t,n)?!0:r)}function _C(e){return Kn(e,"clean",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(ln(e,t,"--fo","rce"))return!0;let n=Vn(e,t,an);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function po(e,t,n){if(!Ze(e,t,"git"))return null;let r=t+3;if(!H(C(e,r)))return{commandEnd:-1,next:r};while(H(C(e,r)))r++;while(r<Y(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=Vn(e,r,oe);if(Ze(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=wC(e,r,o);r=o;while(H(C(e,r)))r++;if(i)return{commandEnd:Ze(e,r,n)?r+n.length:-1,next:Vn(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=Vn(e,r,oe);while(H(C(e,r)))r++}return{commandEnd:-1,next:r}}function wC(e,t,n){for(let r of Se)if(n-t===r.length&&j(e,t,r))return!0;return!1}function AC(e){return Ou(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function PC(e){return Kn(e,"push",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!kt(C(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Nu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function TC(e){return Kn(e,"push",oe,!1,(t)=>{if(H(C(e,t))&&C(e,t+1)==="+"&&t+2<Y(e)&&!oe(C(e,t+2))&&!H(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function IC(e){return Kn(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&ln(e,t,"--de","lete"))return!0;if(H(C(e,t))&&C(e,t+1)===":"&&t+2<Y(e)&&!H(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function kC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=po(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=Vn(e,o,oe),s=OC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function OC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(ln(e,i,"--de","lete"))r=!0;if(ln(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&MC(C(e,s))){let u=C(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!Xe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function MC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function NC(e){return Ou(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Ou(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=po(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(ln(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Xe(e,r+1))return!0;if(an(o))i.outerActive=!1}return!1}function Kn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=po(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(C(e,u)))i=!1;s=c}if(l)i=!1}return!1}function DC(e){let t=!1;for(let n=0;n<Y(e);n++){if(Fs(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=po(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Mu(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=C(e,r),i=t?Fs(o):oe(o);if(n&&H(o)&&C(e,r+1)==="-"&&Ze(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Ze(e,r,"find"))n=!0,r+=3}return!1}function Vn(e,t,n){let r=t;while(r<Y(e)&&!H(C(e,r))&&!n(C(e,r)))r++;return r}function Nu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return Xe(e,o)?o:-1}function ln(e,t,n,r){return Nu(e,t,n,r)>=0}function Ae(e,t){jn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)xe(t,a);if((s.regex?.test(a)??!1)||s.scan&&mo(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var LC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Lu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;jn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Wu(t.nodes,r,i)}function Wu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Wu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return WC(r,t,n)})}function WC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!LC.test(o.text));return e.words.every((o,i)=>o===t||Du(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Du(o.target.raw,n.anchored,!0)))}function Du(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as GC,resolve as Gu}from"node:path";function qn(e,t,n,r){let o=GC(e)?Gu(e):t?Gu(t,e):void 0;if(!o)return;try{return z(o,n,r)}catch{return o}}function Fu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var cn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Yn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",$s=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),FC=new Set(["-p","--print"]),zC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),BC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),$C=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),UC=new Map([["python",new Set(["m"])]]),HC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),jC=new Set(["always","default","never"]),VC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),KC=/\\\r?\n/g,qC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function zu(e){return ho(e).code}function go(e){return ho(e).sources}function Bu(e){return qC.get(Hs(e))??[]}function ho(e){let t=Hs(e[0]??"");if(!$s.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return De(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return De(t,n,r,o,i,s);if(t==="node"&&FC.has(s)){let f=e[i+1];if(f===void 0)return De(t,n,r,o);if(f.startsWith("-"))continue;n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),i++;continue}if(ZC(t,s)){let f=e[i+1];if(f===void 0)return De(t,n,r,o);if(n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),t==="python")return De(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(XC(t)&&a){let f=a[1]??"";n.push({tokenIndex:i,value:f}),r.push({tokenIndex:i,kind:"inline-code",value:f});continue}if(t==="node"){let f=YC(s);if(f){if(f.attached){if(o&&=f.value!=="",f.value!=="")r.push({tokenIndex:i,kind:"module-file",value:f.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,De(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return De(t,n,r,o);if(HC.get(t)?.has(s)){let f=e[i+1];if(f===void 0||f.startsWith("-")&&!(t==="ruby"&&VC.has(s))||t==="python"&&!jC.has(f))return De(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let f=1;f<s.length;f++){let d=s[f];if(d===void 0)break;if(UC.get(t)?.has(d)){let m=s.slice(f+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return De(t,n,r,o)}if(zC.get(t)?.has(d)){l=s.slice(f+1)||e[i+1],c=f+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&d==="r"){let m=s.slice(f+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let m=s.slice(f+1);if(!m){if(o=!1,f+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(BC.get(t)?.has(d)){if(f+1===s.length)i++;break}if($C.get(t)?.has(d)&&f+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return De(t,n,r,o);if(c)i++}return De(t,n,r,o,void 0,void 0,!0)}function De(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function YC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Us(e,t){return Hs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Hs(e){let t=k(e).toLowerCase();return Lr.test(t)?"python":t}function ZC(e,t){return $s.get(e)?.has(t)??!1}function XC(e){return $s.get(e)?.has("--eval")??!1}function Zn(e,t,n=!1){let r=eb(e,t);if(!Bs(r,t))return!1;xe(t,r);let o=QC(r);if(Bs(o,t))return!0;if(xe(t,o),!$u.test(o))return!1;return!n||JC(r,t)}function JC(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let n=e.split(""),r=[];for(let s=0;s<e.length;s++){let a=e[s];if(a!=="'"&&a!=='"')continue;let l=e.startsWith(a.repeat(3),s)?a.repeat(3):a,c=s+l.length,u=c;while(u<e.length&&!e.startsWith(l,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;r.push({start:c,text:e.slice(c,u)}),n.fill(" ",s,u+l.length),s=u+l.length-1}let o=n.join(""),i=Array.from(o.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((s)=>$u.test(s[1]??"")).map((s)=>{let a=s.index+s[0].length;return{start:a,end:js(o,a)}});if(i.some((s)=>Vs(o,s.start)))return!0;return r.some((s)=>(/\b(?:system|exec|spawn|popen)\s*$/.test(o.slice(0,s.start))||i.some((a)=>s.start>=a.start&&s.start<a.end))&&Bs(s.text,t))}function js(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Vs(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var $u=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function QC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Bs(e,t){if(fo(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(xe(t,e),r.test(e))return!0;if(fo(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(xe(t,e),r.test(e))return!0;if(fo(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(xe(t,e),n.some((o)=>mo(o,r))))}function eb(e,t){return xe(t,e),e.replace(KC,"")}import{isAbsolute as pd,relative as gd}from"node:path";import{isAbsolute as Yu,parse as ub}from"node:path";import{dirname as tb,isAbsolute as nb,parse as rb,sep as ob}from"node:path";function mt(e,t,n){if(lt(t))throw Error("Unsupported Windows namespace path");let r=nb(t)?rb(t).root:"",o=r||e;for(let i of sb(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=tb(o);continue}let s=ib(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function ib(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${ob}${t}`}function sb(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Ks=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],ab=new Set(Ks),lb=1024,Uu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Hu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),cb=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function yo(e){return ab.has(e)}function qs(e){return yo(e)||Uu.has(e)||Hu.has(e)||Nn(e)}function Je(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function ju(e,t){let n=Je("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=lb?{state:"valid",count:r}:{state:"invalid"}}function Co(e,t,n){let o=e.match(cb)?.[1];if(!o||!qs(o))return null;let i=e.indexOf("=");return{name:o,value:`${Je(o,t,n)??""}${e.slice(i+1)}`}}function Vu(e){return qu(e,Hu)}function Ku(e){return qu(e,Uu)}function qu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Xu=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!Xu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function bo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Ju(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Ot(e,t,n,r){if(!Ju(un(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let f=0;f<V.wrapperPeelIterations.cap;f++){let d=Zu(i),m=bo(i);for(let[g,h]of m.envAssignments)s.set(g,h),a.set(g,h);if(i=m.words,i.length===0)break;while(i.length>0&&un(i).includes("=")&&!fb(i)){let g=mb(un(i),a,t.env)??Co(un(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=un(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=gb(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=Cb(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=bb(i);if(p==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(Zu(i)===d)break}let u=bo(i);for(let[f,d]of u.envAssignments)s.set(f,d),a.set(f,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:db(u.words,o)}}function db(e,t){return e.some((n)=>!t.has(n))}function Zu(e){return e.map(w).join(" ")}function un(e){let t=e[0];return t?w(t):""}function Le(e,t){let n=e[t];return n?w(n):void 0}function fb(e){return Xu.test(un(e))}function mb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var pb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function gb(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?Xn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Xn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Xn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(pb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var hb=new Set(["-i","-0","--null"]),yb=new Set(["-u","--unset","-C","--chdir","-P"]);function Cb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let f of n.keys())o.set(f,"");o.set("TMPDIR",""),a++;continue}if(hb.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let f=Le(e,a+1);if(f!==void 0)o.set(f,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(yb.has(c)){if(c==="-C"||c==="--chdir"){let f=Le(e,a+1);s=f?Xn(s,f,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let f=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Xn(s,f,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let f=Pe(Le(e,a)??"");if(!f)break;o.set(f.name,f.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function Xn(e,t,n){if(t==="")return null;if(!e&&!Yu(t))return null;let r=Yu(t)?ub(t).root:n.realpath(e??"/");if(r===null)return null;try{return mt(r,t,n)}catch{return null}}function bb(e){if(Le(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var Sb=/['"\\$`{}#]/;function So(e,t){if(e.some((r)=>Sb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function pt(e,t,n){return vo(e,t,n).tokens}function vb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Mt(e,t,n,r=0){let o=vo(e,t,n),i=(o.envSplitValues??[]).flatMap(vb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Mt(s,t,n,r+1)}function vo(e,t,n,r){if(!Ju(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Ot(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Js=Symbol("adopt-as-operand"),Eb=new Set(["env","sudo","command","builtin"]),xb=new Set(["&&","||","|&","|","&",";"]),Rb=new Set(["<<","<<<",">|"]),_b=new Set(["|","|&"]),wb=/[*@#?$!_-]/,Ab=/^\w+(?::\w+)*/,Pb=Object.freeze([]),Jn=Object.freeze({kind:"scope",edge:"enter"}),Qn=Object.freeze({kind:"scope",edge:"exit"}),Tb=Object.freeze([]),Ib=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),er=new Set(["bash","sh","zsh","dash","ksh"]),kb=256,rd=new WeakMap;function od(e,t){let n=t.status==="complete"?new Set(Xs(t)):new Set,r=Nb(e,n);if(Gr(r))return Eo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Nt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Eo("structural-limit",r,t);if(o.invalid)return Eo("invalid",r,t);let s=Eo("complete",r,t,o.assignmentFallbacks);return rd.set(s,Object.freeze(i)),s}function Ro(e,t,n,r,o){let i=o.word??((f)=>f),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let f of id(e)){if(f.kind==="scope"){if(f.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let m=u.pop();if(m===void 0)throw Error("scope exit without a matching enter");s=m.state,a=m.segment,l=m.shellWords,c=m.pipeProducer;continue}if(f.kind==="operator"){if(!f.boundary)continue;let d=o.segment(a,s,c,f.operator,l);if(d)return d;s=Ob(a,s,n,r),c=a.length>0&&_b.has(f.operator)?a:null,a=[],l=new Set;continue}if(f.kind==="redirection"){if(f.fd!==void 0)l.add(a.length-1);if(f.target===void 0)continue;let d=o.redirection({operator:f.operator,role:f.role,targetOrder:f.targetOrder,target:f.target,...f.body===void 0?{}:{body:f.body,consumer:f.consumer}},s);if(d===Js){l.add(a.length),a.push(i(f.target));continue}if(d)return d;continue}a.push(i(f.text))}return o.segment(a,s,c,null,l)}function _o(e){return id(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function Ob(e,t,n,r){let o=tr(e)?new Map([...t.variables,...Mb(e,t.variables)]):t.variables,i=pt([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function Mb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function id(e){return rd.get(e)??Pb}function Nb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Eo(e,t,n,r=Tb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Nt(e,t){return e.nodes.flatMap((n,r)=>Db(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function Db(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(zb(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[xo("{"),...Nt(e.body,a),...s?[xo("}")]:[]]:[Jn,We("("),...Nt(e.body,a),...s?[We(")")]:[],Qn]}]}let o=Hb(e,r.functions);if(o){if(r.depth>=ft.maxDepth||++r.flags.expansions>kb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Qu(e,r),xo(";"),...Nt(o,{...r,depth:r.depth+1}),xo(";")]},...ed(e,t,n,r)]}return[{start:e.span.start,events:Qu(e,r)},...ed(e,t,n,r)]}function Qu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:ad(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:Lb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function Lb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?ad(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[Qs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:Bb(r),targetOrder:Rb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:cd(t)}:{}}),...s===void 0?o:o.slice(1)]}function ed(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[Qs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...sd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?Wb(t,n,r):[]]}function Wb(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:sd(n.source.slice(r.span.end,e.span.end),n)}]}function sd(e,t){if(t.depth>=ft.maxDepth)return t.flags.limited=!0,[];let n=Ne(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Nt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function ad(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?Qs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of Ys(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(We(m));continue}s+=m.text,a||=m.glob}continue}let u=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=Ys(m,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=u?Nt(u,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(Jn,...p,Qn);continue}let f=u?Nt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Jn,...f,Qn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Jn,...f,...c.raw.endsWith(")")?[We(")")]:[],Qn);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>We("(")),...d===1?[Jn]:[],...f,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>We(")")):[],...d===1?[Qn]:[])}return l(),o}function Ys(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=td(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=td(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function td(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=Fb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return Gb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&wb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?Ab:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function Gb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Ys(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function Fb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function zb(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:xb.has(e)})}function xo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function Qs(e){return Object.freeze({kind:"word",text:e})}function Bb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function nr(e){return Ib.has(e)||/^python\d/.test(e)}var $b=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function ld(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=$b.get(e)?.has(n)??!1;return ld(e,t.slice(r?2:1))}function Zs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Zs(e.slice(1));if(!Eb.has(t))return[...e];return Zs(ld(t,e.slice(1)))}function cd(e){let t=$n(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Zs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function Ub(e){let t=cd(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return nr(n)&&!er.has(n)}function Xs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Xs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Xs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(Ub(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!Vb(t))return r;return[...r,...o]})}function Hb(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function gt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function jb(e){if(gt(e.words[0],"git"))return gt(e.words[1],"commit");if(!gt(e.words[0],"gh")||!gt(e.words[2],"create"))return!1;return gt(e.words[1],"pr")||gt(e.words[1],"issue")}function Vb(e){return(gt(e.words[0],"cat")||gt(e.words[0],"tee")||jb(e))&&!e.words.some(nd)&&!e.redirections.some((n)=>nd(n.target))}function nd(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var ud=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),dd=new Set([...ud,"glob"]),Kb=new Set([...dd,"pattern"]);class Ge extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function rr(e){let t=qb(),n=Tn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:Yb(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Qe(e,t){if(!e.includes("$"))return e;return xi(e,t)}function qb(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Ne(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let f={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,f),f}let l=e.get(i);if(l)return l;let c=od(i,a);return e.set(i,c),c},getCommandProgram:r}}function Yb(e){let t=e.route.kind==="grep"?dd:e.route.kind==="glob"?Kb:ud;return[...kl(e.input,t),...e.route.kind==="patch"?Nl(e.input):[]]}var Zb=new Set(["-S","--suffix"]);function dn(e,t,n,r,o){if(e.status==="structural-limit")throw new Ge;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Ro(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function wo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Zb.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function hd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Pr(e.invocation.toolName))return null;let a=e.paths.find((l)=>fd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=dn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>eS(a,l,t,n,r),isRedirectionTarget:(a,l)=>fd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Po(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(ea(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(f)=>c?Ao(f,l):Xb(f,l);if(n.markerFiles.some(u))return!0;return r&&md(n).some(u)}if(ea(a,n))return!0;return r&&md(n).some((c)=>Ao(c,a))}function Xb(e,t){let n=gd(t,e);if(n===""||n.startsWith("..")||pd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function Jb(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function Qb(e,t,n,r,o){if(!n)return!1;return ea(Po(se(e,t,r,o)),n)}function fd(e,t,n,r,o,i){let s=Po(se(e,t,r,o));return i.includes(s)||Cd(s,n)}function yd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Ao(i,Po(se(s,t,r,o)))))}function ea(e,t){return t.entries.includes(e)||t.directories.includes(e)||Cd(e,t)}function Cd(e,t){return t.hooksDirectories.some((n)=>Ao(e,n))}function md(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Ao(e,t){let n=gd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!pd(n)}function Po(e){return process.platform==="win32"?e.toLowerCase():e}function eS(e,t,n,r,o){if(tr(e))return null;let i=Mt([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=wo(i.slice(1)),a=s.sources.find((l)=>Jb(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&Qb(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Mo,normalize as lS,parse as cS,posix as wd,resolve as Wt,sep as oa}from"node:path";import{isAbsolute as tS,join as bd,normalize as Ed,parse as nS,sep as Sd}from"node:path";var rS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],oS=` 	
+`;function or(e,t){if(ht(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!ta(e.get("TMPDIR")??"",t)}function Lt(e,t){if(e.has("TMPDIR"))return ta(e.get("TMPDIR")??"",t);let n=na(e,t);if(n===void 0)return!0;return ta(n,t)}function na(e,t){return Rd(e,t,"TMPDIR")}function ta(e,t){if(!e)return!1;if(sS(e))return!1;return fn(e,t)}function ht(e,t){let n=Rd(e,t,"IFS");return n!==void 0&&n!==""&&n!==oS}function fn(e,t){let n=To(e,t.paths);if(n===null)return!1;return xd(t).some((r)=>Oo(n,r))}function ko(e,t){let n=To(e,t.paths);if(n===null)return!1;return xd(t).some((r)=>Io(r)===Io(n))}var vd=new WeakMap;function xd(e){let t=vd.get(e);if(t)return t;let n=iS(e);return vd.set(e,n),n}function iS(e){let t=rS.map((r)=>To(r,e.paths)??Ed(r)),n=To(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&aS(n))return[...t,n];return t}function sS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Rd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function aS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function To(e,t){try{let n=Ed(e);if(!tS(n))return n;let r=nS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=bd(i,o[s]??"");if(t.entryKind(a)==="missing")return bd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Oo(e,t){let n=Io(e),r=Io(t);if(n===r)return!0;let o=r.endsWith(Sd)?r:`${r}${Sd}`;return n.startsWith(o)}function Io(e){return process.platform==="win32"?e.toLowerCase():e}var uS=process.platform==="win32",_d=64,dS=16384;function ir(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return b(o.id,o.reason)}function sr(e){let t=hu(e,_d,_d,dS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:fS(e)}}function fS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>mS(e.raw,n.span.start-e.span.start))}function mS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Gt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Ce();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:bS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Fe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&vS(e))return{kind:"outside_anchored_cwd"};let o=!r&&Pd(e,t.posixShell);if(lt(e))return{kind:"outside_anchored_cwd"};if(ia(e,r))return{kind:"root_or_home_target"};if(gS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(hS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(SS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&_S(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>wS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(AS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(pS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function pS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Mo(r)||r.startsWith("~"))return!1;if(sa(r))return!1;if(Td(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return fn(Wt(t.resolvedCwd,r),t.environment)}function Ad(e,t,n={}){let{containmentTarget:r,...o}=n;if(Fe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(CS(i))return!1;if(ko(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Td(r??i,s,t.environment.paths,t.budget))}function ia(e,t=!1){let n=e.trim(),r=wd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function gS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Mo(o)?o:t.resolvedCwd?Wt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(z(i,t.environment.paths,t.budget));if(s===cS(s).root)return!0;return s===he(z(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=lS(e);if(uS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function hS(e,t,n,r,o,i,s,a){let l=e.trim();if(sa(l))return!1;if(!r&&fn(l,a))return!0;return(t||i&&s)&&n&&!o&&yS(l,n)}function yS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Pd(e.slice(n.length+1),t)})}function CS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return wd.normalize(`/${t[1]??""}`)==="/"}function sa(e){return e.split(/[\\/]+/).includes("..")}function bS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Fn(o.trim(),t);if(!Mo(i))return[];try{let s=z(i,n,r);if(zn(s,z(t,n,r)))return[];return[he(s)]}catch{return[]}})}function SS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(sa(r))return!1;let o=n?r:Fn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Mo(o)?o:i?Wt(i,o):null;if(!s)return!1;try{let a=he(z(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(oa)?l:`${l}${oa}`))}catch{return!1}}function vS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Pd(e,t=!1){return e.includes("$")||e.includes("`")||ES(e)||t&&xS(e)}function ES(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function xS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&RS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function RS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function _S(e,t,n,r){try{return he(z(e,n,r))===he(z(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function wS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(z(Wt(t,e),n,r))===he(z(o,n,r))}catch{try{return he(Wt(t,e))===he(o)}catch{return!1}}}function AS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ra(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ra(Wt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ra(Wt(a,e),t,i,s)}catch{return!1}}function ra(e,t,n,r){try{return Id(z(e,n,r),z(t,n,r))}catch{return!1}}function Td(e,t,n,r){if(!t)return!1;try{return Id(z(t,n,r),z(e,n,r))}catch{return!0}}function Id(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${oa}`)||n===r}var PS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),kd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",TS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Od="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Md="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",IS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",kS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",OS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Md},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Te},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Od},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:IS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:kd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:TS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:kd}};function Nd(e,t,n,r=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return MS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function MS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=DS(o),s=o[i];if(!s||!PS.has(HS(s.text)))return null;let a=NS(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",kS);for(let l of a.targets)if(!lt(l.text)&&ia(la(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Md);for(let l of a.targets)if(n.resolvedCwd&&Dt(la(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return b("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",Od);for(let l of a.targets){let c=ir(Fe(la(l.text),n),n,r,OS);if(c)return c}return null}function NS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(LS(l))continue;if(s){t.push(aa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=GS(l.text);if(!c){t.push(aa(l)),i=i||l.dynamic;continue}if(FS(c.name)){let u=c.value?WS(c.value,l):e[++a];if(u?.kind==="word"){t.push(aa(u)),i=i||u.dynamic;continue}i=!0;continue}if(zS(c.name)){n=!0;continue}if(BS(c.name)){r=!0;continue}if($S(c.name))o=US(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function DS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function aa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function LS(e){return e.kind==="word"&&e.text===","}function la(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function WS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function GS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function FS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function zS(e){return"recurse".startsWith(e)}function BS(e){return e.length>=2&&"force".startsWith(e)}function $S(e){return e==="wi"||"whatif".startsWith(e)}function US(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function HS(e){return e.toLowerCase()}var mn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",No="Unsupported heredoc syntax",ar="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Dd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var jS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),VS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),KS=new Set(["-o","--output","--query","--subscription"]),qS=new Set;function Ld(e){if(e==="aws")return jS;if(e==="gcloud")return VS;if(e==="az")return KS;return qS}var YS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),ZS=new Set;function Wd(e){if(e==="git")return Se;if(e==="docker")return YS;return ZS}function et(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=fe(e);for(let o of t){if(!QS(n,o.command))continue;if(o.match){if(XS(n,e,o.match))return Gd(o);continue}if(!ev(n,e,o.subcommand))continue;if(nv(e,new Set(o.block_args),r))return Gd(o)}return null}function Gd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function XS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return JS(r,n.command_path,Ld(e))}function JS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function QS(e,t){return e===M(t)}function ev(e,t,n){if(!n)return!0;return Fd(t,1,n,Wd(e))}function Fd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&tv(e,i,n,r))return!0;continue}return s===n}return!1}function tv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Fd(e,t+2,n,r)}function nv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var rv=new Set(["-e","--source"]),ov=new Set(["-F","-v","--assign","--field-separator"]),zd=new Set(["-f","--file"]),iv=new Set(["print","printf","return"]),Bd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],sv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function $d(e,t,n){let r=!1;for(let o of av(e)){let i=lv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",sv):null}function ua(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&rv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(ov.has(a)||zd.has(a))){let l=e[s+1];if(i&&=l!==void 0,zd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function cr(e){return ua(e).sources}function av(e){return cr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function lv(e,t){xe(t,e);let n=e.includes("system")?da(e,t):null,r=cv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function da(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Lo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Ud(e,i+1);continue}if(s==="/"&&Hd(e,i)){i=jd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,lr(e[a-1])||lr(e[i]))continue;let l=Do(e,i);if(e[l]!=="(")continue;l=Do(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Lo(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Do(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function cv(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let m=Lo(e,i,u);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(u==="#"){i=Ud(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Hd(e,i)){let m=jd(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
+{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ca(e,i,"print")||ca(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let f=e[i+1]==="&"?i+2:i+1,d=Do(e,f);if(ca(e,d,"getline")){o=!0;let m=fv(s,l,c);if(r||=m===null,m!==null)n.push(m);c=f,i=f;continue}if(pv(s,a)){o=!0;let m=dv(e,d);if(!m){r=!0,c=f,i=f;continue}if(!uv(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=f,i++}if(!o)return null;return{dynamic:r,commands:n}}function lr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Do(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function uv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Lo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=mv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function dv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Lo(e,t,n)}function fv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function mv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ca(e,t,n){return e.startsWith(n,t)&&!lr(e[t-1])&&!lr(e[t+n.length])}function pv(e,t){return t!==null&&t>=e}function Ud(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Hd(e,t){let n=gv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(lr(e[r-1]))r--;return iv.has(e.slice(r,n+1))}function gv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function jd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var hv=new Set(["sudo","env","command","builtin"]);function Wo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=yv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function yv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&Cv(a,r);if(l)i.push(s);if(!l&&Wr.has(M(a)))break;if(o)break}return i}function Cv(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||Ji.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return hv.has(e.toLowerCase())}function zt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function ze(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Go([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Go(e,t,n,r,o,i,s,a,l){let c=vo(e,t,n,i);for(let[m,p]of c.envAssignments)i.set(m,p),o.set(m,p);let{tokens:u,cwd:f}=c;if(c.envSplitValues){let m=So(c.envSplitValues,u);if(!m)throw new N("derivedCommandShape");fa(a),yield*Go(m,t,f,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new N("wrapperPeelIterations");let d=Wo(u,s);if(d){for(let m of[d.childIndex,...d.alternativeChildIndices])fa(a),yield*Go(m===d.childIndex?d.tokens:u.slice(m),t,f,r,new Map(o),new Map(i),s,a,!0);return}if(Sv(u)){fa(a),yield*Go(u.slice(1),t,f,r,o,i,s,a,l);return}yield bv(u,f,r,o,i,l)}function bv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function fa(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function Sv(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ma(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Be(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||pa(r,"recursive")){t=!0;continue}if(r==="-f"||pa(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Vd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>pa(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function pa(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var vv="find -delete permanently removes files. Use -print first to preview.",Ev="find -exec rm -rf is dangerous. Use explicit file list instead.",xv=new Set(["-exec","-execdir","-ok","-okdir"]),Rv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Kd(e,t){let n=e.map(w),r=_v(e,n,t);if(r)return r;if(zo(n,1)&&!Av(e,n,t)){let s=P(b("find.delete",vv),t.policy);if(s)return s}let o=t.budget??Ce(),i=0;while(i<n.length){let s=n[i],a=yt(s??"");if(a>0){i+=a+1;continue}if(!tt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=ur(n,i);i=l.nextIndex;let c=Tv(l.tokens,t.environment);if(c){let m=P(c,t.policy);if(m)return m}let u=s==="-execdir"||s==="-okdir",f=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=f?.id.startsWith("custom.")?f:P(f,t.policy);if(d)return d}return null}function _v(e,t,n){if(!zo(t,1)&&!ga(t,n.environment))return null;let o=Fo(e)??K(["."]),i=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=sr(s);for(let l of a.expandedTargets??[w(s)]){let c=Fe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Te)}}if(wv(t)&&i.resolvedCwd&&yd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return b("find.delete-git-metadata",Te);return null}function ga(e,t){let n=0;while(n<e.length){if(!tt(e[n])){n++;continue}let r=ur(e,n),o=Mt([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function wv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function Av(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Fo(e);if(!r)return!1;let o=n.envAssignments??new Map,i=na(o,n.environment),s=n.trustedTmpdirValue??Lt(o,n.environment),a=n.allowTmpdirVar??!or(o,n.environment),l=Gt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??ht(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=sr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((f)=>Ad(f,l,{containmentTarget:Pv(f,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function Pv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Fo(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function Tv(e,t){let n=pt([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&Be(n))return b("find.exec-rm-recursive-force",Ev);return null}function ur(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function zo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(tt(r)){n=ur(e,n).nextIndex;continue}let o=yt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function yt(e){return Rv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function tt(e){return e!==void 0&&xv.has(e)}import{resolve as tx}from"node:path";function dr(e){let t=Ne(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Iv=5,ha="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Yd(e,t,n){let r=Bo(e,t,n),o=kv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Iv;a++){let{subcommand:l,rest:c}=Re(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let f=o.get(u),d=Lv(f);if(d===null||d.length===0)return{blockedReason:ha,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:ha,expanded:!0,tokens:i}}function Zd(e,t,n){return Bo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Re(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Se.has(o)?2:1}return{subcommand:null,rest:[]}}function kv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Bo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=Mv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Ov(e,t,n)]}}function Ov(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=ya(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=ya(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=qd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=qd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Se.has(i)){o+=2;continue}o++}return r}function Mv(e,t){let n=Nv(e,t),r=Dv(e,t);return{blockedReason:n===null||r===null?ha:null,entries:[...n??[],...r??[]]}}function Nv(e,t){let n=Je("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=dr(n);if(!o)return null;for(let i of o){let s=ya(i);if(!s)return null;r.push(s)}return r}function Dv(e,t){let n=ju(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Je(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Je(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function ya(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function qd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Je(e.slice(r+1),t,n)}}function Lv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return dr(t)}var Wv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",Gv="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",Fv="git checkout --force discards uncommitted changes. Use 'git stash' first.",zv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Bv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",$v="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",Uv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Hv="git switch --force discards uncommitted changes. Use 'git stash' first.",jv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Vv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Kv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",qv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Yv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Zv="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Xv="git push --force destroys remote history. Use --force-with-lease for safer force push.",Jv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",Qv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",eE="git branch -D force-deletes without merge check. Use -d for safe delete.",tE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",nE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",rE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",oE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",iE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",sE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",aE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",lE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),cE=new Set(["--recurse-submodules","--track","-t"]),Ca=new Set(["-b","-B","-U"]),ba=new Set(["-c","-C"]),uE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var pn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Jd(e,t){let{subcommand:n,rest:r}=Re(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return Ct(dE(r,t));case"switch":return Ct(mE(r));case"restore":return Ct(gE(r));case"reset":return yE(r);case"clean":return Ct(bE(r));case"rm":return Ct(SE(r));case"push":return Bt(vE(r));case"branch":return Bt(RE(r));case"stash":return Bt(TE(r));case"worktree":return Bt(IE(r));case"rebase":return Ct(_E(r));case"merge":return Ct(wE(r));case"tag":return Bt(AE(r));case"reflog":return Bt(PE(r));default:return null}}function Ct(e){return e?{...e,localDiscard:!0}:null}function Bt(e){return e?{...e,localDiscard:!1}:null}function dE(e,t){let{index:n,before:r}=ie(e),o=fe(r,{shortOptsWithValue:Ca});if(r.some((a)=>O(a,"--force"))||o.has("-f"))return b("git.checkout-force",Fv);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(O(a,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",Bv)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return b("git.checkout-ref-path",zv);return b("git.checkout-double-dash",Wv)}let i=pE(e);if(i.length>=2)return b("git.checkout-ambiguous",$v);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>O(a,"--detach")||O(a,"--track")))return null;if(fE(s)||t(s))return b("git.checkout-double-dash",Gv);return null}function fE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function mE(e){let{before:t}=ie(e);if(t.some((r)=>O(r,"--discard-changes")))return b("git.switch-discard-changes",Uv);let n=fe(t,{shortOptsWithValue:ba});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return b("git.switch-force",Hv);return null}function pE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(lE.has(r)){n+=2;continue}if(cE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function gE(e){let t=hE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",Vv):b("git.restore-unstaged",jv)}function hE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(uE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function yE(e){let t=null;for(let n of e){if(O(n,"--hard")){t=b("git.reset-hard",Kv);break}if(O(n,"--merge")){t=b("git.reset-merge",qv);break}}if(!t)return null;return CE(e)?Bt(t):Ct(t)}function CE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function bE(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=fe(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return b("git.clean-force",Yv);return null}function SE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=fe([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",Zv):null}function vE(e){let{before:t,after:n}=ie(e),r=fe(t);if(t.some((s)=>O(s,"--mirror")))return b("git.push-mirror",Qv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||Xd(t,n).some(EE))return b("git.push-force",Xv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||Xd(t,n).some(xE))return b("git.push-delete",Jv);return null}function Xd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function EE(e){return e.startsWith("+")||e.includes(":+")}function xE(e){return e.length>1&&e.startsWith(":")}function RE(e){let{before:t}=ie(e),n=fe(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return b("git.branch-force-delete",eE);return null}function _E(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.rebase-abort",tE):null}function wE(e){let{before:t}=ie(e);return t.some((n)=>O(n,"--abort"))?b("git.merge-abort",nE):null}function AE(e){let{before:t}=ie(e);return fe(t).has("-d")||t.some((r)=>O(r,"--delete"))?b("git.tag-delete",rE):null}function PE(e){return e[0]==="delete"?b("git.reflog-delete",oE):null}function TE(e){for(let t of e){if(t==="drop")return b("git.stash-drop",iE);if(t==="clear")return b("git.stash-clear",sE)}return null}function IE(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=fe(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",aE);return null}import{dirname as ZE,isAbsolute as XE,join as pf,resolve as JE}from"node:path";var va="TMPDIR",Ea="IFS",ef=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,tf=/^[A-Za-z_][A-Za-z0-9_]*$/,nf=new Set(["export","typeset","declare","readonly"]),kE=new Set(["builtin","command","time"]),rf=new Set(["do","then","else"]),OE=new Set(["do","then","case"]),Qd=new Set(["done","fi","esac"]),ME=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function of(e,t){return e.map((n)=>n.provenance==="variable"&&df(n.text)?fr(n.text,t.shellAssignments):w(n))}function fr(e,t){return e.replace(ME,(n,r,o)=>t.get(r??o??"")??n)}function sf(e,t){return{env:e,effectiveEnvAssignments:WE(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function af(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function xa(e,t){let n=cf(e,t),r=e[0]??"";if(OE.has(r))t.bodyDepth+=1;if(r==="elif"||Qd.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(Qd.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);Ra(t,a)});let o=n.commandIndex;if(o!==-1&&nf.has(e[o]??""))e.filter((a)=>tf.test(a)&&Sa(a)).forEach((a)=>{GE(t,a)});let i=o===-1?-1:uf(e,o);if(i===-1||e[i]!=="unset")return;let s=zE(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(rf.has(r)){t.shellAssignments.set(a,"");return}FE(t,a)})}function lf(e,t){let n=cf(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function cf(e,t){let n=rf.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!df(a)),o=r!==-1&&nf.has(e[uf(e,r)]??""),i=LE(t);return{assignments:e.flatMap((a,l)=>{let c=NE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!yo(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function uf(e,t){let n=t;while(kE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function df(e){return Pe(e)!==null||ef.test(e)}function NE(e,t,n){return Pe(e)??DE(e,t,n)}function DE(e,t,n){let r=Co(e,n,t);if(r)return r;let o=e.match(ef)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Sa(e){return e===va||e===Ea||qs(e)}function LE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function WE(e,t){let n=[va,Ea].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Ra(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function GE(e,t){Ra(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function FE(e,t){if(!Sa(t)&&!tf.test(t))return;if(e.shellAssignments.set(t,""),yo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Sa(t)||t===va||t===Ea||Nn(t)){Ra(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function zE(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as BE}from"node:path";function $o(e,t){return Ks.some((n)=>t?.has(n)||e.has(n))}function gn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(BE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=ff(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=ff(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Se.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function ff(e,t,n){try{let r=mt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function mf(e,t,n){if(!t.localDiscard||!n.worktreeMode||$o(n.environment.env,n.envAssignments))return null;let r=gn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(_a(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function _a(e,t,n){let{subcommand:r,rest:o}=Re(e),i=r?.toLowerCase();if(t.dynamicArguments||$E(o)||KE(e,t.environment.env,t.envAssignments,n)||jE(o)||UE(i,o))return!0;return i==="clean"&&VE(o)>1}function $E(e){return e.some((t)=>/[$*?[]/.test(t))}function UE(e,t){if(e==="checkout"){let{before:n}=ie(t),r=fe(n,{shortOptsWithValue:Ca}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=fe(n,{shortOptsWithValue:ba}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||HE(s))||r.has("-C");return o&&i}return!1}function HE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function jE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function VE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function KE(e,t,n,r){if(Je("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Bo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>YE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||qE(s.value);if(Ku(n))return!0;return r.recursiveSubmodules}function qE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function YE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function gf(e,t,n){let r=e.map(w),o=n.environment.paths,i=gn(r,n.cwd,o),s=n.originalCwd?o.realpath(JE(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||$o(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?ex(e,n.shellAssignments,o):hf(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!QE(a,r,t,n)||!fn(a,n.environment)||ko(a,n.environment)||Oo(s,a)||Oo(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function QE(e,t,n,r){let o=r.environment.paths,i=pf(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!_a(t,r,s)}function ex(e,t,n){let r=Re(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?fr(a,t??new Map):a;if(!XE(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function hf(e,t){if(t.entryKind(pf(e,".git"))!=="missing")return e;let n=ZE(e);return n===e?null:hf(n,t)}var nx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",rx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Uo(e,t){return yf(e,t)}function yf(e,t,n){let r=e.map(w),o=Yd(r,t.environment.env,t.envAssignments),i=o.blockedReason?P(b("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Vu(t.envAssignments)||Zd(r,t.environment.env,t.envAssignments))&&ox(s))return b("git.ssh-env",nx);let a=Jd(s,(c)=>{let u=gn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(tx(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=mf(r,a,t)??gf(e,a,t);if(!l)return a;return n?.(l),null}function Cf(e,t){let n=null;return{match:yf(e,t,(o)=>{n=o}),relaxation:n}}function ox(e){let{subcommand:t,rest:n}=Re(e),r=t?.toLowerCase();if(!r)return!1;if(rx.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&ix(n)}function ix(e){return e.find((t)=>!sx(t))?.toLowerCase()==="update"}function sx(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as Bx}from"node:path";function bf(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Ho(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Sf="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ax="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",lx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Ef="rm -rf targeting root or home directory is extremely dangerous and always blocked.",cx="rm -rf in home directory is dangerous. Change to a project directory first.",vf={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Ef},git_metadata_target:{id:"rm.git-metadata",reason:Te},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:lx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:cx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Sf},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:ax},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Sf}};function jo(e,t){let n=Gt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Be(r),i=Vd(r),s=dx(e);for(let a of s){let l=sr(a.word);if(o&&l.unsafeBraceExpansion){let c=P(ir({kind:"outside_anchored_cwd"},n,t.policy,vf),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=be(c),f={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return b("rm.git-metadata",Te);if(i&&!o){let d=Fe(u,n,f);if(d.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",Ef);if(d.kind==="git_metadata_target")return b("rm.git-metadata",Te);continue}if(!o)continue;for(let d of ux(u,n,f)){let m=ir(d,n,t.policy,vf),p=P(m,t.policy);if(p)return p}}}return null}function ux(e,t,n){let r=Fe(e,t,n);if(r.kind==="cwd_self_target")return[r,Fe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Fe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Fe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function dx(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var bt={kind:"none"},$t={kind:"dynamic"},fx=new Set(["<","<<","<<-","<<<","<&","<>"]),Rf=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,mx=/^(?:[0-9]+|[@*])$/,px=ft.maxWords,gx=ft.maxInputLength;function _f(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Ho(e){let t=mr(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(Vo))return $t;return{kind:"literal",source:n.map(w).join(" ")}}function hm(e){let t=mr(e[1])==="--"?2:1,n=e[t],r=mr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!Vo(n))return $t;return{kind:"literal",source:r}}function jo(e,t){let n=ix(e);if(n===-1)return Ct;let r=sx(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=lx(s,e,n,r.ifs);if(!a)return $t;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>nx||i>rx)return $t;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(ux)].filter((s)=>s!==null).join(" ")}}function ym(e,t,n,r){if(!Se(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&ex.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return $t;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?$t:{kind:"literal",source:r}}function et(e){let t=Se(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=mr(n);return lo(n,r)?{kind:"literal",source:r}:$t}var ox=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Ra(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=k(M(s));return!ox.has(a)&&!J.has(a)&&!Ft(a)}function ix(e){return Se(e.map(w)).commandIndex??-1}function sx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(ax);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function ax(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function lx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?va(o):cx(o,r);if(e.parameter==="*"){let a=va(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Ea(l,r)}let i=t[n+1+e.parameter];if(i&&!Vo(i))return;let s=mr(i);return e.quoted?[s]:Ea(s,r)}function va(e){return e.every(Vo)?e.map(w):void 0}function cx(e,t){let n=va(e);if(!n)return;let r=n.map((o)=>Ea(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ea(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Vo(e){let t=mr(e[1])==="--"?2:1;if(e.length<=t)return bt;let n=e.slice(t);if(!n.every(qo))return $t;return{kind:"literal",source:n.map(w).join(" ")}}function wf(e){let t=mr(e[1])==="--"?2:1,n=e[t],r=mr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return bt;if(!qo(n))return $t;return{kind:"literal",source:r}}function Ko(e,t){let n=yx(e);if(n===-1)return bt;let r=Cx(t);if(!r)return bt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Sx(s,e,n,r.ifs);if(!a)return $t;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>px||i>gx)return $t;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(Ex)].filter((s)=>s!==null).join(" ")}}function Af(e,t,n,r){if(!ve(e.map(w)).readsStdinAsCommands)return bt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&fx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return bt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return $t;return{kind:"literal",source:o.target.text}}if(!n)return bt;return r===void 0?$t:{kind:"literal",source:r}}function nt(e){let t=ve(e.map(w)).scriptIndex;if(t===null)return bt;let n=e[t],r=mr(n);return uo(n,r)?{kind:"literal",source:r}:$t}var hx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Ta(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=k(M(s));return!hx.has(a)&&!J.has(a)&&!Ft(a)}function yx(e){return ve(e.map(w)).commandIndex??-1}function Cx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(bx);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function bx(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Sx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?wa(o):vx(o,r);if(e.parameter==="*"){let a=wa(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Aa(l,r)}let i=t[n+1+e.parameter];if(i&&!qo(i))return;let s=mr(i);return e.quoted?[s]:Aa(s,r)}function wa(e){return e.every(qo)?e.map(w):void 0}function vx(e,t){let n=wa(e);if(!n)return;let r=n.map((o)=>Aa(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Aa(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Vo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function mr(e){return e?w(e):""}function ux(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function _a(e,t){return xa(Me(e,"posix"),t)}function pr(e){return _a(e,new Set(Array.from(e.matchAll(pm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function xa(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(xa(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>xa(o,n))||Cm(r.words,n))return!0;gx(r,n)}return!1}function Cm(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(fr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return fm(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Se(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&fm(s[l],t)}let i=dx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Cm(e.slice(i),t)}function dx(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return mx(e,t+1);if(r==="exec")return fx(e,t+1);if(r==="env")return px(e,t+1,n);return null}function mx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function fx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function px(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return fr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return fr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function gx(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(fr(n,t))t.add(r.name)}}function fr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(pm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(tx.test(o)||t.has(o))}))}function fm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||fr(e,t))}var hx=["--init-file","--rcfile"],yx=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function tt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return bm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=bm(e,t,!1);if(r!==null)return r}}return null}function nt(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Se(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function bm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Sm(e){let t=k(e[0]??"").toLowerCase(),n=Cx(e,t),r=yx.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Cx(e,t){let n=Se(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?hx.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Yi.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Zi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var wa="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Pa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",bx="__CC_SAFETY_NET_XARGS_INPUT__",Ko="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",qo="rm",Sx=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,vx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Ex=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,xx=/^(?:[0-9]+|[@*])$/;function xm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Ut(n),i=n.slice(r),s=b("xargs.shell-dynamic",Pa);if(_x(i,o,t)&&A(s,t.policy))return A(s,t.policy);for(let a of Fe(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?A(s,t.policy):null;if(c)return c;let u=Am(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&wm(l,o),d=t.analyzeChild(l,{...zt(a,t),dynamicInput:u,dynamicSourceInput:m||_m(l,a.head,o,a.wrapperEnvAssignments,u,t.environment),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",wa)});if(d)return d;let f=Rx(l,o,t.policy?.rules??[],A(s,t.policy));if(f)return f;if(a.head==="git"){let h=o===null?[...l,bx]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...zt(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=Je(l,t.policy?.rules??[]);if(p)return p}return null}function Rx(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Rm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=cm(e,r,t.length,n);return o===null?[]:[o]}function _m(e,t,n,r,o,i){if(J.has(t)){if(nt(e))return!1;if(n!==null&&wx(e,n))return!0;let s=tt(e);if(!s){let a=et(K(e));if(a.kind==="literal")return n!==null&&a.source.includes(n);return a.kind==="none"&&o}if(n!==null&&s.includes(n))return!0;if(Ye(s))return!0;return Px(s,n,r)}if(Oe(t))return vm(e,n,po,Mu(t));if(we.has(t))return vm(e,n,ia,Od);if(t==="eval"){let s=Ho(K(e));if(s.kind==="dynamic")return!0;if(n!==null)return s.kind==="literal"&&s.source.includes(n);return o}if(t==="find")return Ax(e,n,i);if(t==="git"){let s=xe(e);return n===null?s.subcommand===null:(s.subcommand?.includes(n)??!1)||s.subcommand!==null&&pn.has(s.subcommand.toLowerCase())&&Pm(s.rest,n).some((a)=>a.includes(n))}return!1}function vm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Ko]).sources.some((a)=>a.value===Ko);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Ko}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Ko}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Rm(l,t,a))));return $o(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function _x(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Fe(e,n),(i)=>i.head)),o=t===null?[...e,qo]:e.map((i,s)=>s===0?i:i.replaceAll(t,qo));return Array.from(Fe(o,n)).some((i)=>i.head===qo&&!r.has(qo))}function wm(e,t){return Pm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Pm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Am(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function wx(e,t){let n=Se(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return Rm(i,t,o).some((l)=>{let c=e.map((m,d)=>d===s?m.replaceAll(t,l):m),u=Se(c);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(n.commandIndex===null&&u.commandIndex!==null)return!0;if(n.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(c[u.commandIndex]??"").includes(l))return!0;return u.scriptIndex!==null&&(c[u.scriptIndex]??"").includes(l)})}))}function Px(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Sx))if(Em(o,r))return!0;for(let o of e.matchAll(vx))for(let i of(o[1]??"").matchAll(Ex))if(Em(i,r))return!0;return _a(e,r)}function Em(e,t){let n=e[1]??e[2];return n!==void 0&&(xx.test(n)||t.has(n))}function Ax(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Qe(s)){let l=cr(e,i);i=l.nextIndex-1;for(let c of Fe(l.tokens,{environment:n,cwd:void 0})){let u=Am(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&wm(c.tokens,t)||_m(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=ht(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Ut(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var gr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",hr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Ix="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",kx="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Zo=/\{[^{}\s]*\}/g,Tm=/\{\}|\{-?\d+\}/g,Ox=["e","f","source","file","-e","-f","--source","--file"],Mx=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Nx=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Dx=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Im=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Lx=new Set(["--workdir","--wd"]),km="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Te(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Lm(e){return Te([...e],(t)=>Ye(t))}function Wm(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=hn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Vm(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=hn(t);if(p)return p;let h=Lm(t.envAssignments?.values()??[]);if(h)return h}if(l){let p=$x(t);if(p)return p}if(u!==void 0&&a){let p=hn(t);if(p)return p}let d=Ux(u,t.cwd,t.environment.paths);if(d===null){let p=hn(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...Fe(i,f)].flatMap((h)=>[...h.envAssignments.values()]).some(Ia)){let h=hn(t);if(h)return h}return null}if(i.length===0){let p=s.map((g)=>g[0]??"");t.budget.charge("derivedTokens",p.length);let h=Bm(f.envAssignments,f.cwd,a);return Te(p,(g)=>t.analyzeNested(g,h))}return Te(Fe(i,f),(p)=>Wx(p,o,t,f))}function Wx(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(Hm)){let g=hn(n);if(g)return g}let u=Lm(c);if(u)return u;let m=c.some(G),d=i||m,f=a&&d,p=Bm(e.envAssignments,e.wrapperCwd,s||f);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Te(o,(E)=>n.analyzeChild(Yo(l,E,n.budget),zt(e,r)))};if(nt(l))return g();let y=tt(l);if(y){if(jm(y)){let x=bt(n);if(x)return x;if(o.length===0)return null;return Te(o,(P)=>n.analyzeNested(Nm(y,P,n.budget),p))}if(G(y)){if(o.length>0)return Te(o,(q)=>n.analyzeNested(Nm(y,q,n.budget),p));let x=ur(y);if(x?.[0]&&M(x[0])==="rm"&&ze(x)){let q=Mm(n);if(q)return q}let P=x?n.analyzeChild(x,{...zt(e,r),dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",hr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",gr)}):null;if(P)return P;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>jo(K(x===void 0?l:i?l.map((P)=>$m(P,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=bt(n);if(x)return x}let S=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(S.length>0)return n.budget.charge("derivedTokens",S.length),Te(S,(x)=>n.analyzeNested(x,p));if(pr(y)){let x=bt(n);if(x)return x}let T=n.analyzeNested(y,p);if(T)return T;if(d)return bt(n);return null}let v=et(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&G(v.source))return bt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=bt(n);if(E)return E;let S=g();if(S)return S;if(i)return null;let T=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",T.length),Te(T,(x)=>n.analyzeNested(x,p))}if(d||a)return bt(n)??g();return null}if(e.head==="rm"&&ze(l)){if(i&&o.length>0)return Te(o,(y)=>Aa(Yo(l,y,n.budget,Tm),e.cwd,r));if(o.length>0)return Te(o,(y)=>Aa(Dm(l,y,n.budget),e.cwd,r));let g=Aa(l.flatMap((y,v)=>{if(v===0||!G(y))return[y];return y.startsWith("-")?[y.replace(Tm,"")]:[]}),e.cwd,r);if(g)return g;return Mm(n)}let h=o.length>0?o:[void 0];return Te(h,(g)=>{let y=g===void 0?l:i?Yo(l,g,n.budget):Dm(l,g,n.budget),v=b("parallel.shell-dynamic",hr),E=a&&e.head==="find"?Bx(y,r):null,S=Fm(y,a,n)??E?.customResult??null,T=M(e.head),x=a&&(T==="rm"&&Ta(y)||T==="xargs"&&zm(y)||E?.rmOptions===!0),P=a&&(x||E?.executedSource===!0||E===null&&Gm(y,T)),q=n.analyzeChild(y,{...zt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:x,dynamicSourceInput:S!==null||P,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",gr)});if(P){let Z=A(v,n.policy);if(Z)return Z}return q??S??Je(y,n.policy?.rules??[])})}function Gm(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return zx(e);if(t==="git")return Gx(e);if(t==="find")return!0;if(we.has(t))return Om(e,Ox,lr);if(Oe(t))return Om(e,Mx,fo);return!1}function Ta(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||jm(o)))}function Gx(e){if(Fx(e))return!0;let t=xe(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!pn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function Fx(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function zx(e){if(nt(e))return!1;let t=tt(e);if(t!==null)return G(t);let n=et(K(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function Om(e,t,n){let r=n(e);if(r.some((o)=>G(o.value)))return!0;if(!e.some(G))return n([...e,km]).some((o)=>o.value===km);return $o(r,t,(o)=>n(e.map((i)=>$m(i,[o]))))}function Fm(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(G))return bt(n);return Te(o,(i)=>Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function Bx(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of Fe(i,t))n.executedSource||=Gm(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ta(a.tokens)||a.head==="xargs"&&zm(a.tokens),n.customResult??=Fm(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Qe(a)){i=[],n.executedSource||=G(a);continue}let l=ht(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function zm(e){let t=e.slice(Ut(e).childStart);return M(t[0]??"")==="rm"&&Ta(t)}function Xo(e,t){return(n)=>A(b(e,t),n.policy)}var bt=Xo("parallel.shell-dynamic",hr),$x=Xo("parallel.command-stream-dynamic",Ix),hn=Xo("parallel.command-stream-dynamic",kx),Mm=Xo("parallel.rm-recursive-force-dynamic",gr);function Aa(e,t,n){return A(Uo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Lt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Bm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function $m(e,t){return e.replace(Zo,(n)=>Um(n,t))}function Yo(e,t,n,r=Zo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Um(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Nm(e,t,n){return Yo([e],t,n)[0]??""}function Dm(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Um(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function G(e){return e.search(Zo)!==-1}function Hm(e){if(Ia(e))return!0;for(let t of e.matchAll(Zo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Ia(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function jm(e){return/^\{[^{}\s]*\}$/.test(e)}function Ux(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Tx(e))return null;try{return mt(t??e,e,n)}catch{return null}}function Vm(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=la(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=la(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||Dx.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(Im.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=Im.has(p)?2:1;continue}if(Lx.has(y)){c=!0;let E=v??h;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(Nx.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Ia:Hm);let u=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){u.push(p),p=[];continue}if(g!==void 0)p.push(g)}u.push(p)}c||=u.length>1;let m=Hx(u),d=n.some(G),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function Hx(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function Km(e){return Vm(e).childStart}var jx="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Jo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Oa(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function ka(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Ym(e,t,n,r,o=!1,i){let a=(Bn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",jx):null;return A(a,i)??Zm(e,t,n,o,i)}function Zm(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Oa(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=sn(e,t),l=Kx(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return A(b("shell.dynamic-structure",Jo),o);if(A(Bo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&pn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return A(b("shell.dynamic-structure",Jo),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&qx(t)?A(b("shell.dynamic-structure",Jo),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=ze(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?A(b("shell.dynamic-structure",Jo),o):null}if(s==="xargs")return qm(e,t.slice(Ut(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return qm(e,t.slice(Km(t.map(w))),"parallel",n,r,o);return null}function qm(e,t,n,r,o,i){if(t.length===0)return null;let s=Vx(t,r);if(Bn(e,s)){let l=A(b(`${n}.shell-dynamic`,n==="xargs"?Pa:hr),i);if(l)return l}let a=Zm(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Oa(l)&&ka(l)))return A(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?wa:gr),i);return null}function Vx(e,t){let n=Ot(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function Kx(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(be.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function qx(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Oa(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||ka(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||ka(s)))return!0;continue}if(t=!0,a)return!0;let l=ht(s.text);if(l>0){n=l;continue}if(Qe(s.text))o=!0,r=!0}return!1}function Ma(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!lo(t[n.tokenIndex],n.value)})}var Yx="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",Zx="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",Xx="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Xm(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",Yx);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",Zx);if(e==="shred"&&n.length>0)return b("shred.target",Xx);return null}var Qm=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Uo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Bo(e.words,Na(e))},{heads:new Set(["find"]),analyze:(e)=>Gd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>xm(e.words,{...Jm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Wm(e.words,{...Jm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})}];function Jm(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ht(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Na(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var rf="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function of(e){return Qm.find((t)=>t.heads.has(e))?.analyze}function Cn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=yo(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=Ot(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let R=[...p,...i(f.words)].join(" "),I=Ye(R);if(I)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:I.reason}),ue(I);if(n.strict)return he(r);let L=Co(p,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(te)return te}}let h=f.rewritten?K(i(f.words)):sn(o,f.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>h.length){let R=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),E=g[0];if(!E)return null;if(Ft(E))throw new N("wrapperPeelIterations");let S=M(E),T=f.cwd===null?void 0:f.cwd??u,x=f.cwd===null?void 0:m,P=f.cwd===void 0?n.effectiveCwd:f.cwd,q=s?s.allowTmpdirVar:!or(v,n.environment),Z=Ym(o,f.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),ue(Z);let ee=Do(g,n.policy);if(ee){for(let R of[ee.childIndex,...ee.alternativeChildIndices]){ef(y.wrapperNormalizationBudget);let I=h.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=Cn(I,t,{...y,effectiveCwd:P,envAssignments:v});if(L)return L}return null}let X=l?void 0:S==="eval"?Ho(h):S==="trap"&&!a?hm(h):void 0;if(a&&s&&S==="eval"){if(X?.kind==="dynamic")return yn(s,n.policy);if(X?.kind==="literal"){let R=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v});if(R)return R}return bn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!Ra(n.commandView)))return he(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:S==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let R=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?J.has(S):af(E,S)){if(nt(g))return null;if(a&&s){let R=tt(g);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=yn(s,n.policy);if(L)return L}if(pr(R)){let L=yn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:P,envAssignments:v})}let I=et(h);if(I.kind==="dynamic")return yn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?yn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?yn(s,n.policy):null}if(l){let R=tt(g),I=R?n.analyzeNested(R,{effectiveCwd:P,envAssignments:v}):et(h).kind==="dynamic"?he(r):null;if(I)return I}if(s===void 0){let R=tR(g,v,P,n,r,t);if(R)return R;let I=tt(g);if(I){let qt=jo(h,I);if(qt.kind==="dynamic")return he(r);let hi=qt.kind==="literal"?qt.source:I,il=nR(hi);r?.recordSegment({type:"shell-wrapper",wrapper:S,innerCommand:il}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:il,depth:t+1});let sl=n.analyzeNested(hi,{effectiveCwd:P,envAssignments:v});if(sl)return sl;return pr(hi)?he(r):null}let L=et(h);if(L.kind==="dynamic")return he(r);if(L.kind==="literal")return Qo(L.source,P,v,n,r,t);let te=ym(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return he(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:P,envAssignments:v})}}if(!s&&(S==="source"||S===".")){let R=g[1]==="-p"?2:null;if(R!==null){let qt=n.commandView?h[R]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return he(r)}let I=R===null?1:3,L=g[I]==="--"?I+1:I,te=n.commandView?h[L]:void 0;if(!te)return null;if(te.provenance==="literal")return Qo(te.text,P,v,n,r,t);if(n.strict||!n.commandView||!Ra(n.commandView))return he(r)}if(we.has(S)&&!l){if(!s&&n.strict&&Ma(lr(g),h))return he(r);let R=Md(g,(L)=>Ht(n.analyzeNested(L,{effectiveCwd:P,envAssignments:v}))),I=A(R,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),ue(I)}if(Oe(S)&&!l){if(!s&&n.strict&&Ma(fo(g),h))return he(r);let R=Ou(g);if(a&&s)return Qx(S,R,P,v,n,s);if(R){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:S,codeArg:R,paranoidBlocked:I}),I){let te=A(b("interpreter.one-liner-paranoid",Yn),n.policy);if(te)return ue(te)}if(zs(S,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:P,envAssignments:v});if(L&&!sf(L,R))return L;if(Zn(R)){let te=A(b("interpreter.dangerous-command",cn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:cn}),ue(te)}r=void 0}}if(S==="busybox"&&g.length>1)return ef(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),Cn(h.slice(1),t,{...y,effectiveCwd:P,envAssignments:v});let D=s?null:A(Xm(S,g),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),ue(D);let ce=r===y.trace?y:{...y,trace:r},_e={words:h,head:S,cwd:T,originalCwd:x,envAssignments:v,allowTmpdirVar:q,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:P,options:ce,analyzeChildTokens:(R,I)=>a&&s?Da(R,t,ce,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ht(Cn(K(R),t+1,{...ce,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:v}))??Je(R,ce.policy.rules),analyzeChild:(R,I)=>Da(R,t,ce,I)},je=s&&(S==="xargs"||S==="parallel")?void 0:of(S);if(S==="rm"||S==="xargs"||S==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let Ie=r&&S==="git"?lm(_e.words,Na(_e)):void 0,pi=tf(Ie?Ie.match:je?.(_e)??null,n.policy);if(r)rR(_e,pi,Ie?.relaxation??null);if(pi)return ue(pi);if(a&&s&&(S==="rm"||S==="rmdir")){if(!(S==="rm"&&(ze(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?bn(s,n.policy):null)??eR(s,n.policy)}let rl=je!==void 0,ol=!s&&!rl&&!Lr.has(S),gi=r&&ol?[]:void 0;if(ol)for(let R=1;R<g.length;R++){let I=g[R];if(!I)continue;gi?.push(I);let L=tf(Jx(g,R,t,ce,T,x,P,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[],embeddedCommandFound:M(I)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:gi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&rl)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let Rr=Je(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Rr,reason:Rr?.reason}),Rr)return ue(Rr);return a&&s?bn(s,n.policy):null}function Da(e,t,n,r){return Ht(Cn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function Jx(e,t,n,r,o,i,s,a){for(let l of Fe(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=M(c);if(af(c,u)||of(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=Da(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!or(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function Qx(e,t,n,r,o,i){if(!t)return bn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=A(b("interpreter.one-liner-paranoid",Yn),o.policy);if(a)return ue(a)}if(zs(e,t))return bn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!sf(s,t))return s;if(Zn(t)){let a=A(b("interpreter.dangerous-command",cn),o.policy);if(a)return ue(a)}return bn(i,o.policy)}function sf(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Oo)||e.reason===fn)&&!Wr(t)}function yn(e,t){let n=e.shellDynamicMatch?A(e.shellDynamicMatch,t):null;return n?ue(n):null}function bn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?A(e.dynamicSourceMatch,t):null;return n?ue(n):null}function eR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?A(e.rmDynamicMatch,t):null;return n?ue(n):null}function tR(e,t,n,r,o,i){let s=Sm(e);if(s.argvSource?.kind==="absent")return he(o);if(s.argvSourceApplies&&s.argvSource){let l=Qo(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Qo(a,n,t,r,o,i,!0)}function Qo(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return he(o);let a=qn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?he(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function nR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function rR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function ef(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function he(e){return e?.recordSegment({type:"error",message:rf}),ue(oR())}function oR(){return{id:"",reason:rf,intent:"stop_and_explain"}}function af(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function tf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:A(e,t)}var iR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,sR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function aR(e,t){let n=uf(e,t);if(n.length===0)return!1;let r=n[cf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return iR.test(e.join(" "))}function lf(e,t,n,r,o){if(e.dialect==="powershell"){let g=cR(e.words,o);if(g.kind==="none")return;if(!t||g.kind==="unknown")return null;return nf(fR(g.target),t,n.paths)}let i=e.words.map(w),s=i.some((g)=>/^CDPATH\+?=/.test(g));if(!aR(i,n))return s?null:void 0;if(!t)return null;let a=uf(i,n,t),l=cf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((g)=>g.length<=1||!g.startsWith("-")||g==="--");if((u===-1?c:c.slice(0,u)).some((g)=>!/^-[LP]+$/.test(g)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length!==1)return null;let p=f[0]??"",h=e.words.some((g)=>g.provenance==="variable"&&g.text===p)?lR(p,r):p;if(h===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(h)&&(s||n.env.has("CDPATH")))return null;return nf(h,t,n.paths)}function lR(e,t){let n=dr(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function nf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return mt(t,e,n)}catch{return null}}function cR(e,t){let n=uR(e[0])?1:0,r=e[n];if(!dR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!sR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return mR(e.slice(n+1),t)}function uR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function dR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function mR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function fR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function cf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function uf(e,t,n){let r=pR(e);return ft([...r],t,n)}function pR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var gR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",jt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function za(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Me(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Fa(e,n);let u=`${Oo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return hf(e,n),{reason:fn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return hf(e,n),{reason:fn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Fa(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Zd(n.environment.env,n.envAssignments);return ni(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ni(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,d=hR(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=f||vn(m);if(c.kind==="function"){let Z=h.flatMap((X)=>{let U=En(X);return U.functionDefinitions.set(c.name,c.body),La(X,[U],d,m==="&",vn(m))}),ee=Wa(Z,[],g,y,a,m);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of h){let D=ni(c.body,t,n,r,[En(U)]);if(D.result)return D;if(Z.push(...La(U,D.states,d,m==="&",vn(m))),v)ee.push(U,...d?D.states.map((ce)=>ei(U,ce)):D.states)}let X=Wa(Z,ee,g,y,a,m);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),S=e.nodes[l-2],T=ri(a)&&S?.kind==="command"?gm(S)??CR(S):void 0,x=[],P=[];for(let Z of h){let ee=bR(c,t,n,r,[En(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ei(Z,U));for(let U of X){let D=En(U),ce=ER(c,t,n.trace?{...n,trace:yf(n.trace,E)}:n,r,D,ri(a),T);if(ce)return{result:ce,states:i};let _e=GR(c,D.functionDefinitions);if(_e)n.budget.charge("derivedTokens",oi(_e));let je=_e?t+1>=V.recursionDepth.cap?Ga(c.displayText,n,[D]):ni(_e,t+1,n,r,[D]):{result:null,states:LR(c,D)};if(je.result)return je;if(x.push(...La(Z,je.states,d,m==="&",vn(m))),v)P.push(Z),P.push(...je.states.map((Ie)=>d?ei(Z,Ie):Ie))}}let q=Wa(x,P,g,y,a,m);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function hR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ri(r)||ri(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&yR(e,t)}function La(e,t,n,r,o){let i=n?t.map((a)=>ei(e,a)):[...t],s=o?i.flatMap((a)=>Sn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ei(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function yR(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(SR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ri(e){return e==="|"||e==="|&"}function CR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function vn(e){return e==="&&"||e==="||"}function Wa(e,t,n,r,o,i){let s={success:ti([...n,...e]),failure:ti([...r,...t])},a=vn(i)?s:void 0;return{states:vn(o)||a?ti([...s.success,...s.failure]):s.success,conditionalStates:a}}function yf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function bR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=vR(e);if(s){if(t+1>=V.recursionDepth.cap)return Ga(s,n,o);let a=Me(s,"powershell");if(a.status==="limited")return Ga(s,n,o);if(a.status!=="complete")return df(i,n,r,o);n.budget.charge("derivedTokens",oi(a)),i.push({program:a,depth:t+1})}}return df(i,n,r,o)}function SR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function df(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ni(i.program,i.depth,t,n,[En(a)]);if(l.result)return l;s.push(...l.states)}o=ti(s)}return{result:null,states:o}}function vR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function oi(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+oi(o),0):n.kind==="group"||n.kind==="function"?oi(n.body):0),0)}function Ga(e,t,n){return t.trace?.recordSegment({type:"error",message:$e}),{result:{reason:$e,segment:e,intent:"stop_and_explain"},states:[...n]}}function ER(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=TR(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Cf(e,o,"before-consumer",a.environment.paths,a.budget);let c=sn(e.dialect,e.words),u=c.map(w),m=e.displayText,d=Yd(c,o.shellGitContextState),f=Jd(d,o.shellGitContextState);if(e.dialect==="powershell"){let g=A(_d(e,i,zR(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!g,reason:g?.reason}),g)return FR(m,g)}if(u.length===1&&u[0]?.includes(" ")&&!Bn(e.dialect,e.words)){let g=A(Ye(u[0]),a.policy),y=g!==null&&!a.strict&&Pu(e,a.rootProgram);if(g&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:g.reason}),{reason:g.reason,segment:m,ruleId:g.id,intent:g.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let v=mf(e,l,o,f,s,a);if(v)return v;return Ca(d,o.shellGitContextState),null}let p=Cn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(g,y)=>{let v=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=za(g,t+1,{...a,effectiveCwd:v,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?yf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:m};let h=mf(e,l,o,f,s,a);if(h)return h;return Ca(d,o.shellGitContextState),null}function mf(e,t,n,r,o,i){let s=IR(e,t,n,r??new Map,i);if(s)return s;return Cf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),_R(e,t,n,i.environment.paths,i.budget),MR(e,n,o,i.environment,i.trace),null}var xR=new Set([">>","<>"]);function Cf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?RR(s):xR.has(s.operator)))continue;ff(s.target,t,r,o)}if(n!=="before-consumer"||!Re(e.words[0],"tee"))return;let i=bf(e.words.slice(1));if(!i)return;for(let s of i.operands)ff(s,t,r,o)}function RR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function ff(e,t,n,r){let o=e?.provenance==="literal"?qn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function _R(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!ii(i))return;for(let s of wR(e)){let a=qn(s.text,n.effectiveCwd,r,o);if(!a||!Iu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function wR(e){let t=AR(e.redirections)?.target,n=pf(t)?[t]:[];if(Re(e.words[0],"cat"))return PR(e.words)?n:[];if(!Re(e.words[0],"tee"))return[];let r=bf(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(pf))return[];return[...r.operands,...n]}function PR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function AR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function bf(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&Re(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function pf(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function Re(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function ii(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function TR(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return jt;let n=t[0];if(!n?.heredoc)return jt;if(!ii(n.heredoc))return gR;if(n.fd!==void 0&&n.fd!==0)return jt;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return jt;let r=e.redirections.some((s)=>s!==n&&gf(s.target));if(Re(e.words[0],"cat"))return r?jt:void 0;if(Re(e.words[0],"tee"))return r||e.words.slice(1).some(gf)?jt:void 0;let o=e.words[0],i=e.words[1];if(Re(o,"git")&&(Re(i,"apply")||Re(i,"commit")))return;if(Re(o,"gh")&&(Re(i,"pr")||Re(i,"issue"))&&Re(e.words[2],"create"))return;return jt}function gf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function IR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(OR(e,i,n,r,o))return null;let a=kR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Fa(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function kR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!ii(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Oe(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=A(b("interpreter.one-liner-paranoid",Yn),n.policy);if(c)return c}if(!Zn(s))return null;let l=A(b("interpreter.dangerous-command",cn),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function OR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!ii(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Ot(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return nt(a)}function MR(e,t,n,r,o){let i=lf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var NR=/^[A-Za-z_][A-Za-z0-9_]*$/,DR=8;function LR(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!NR.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=DR&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=En(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function En(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Xd(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ti(e){let t=[];for(let n of e){if(!t.some((r)=>WR(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function WR(e,t){return e.effectiveCwd===t.effectiveCwd&&Sn(e.shellGitContextState.env,t.shellGitContextState.env)&&Sn(e.literalHeredocFiles,t.literalHeredocFiles)&&Sn(e.functionDefinitions,t.functionDefinitions)&&Sn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Sn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function Sn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function GR(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function FR(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function zR(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Fa(e,t){let n=A(Ye(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function hf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:fn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var BR=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Sf(e,t,n,r){let o=za(e,0,{...t,...Yc(t),budget:t.budget??ye(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function vf(e,t,n){try{return{decision:e()}}catch(r){let o=$R(r,t,n);if(!o)throw r;return o}}function $R(e,t,n){if(!(e instanceof N)||!BR.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var UR=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),$a=new Set(["cc-safety-net","ccsn"]),HR=new Set(["bunx","npx","pnpx"]),jR=new Set(["pnpm","yarn"]),VR=new Set(["npm","pnpm","yarn"]),KR=new Set(["bun","node"]);function ai(e,t,n={}){if($a.has(e))return 0;if(HR.has(e)){if(n.broad)return Ba(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return si(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&VR.has(e)&&n.broad&&t[r]==="exec"){let o=Ba(t.slice(r+1));return o===null?null:r+1+o}if(jR.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&si(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ba(t.slice(r+1));return o===null?null:r+1+o}if(KR.has(e)){let o=n.broad&&r!==-1?r:0;if(Ef(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Ef(t[o+1]))return o+2}return null}function Ba(e){let t=e.findIndex((r)=>si(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!si(r))break;n++}return n}function si(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return $a.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return $a.has(e.slice(0,t))}function Ef(e){let t=e?.replaceAll("\\","/");return[...UR].some((n)=>t===n||t?.endsWith(`/${n}`))}var xf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Rf(e,t,n){let r=pe(e,"input-candidate");if(!r)return null;let o=dn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>qR(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function qR(e,t){let n=ft([...e],t),r=n.slice(1),o=ai(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as li}from"node:path";var Af="This path contains the protected policy config and you must not modify or delete it.",YR=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Tf(e,t,n){let r=t_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return _f(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=pe(e,"input-candidate");if(e.invocation.route.kind==="command")return o?wf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=wf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return _f(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Pr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function _f(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>yr(a,n,r,o,i));return s?{target:s}:null}function wf(e,t,n,r,o){let i=dn(e,t,r,o,{findSegmentTarget:(s,a)=>ZR(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>yr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>e_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function ZR(e,t,n,r,o){if(tr(e))return null;let i=Mt([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&XR(a)){let l=JR(a).find((c)=>Pf(fe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Go(i,1)||ua(i,r)){let c=(Wo(K(i))??K(["."])).find((u)=>{let m=fe(u.text,t.variables);return yr(m,t.cwd,n,r,o)||Pf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Ro(a).sources.find((c)=>n_(fe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(QR(i,s))return null;for(let l of[...e,...i])for(let c of If(l))if(yr(fe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function XR(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function JR(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function QR(e,t){if(!YR.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function e_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of If(i))if(yr(s,t,n,r,o))return{target:s};return null}function If(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function t_(e,t,n){let r=(a)=>Cr(se(a,e.executionCwd,t,n)),o=r(Qt(t)),i=[r(Ln(e.executionCwd)),r(Ln(e.configCwd))],s=new Set(i.map((a)=>li(a)));for(let a=li(o);;a=li(a))if(s.add(a),li(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function yr(e,t,n,r,o){let i=gl(e,t,r,o,(s)=>Cr(s)===Nr);return i!==null&&n.files.has(Cr(i))}function Pf(e,t,n,r,o){return n.directoriesAndAncestors.has(Cr(se(e,t,r,o)))}function n_(e,t,n,r,o){let i=Cr(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Cr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ci,posix as r_,resolve as di,win32 as o_}from"node:path";import{fileURLToPath as i_}from"node:url";var zf="Access to a sensitive path is not allowed.",Bf=new Set(["echo","printf"]),s_=new Set(["find"]),a_=new Set(["-exec","-execdir"]),l_=new Set([";","+"]),c_=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),u_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),$f=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),d_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),m_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Uf=new Set(["-c","-e","-r","-E","--eval","--exec"]),f_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),p_=new Set(["grep","rg"]),kf=new Set(["jq","gojq","jaq"]),Of="f",Mf="file",g_="files",h_=new Set(["e","f"]),y_=new Set(["regexp","file"]),C_=new Set(["e","f","A","B","C","m"]),b_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Ua="__CC_SAFETY_NET_PIPE_INPUT__",ja=/[\w./~@+-]*[./~][\w./~@+-]*/g,S_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,v_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,E_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,x_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,R_=/\b(?:system|exec)\s*$/,__=/\b(?:eval|exec)\s*\(/g,w_=/\b(?:eval|exec)\s*$/,P_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Nf(e,t,n,r,o,i){for(let s of e){let a=s.target;if(_w(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=xw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&ww(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Hf(e,t,n,r,o={}){let i=Df(e,n,r),s=Nf(i,t,e.invocation.context.configCwd,n,r);if(s===null)return null;let a=s.ruleId!=="secret.deny-path"&&o.strict===!1?Df(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:Nf(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&A_(e,n))return null;return l}function A_(e,t){let n=pe(e,"input-candidate")??pe(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of xo(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(Xe(a.text,t))}let o=St(r);if(o.length===0)return!1;let i=it(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>c_.has(a))}function Df(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=pe(e,"input-candidate");return[...s?xn(s.shell,e.store,r,t,o,n,T_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function T_(e){return e.program.dialect==="powershell"}function xn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new We;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...iw(Xe(e.source,r),t,n,r,o,i)],l=(c)=>Xe(z_(c,s),r);return Eo(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...mi(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...k_(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...jf(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>O_(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return Ks;return a.push({target:l(c.target),cwd:u.cwd}),null}}),a}function Va(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new We;return s.status==="complete"?xn(s,t,n,r,o,i):null}function mi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(kf.has(it(St(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...mi(p,t,n,r,o,i)]}let l=F_(e).map(a),c=St(e);if(c.length===0)return l;let u=c[0]??"",m=it(u).toLowerCase(),d=c.slice(1),f=I_(u,m,d);if(f)return[...l,...f.map(a)];if(Bf.has(m))return n.capturedOutput===!0?[...l,...Vf(e).map(a)]:l;if(m==="eval")return[...l,...Va(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:ot(m,p)).map(a)];if(m==="git")return[...l,...$_(d).map(a)];if(kf.has(m))return[...l,...B_(d).map(a)];if(p_.has(m))return[...l,...fw(d).map(a)];if(s_.has(m))return[...l,...V_(d,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...d.flatMap((p)=>ot("awk",p)).map(a),...d.flatMap((p)=>q_(p,t,n,r,o,i)),...d.flatMap(Y_).map(a)];if(m==="curl")return[...l,...d.flatMap((p)=>ot(m,p)).map(a),...U_(d).map(a)];if(nr(m)){let p=er.has(m)?Se([m,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new We;if(h.status==="complete")return[...l,...xn(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...K_(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>ot(m,p)).map(a)]}function I_(e,t,n){let r=ai(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function k_(e,t,n,r,o,i,s){if(L_(t,n,r,o,i,s))return Vf(e).map((a)=>({target:a,cwd:i}));return jf(t,M_(e),n,r,o,i,s,()=>[])}function O_(e,t,n,r,o,i,s){let a=St(e);if(!nr(it(a[0]??"").toLowerCase()))return[];return Va(t,n,r,o,i,s)??[{target:t,cwd:i}]}function jf(e,t,n,r,o,i,s,a){let l=W_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>er.has(l)?xn(n.getShellSyntax(c),n,r,o,i,s):ui(l,c,n,r,o,i,s))}function Vf(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase();if(!Bf.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Ka(r.replaceAll("%%","%"))];return t.slice(1)}function M_(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return N_(r);return[]}function N_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ka(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>D_(t,r.slice(i*n,(i+1)*n)))}function D_(e,t){let n=0;return Ka(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ka(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function L_(e,t,n,r,o,i){let s=St(e);if(s.length===0||it(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Ut(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Ua]:l.map((m)=>m.split(c).join(Ua));return mi(u,t,n,r,o,i).some((m)=>m.target.includes(Ua))}function W_(e){let t=St(e);if(t.length===0)return null;let n=it(t[0]??"").toLowerCase();if(!nr(n))return null;return G_(n,t.slice(1))?n:null}function G_(e,t){let n=qa(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Uf.has(o)||Kf(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(P_.get(n)?.has(o))r++;continue}return!1}return!0}function qa(e){return/^python\d/.test(e)?"python":e}function F_(e){let t=[];for(let n of e){if(Yf(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Lf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function z_(e,t){if(!t||!Lf.test(e))return e;return`~${e.replace(Lf,"").replace(/\\/g,"/")}`}function ot(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function B_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>ot("jq",i))}return e.flatMap((r,o)=>o===t?[]:ot("jq",r))}function $_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>ot("git",i))];if(t.push(...ot("git",r)),!be.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:ot("git",o)),n++}return t}function U_(e){return e.flatMap((t,n)=>{let r=j_(t);if(r!==null)return Wf(r.flag,r.value);let o=H_(e[n-1]);return o===null?[]:Wf(o,t)})}function Wf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ha(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ha(t.slice(n+1))}return t.startsWith("@")?Ha(t.slice(1)):[]}function H_(e){if(e===void 0)return null;if($f.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function j_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return $f.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ha(e){return e===""||e==="-"?[]:[e]}function V_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!a_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>l_.has(f)),m=u===-1?c:c.slice(0,u),d=mi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,h)=>{if(!u_.has(f))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function K_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Uf.has(c)||Kf(e,c)){let m=t[l+1];if(m!==void 0)a.push(...ui(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...ui(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Kf(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return f_.get(t[t.length-1]??"")?.has(qa(e))??!1}function q_(e,t,n,r,o,i){if(!e.includes("system"))return[];return sa(e)?.commands.flatMap((s)=>xn(t.getShellSyntax(s),t,n,r,o,i))??[]}function Y_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function Z_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Ya),...e.match(ja)??[]]}function ui(e,t,n,r,o,i,s){let a=(f)=>({target:f,cwd:i}),l=J_(t,X_(e));if(l===null)return Z_(t).map(a);let c=l.masked.match(x_)!==null||l.literals.some((f)=>R_.test(l.masked.slice(0,f.start))),u=l.masked.match(__)!==null||l.literals.some((f)=>w_.test(l.masked.slice(0,f.start))),m=r.refineInlineData===!0&&!er.has(e),d=m&&!(nw(l.masked)||c||u)?[]:l.literals;return[...d.map((f)=>f.text).filter((f)=>f!=="").map(a),...d.flatMap((f)=>Ya(f.text)).map(a),...m?[]:l.literals.flatMap((f)=>f.text.match(ja)??[]).map(a),...c?l.literals.flatMap((f)=>Va(f.text,n,r,o,i,s)??[a(f.text)]):[],...u?l.literals.flatMap((f)=>ui(e,f.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
-`:h),n,r,o,i,s)):[],...(l.masked.match(ja)??[]).map(a)]}function X_(e){let t=qa(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function J_(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(v_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&tw(e,o))return null;let a=t==="python"?Q_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=ew(e,c,l);if(u===null)return null;let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&E_.test(m))return null;r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function Q_(e,t){return S_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function ew(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function tw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function nw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(d_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>m_.has(i)))continue;if(o.length>1)return!0;if(rw(e,r)===".")return!0;if(ow(e,r+n.length)==="(")return!0}return!1}function rw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function ow(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function iw(e,t,n,r,o,i){return uw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...xn(a,t,{...n,capturedOutput:!0},r,o,i),...sw(a,r)?aw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function sw(e,t){let n=xo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||it(Xe(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Xe(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function aw(e,t){return xo(e).flatMap((n)=>n.kind==="word"?[Xe(n.text,t)]:n.kind==="redirection"&&n.target?[Xe(n.target,t)]:[]).flatMap(Ya)}function Ya(e){let t=cw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||lw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function lw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function cw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function uw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Wn(o,n))continue;if(qf(e,r,n)){let i=dw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=mw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function dw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Wn(i,n))continue;if(qf(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function mw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function qf(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function fw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===g_)o=!0;if(y_.has(m))r=!0;if(d!==void 0){if(m===Mf)t.push(d);continue}if(b_.has(m)){let f=e[l+1];if(m===Mf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let h=0;h<m.length;h++){let g=m[h]??"";if(h_.has(g))r=!0;if(C_.has(g)){d=g,f=m.slice(h+1);break}}if(d==="")continue;if(f.length>0){if(d===Of)t.push(f);continue}let p=e[l+1];if(d===Of&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function St(e){let t=e.findIndex((n)=>!Yf(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Yf(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var pw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),gw=".env.",hw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),yw=[".env.example.",".env.sample."];function Cw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function bw(e){return e.length>0&&!/\s/.test(e)}function Sw(e,t,n,r){try{let o=vr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof N)throw o;return!1}}var vw=new Set(["node_modules","__pycache__"]),Ew=[["vendor","bundle"],["vendor","cache"]];function xw(e,t,n,r,o){if(Cw(e))return null;let i=He(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>bw(s)||Sw(e,t,r,o);if(hw.has(s)||yw.some((d)=>s.startsWith(d)))return null;let c=B(Tw(e,t,r,o));for(let d of is){let f=`~/${d.suffixParts.join("/")}`;if((Ff(a,f)||Ff(c,f))&&rt(d.id,n))return d.id}let u=Rw(i,t,n,r,o);if(u)return u;if(pw.has(s))return null;for(let d of os)if(s===d.basename&&rt(d.id,n))return d.id;if(s.startsWith(gw)&&rt(Br.id,n)&&l())return Br.id;for(let d of ss)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&rt(d.id,n)&&l())return d.id}for(let d of as)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&rt(d.id,n))return d.id}if(Pw(a))return null;if(!s.includes(".")&&Gn.pattern.test(s)&&rt(Gn.id,n))return Gn.id;let m=Aw(s,n);if(m)return m;return null}function Rw(e,t,n,r,o){return $r.find((i)=>{if(!rt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Sr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,He("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||br(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,le(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Sr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,He(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||br(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||br(e,s,["credentials"])||br(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>Sr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?z(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[le(z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?Sr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,He(u,t,r,o),l))}case"secret.cli.pi":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=He("~",t,r,o);return[le(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),le(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||br(e,le(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),le(He("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Sr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=le(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=le(z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,He("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&Vt(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,He("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Gf=new WeakMap;function z(e,t,n,r,o){let i=Gf.get(o)??new Map;Gf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=He(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>Zf(e,le(t,r)))}function br(e,t,n){return n.some((r)=>Vt(B(e),B(le(t,r))))}function Sr(e,t,n,r,o){return Zf(e,He(t,n,r,o))}function Zf(e,t){return B(e)===B(t)}function le(e,...t){return Be([e,...t].filter(Boolean).join("/"))}function _w(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(vr(e,t,o,i));return n.some((a)=>Vt(s,B(vr(a,r,o,i))))}function ww(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(vr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Be(F(Ce(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=B(u?Be(F(di(Ce(u)),o.paths,i)):l&&Be(F(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Vt(s,m))return!1;return n.some((d)=>{let f=B(vr(d,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return Vt(s,f)})}function Pw(e){let t=e.split("/");return t.some((n)=>vw.has(n))||Ew.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Aw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ls)if(r===o.extension&&rt(o.id,t))return o.id;for(let o of cs)if(o.pattern.test(r)&&rt(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function rt(e,t){return!t?.disabledRules?.includes(e)}function He(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i)return"";if(!o)return i;let s=Xa(i,o),a=ci(s)?s:Be(di(t,s)),l=Be(F(a,n.paths,r));if(!Vt(l,o)){if(ci(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Ff(e,t){return e===t||e.startsWith(`${t}/`)}function Tw(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i||!o)return"";let s=Xa(i,o),a=r_.normalize(ci(s)?s:Be(di(t,s))),l=Be(Ce(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Vt(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function vr(e,t,n,r){let{home:o,normalized:i}=Za(e,n,r);if(!i)return"";let s=o?Xa(i,o):i;return Be(F(ci(s)?s:di(t,s),n.paths,r))}function Za(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Be(F(Ce(r),t.paths,n)):"",i=Be(Ce(Iw(Xe(e,t))));return{home:o,normalized:i}}function Iw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return i_(e)}catch{return e}}function Xa(e,t){if(e==="~")return t;if(e.startsWith("~/"))return le(t,e.slice(2));return e}function kw(e){if(process.platform==="win32")return!0;return o_.parse(e).root.length>1}function Be(e){let t=e.trim(),n=(t.includes("\\")&&kw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Vt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function it(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Kt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Ow={findPolicyMutation:Tf,findGitMetadataMutation:ad,resolveGitMetadata:Mw,loadPolicySnapshot:qc,findSensitiveTarget:Hf,analyzeCommand:Sf,getModes:Mi};function Xf(e,t){let n={...Ow,...t.dependencies},r=Lw(e),o=Er(e)?e.command:r,i=vt("policy-protection",o,()=>rr(e)),s=pe(i,"input-candidate"),a=pe(i,"declared-command");if(Er(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:$e,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:wd,intent:"stop_and_explain"}};let l=ye(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Af,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=vt("policy-protection",o,()=>Rf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:xf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ae,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let f=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...Nw(f)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:Er(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:zf,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!Er(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Ja("command-validation",o),...g};let v=vt("command-analysis",o,()=>vf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Dw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function Mw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Nw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Dw(e){return pe(e,"declared-command")?.program}function Lw(e){try{return Tn(e.input)}catch(t){let n=Er(e)?e.command:void 0;throw new Kt("policy-protection",Ja("policy-protection",t instanceof Ve?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Kt(e,Ja(e,r instanceof Ve?void 0:t,r),r)}}function Ja(e,t,n){let r=n instanceof N||n instanceof We;return{stage:e,decision:{kind:"deny",reason:r?Ci:_n,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Er(e){return e.route.kind==="command"}import{appendFileSync as Yw,mkdirSync as Zw}from"node:fs";import{isAbsolute as Xw,join as tl}from"node:path";import{lstatSync as Qf,readdirSync as Ww,readFileSync as Gw,rmdirSync as Fw,statSync as ep,unlinkSync as zw,utimesSync as Bw,writeFileSync as $w}from"node:fs";import{join as xr}from"node:path";function Jf(e,t={}){return Zr(Qt(e,t),e.home).policy.audit.retention_days}var el=86400000,Uw=".last-prune",Hw=/^\d{4}-\d{2}$/,jw=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,tp=(e)=>Math.floor(e/el);function rp(e,t,n=()=>new Date){try{let r=n().getTime();if(!ep(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=xr(t,Uw),i=ep(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&tp(i)===tp(r))return;let s=r-Jf(e)*el,a=new Date(r).toISOString().slice(0,7);for(let l of Qa(t)){if(l.isDirectory()){Vw(xr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))Kw(xr(t,l.name),s)}$w(o,"",{mode:384}),Bw(o,r/1000,r/1000)}catch{}}function Vw(e,t,n){for(let r of Qa(e)){if(!r.isDirectory()||!Hw.test(r.name))continue;let o=xr(e,r.name);for(let i of Qa(o)){if(!i.isFile())continue;let s=jw.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+el;if(!Number.isFinite(a)||a>=t)continue;op(xr(o,i.name))}if(r.name!==n)np(o)}np(e)}function Kw(e,t){try{let n=Qf(e);if(n.mtimeMs>=t)return;let r=Gw(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(qw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Qf(e).mtimeMs!==n.mtimeMs)return;op(e)}catch{}}function qw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Qa(e){try{return Ww(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function op(e){try{zw(e)}catch{}}function np(e){try{Fw(e)}catch{}}var Jw="2.4.5",Qw=1e4,eP=2000,tP=256,nP=32768;function rP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function oP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function nl(e,t,n,r,o,i,s={}){let a=rP(t);if(!a)return;let l=sP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=fi(st(n),s.failureStage?Number.POSITIVE_INFINITY:Qw),m=fi(st(r),eP),d=s.toolName?fi(st(s.toolName),tP):void 0,f=i===null?void 0:fi(st(i),nP),p=tl(l,oP(f?.value??null),c.slice(0,7));Zw(p,{recursive:!0,mode:448});let h=tl(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Di)(),v:Jw,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Yw(h,`${JSON.stringify(g)}
-`,{encoding:"utf-8",mode:384}),rp(e,l,s.now)}catch{}}function fi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function iP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&Xw(n)?n:null}function sP(e){let t=iP(e);return t?tl(t,".cc-safety-net","logs"):null}function sp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=ip(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?ip(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function ip(e){return"command"in e?e.command??"":""}function ap(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;nl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function lp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;nl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function up(e,t,n){try{let r=Xf(t,{environment:e,...n.guard});return cp(e,t,r,n),r}catch(r){if(!(r instanceof Kt))throw r;throw cp(e,t,r.evaluation,n,!(r.cause instanceof Ve),{stage:r.stage,errorCode:aP(r.cause)}),r}}function cp(e,t,n,r,o=!0,i){ap(e,sp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function aP(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Ve)return"tool-input-limit";if(e instanceof We)return"structural-shell-syntax-limit";return"unexpected-error"}function Et(e,t={}){return{malformed:!0,denial:wn(t),cwd:e}}function dp(e,t={}){return(n,r)=>{try{return lP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(wn())}}}function lP(e,t,n,r){let o=Fl();if(n.cancelled?.(t))return n.block(wn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return lp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=ll(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=up(o,i,{guard:{auditAllowed:zl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Kt))throw l;if(Rt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${ul(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var mp="exec",cP=new Set(["auto","gateway"]);function fp(e){e.on("before_tool_call",uP(e),{matcher:[mp],priority:50})}function uP(e,t={}){return dp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>dP(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>pP(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function dP(e,t,n,r){if(!e||typeof e!=="object")return Et(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Et(null);if(o!==mp)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Et(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Et(null,{toolName:o});if(s.host!==void 0&&!cP.has(s.host))return Et(null,{command:a,toolName:o});let l=mP(n,t.agentId,r);if(!l)return Et(null,{command:a,toolName:o});let c=fP(l,s,r);if(!c)return Et(l,{command:a,segment:typeof s.workdir==="string"?s.workdir:void 0,toolName:o});return In(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function mP(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return wi(".",[r],n)}catch{return}}function fP(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return wi(r,[e],n)}function pP(e){return{block:!0,blockReason:cl(e)}}var EL={...al,register:fp};export{EL as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function qo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function mr(e){return e?w(e):""}function Ex(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Ia(e,t){return Pa(Ne(e,"posix"),t)}function gr(e){return Ia(e,new Set(Array.from(e.matchAll(Rf)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Pa(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Pa(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Pa(o,n))||Pf(r.words,n))return!0;Ax(r,n)}return!1}function Pf(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(pr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return xf(e[s],t)}if(J.has(o)){let s=e.slice(n),a=ve(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&xf(s[l],t)}let i=xx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Pf(e.slice(i),t)}function xx(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return Rx(e,t+1);if(r==="exec")return _x(e,t+1);if(r==="env")return wx(e,t+1,n);return null}function Rx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function _x(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function wx(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return pr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return pr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function Ax(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(pr(n,t))t.add(r.name)}}function pr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Rf)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(mx.test(o)||t.has(o))}))}function xf(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||pr(e,t))}var Px=["--init-file","--rcfile"],Tx=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function rt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Tf(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Tf(e,t,!1);if(r!==null)return r}}return null}function ot(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return ve(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Tf(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function If(e){let t=k(e[0]??"").toLowerCase(),n=Ix(e,t),r=Tx.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Ix(e,t){let n=ve(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?Px.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let f=l.split("=",1)[0]??l;if(t==="bash"&&Zi.has(f)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Xi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var ka="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Oa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",kx="__CC_SAFETY_NET_XARGS_INPUT__",Yo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Zo="rm",Ox=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Mx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Nx=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Dx=/^(?:[0-9]+|[@*])$/;function Mf(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Ut(n),i=n.slice(r),s=b("xargs.shell-dynamic",Oa);if(Wx(i,o,t)&&P(s,t.policy))return P(s,t.policy);for(let a of ze(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?P(s,t.policy):null;if(c)return c;let u=Ff(l,o,a.wrapperEnvAssignments),f=a.head==="rm"&&o!==null&&Wf(l,o),d=t.analyzeChild(l,{...zt(a,t),dynamicInput:u,dynamicSourceInput:f||Df(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:f,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",ka)});if(d)return d;let m=Lx(l,o,t.policy?.rules??[],P(s,t.policy));if(m)return m;if(a.head==="git"){let g=o===null?[...l,kx]:l,h=o!==null&&(l.some((S)=>S.includes(o))||Array.from(a.envAssignments.values()).some((S)=>S.includes(o))),y=t.analyzeChild(g,{...zt(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=et(l,t.policy?.rules??[]);if(p)return p}return null}function Lx(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=et([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Nf(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=bf(e,r,t.length,n);return o===null?[]:[o]}function Df(e,t,n,r,o,i,s){if(J.has(t)){if(ot(e))return!1;if(n!==null&&Gx(e,n,s))return!0;let a=rt(e);if(!a){let l=nt(K(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Lf(a,n,s))return!0;if(Ae(a))return!0;return Fx(a,n,r)}if(Me(t))return kf(e,n,ho,Bu(t));if(we.has(t))return kf(e,n,ua,Bd);if(t==="eval"){let a=Vo(K(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return zx(e,n,i);if(t==="git"){let a=Re(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&pn.has(a.subcommand.toLowerCase())&&Gf(a.rest,n).some((l)=>l.includes(n))}return!1}function Lf(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Ae(i)===null&&n(i)===null}function kf(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Yo]).sources.some((a)=>a.value===Yo);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Yo}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Yo}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Nf(l,t,a))));return Ho(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function Wx(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(ze(e,n),(i)=>i.head)),o=t===null?[...e,Zo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Zo));return Array.from(ze(o,n)).some((i)=>i.head===Zo&&!r.has(Zo))}function Wf(e,t){return Gf(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Gf(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Ff(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function Gx(e,t,n){let r=ve(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Lf(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Nf(a,t,s).some((u)=>{let f=e.map((m,p)=>p===l?m.replaceAll(t,u):m),d=ve(f);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(f[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(f[d.scriptIndex]??"").includes(u)})}))}function Fx(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Ox))if(Of(o,r))return!0;for(let o of e.matchAll(Mx))for(let i of(o[1]??"").matchAll(Nx))if(Of(i,r))return!0;return Ia(e,r)}function Of(e,t){let n=e[1]??e[2];return n!==void 0&&(Dx.test(n)||t.has(n))}function zx(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(tt(s)){let l=ur(e,i);i=l.nextIndex-1;for(let c of ze(l.tokens,{environment:n,cwd:void 0})){let u=Ff(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Wf(c.tokens,t)||Df(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=yt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Ut(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var hr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",yr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",$x="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Ux="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Jo=/\{[^{}\s]*\}/g,zf=/\{\}|\{-?\d+\}/g,Hx=["e","f","source","file","-e","-f","--source","--file"],jx=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Vx=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Kx=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Bf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),qx=new Set(["--workdir","--wd"]),$f="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ie(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Kf(e){return Ie([...e],(t)=>Ae(t))}function qf(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=hn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=rm(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:f}=o;if(c){let p=hn(t);if(p)return p;let g=Kf(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=eR(t);if(p)return p}if(u!==void 0&&a){let p=hn(t);if(p)return p}let d=tR(u,t.cwd,t.environment.paths);if(d===null){let p=hn(t);if(p)return p}let m=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(f){if([...ze(i,m)].flatMap((g)=>[...g.envAssignments.values()]).some(Da)){let g=hn(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=Jf(m.envAssignments,m.cwd,a);return Ie(p,(h)=>t.analyzeNested(h,g))}return Ie(ze(i,m),(p)=>Yx(p,o,t,m))}function Yx(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(tm)){let h=hn(n);if(h)return h}let u=Kf(c);if(u)return u;let f=c.some(G),d=i||f,m=a&&d,p=Jf(e.envAssignments,e.wrapperCwd,s||m);if(J.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ie(o,(E)=>n.analyzeChild(Xo(l,E,n.budget),zt(e,r)))};if(ot(l))return h();let y=rt(l);if(y){if(nm(y)){let x=St(n);if(x)return x;if(o.length===0)return null;return Ie(o,(A)=>n.analyzeNested(jf(y,A,n.budget),p))}if(G(y)){if(o.length>0)return Ie(o,(q)=>n.analyzeNested(jf(y,q,n.budget),p));let x=dr(y);if(x?.[0]&&M(x[0])==="rm"&&Be(x)){let q=Hf(n);if(q)return q}let A=x?n.analyzeChild(x,{...zt(e,r),dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",yr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",hr)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!f&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>Ko(K(x===void 0?l:i?l.map((A)=>Qf(A,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=St(n);if(x)return x}let v=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(v.length>0)return n.budget.charge("derivedTokens",v.length),Ie(v,(x)=>n.analyzeNested(x,p));if(gr(y)){let x=St(n);if(x)return x}let T=n.analyzeNested(y,p);if(T)return T;if(d)return St(n);return null}let S=nt(K(l));if(S.kind==="dynamic"||S.kind==="literal"&&G(S.source))return St(n)??h();if(S.kind==="literal")return h();if(o.length>0){let E=St(n);if(E)return E;let v=h();if(v)return v;if(i)return null;let T=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",T.length),Ie(T,(x)=>n.analyzeNested(x,p))}if(d||a)return St(n)??h();return null}if(e.head==="rm"&&Be(l)){if(i&&o.length>0)return Ie(o,(y)=>Ma(Xo(l,y,n.budget,zf),e.cwd,r));if(o.length>0)return Ie(o,(y)=>Ma(Vf(l,y,n.budget),e.cwd,r));let h=Ma(l.flatMap((y,S)=>{if(S===0||!G(y))return[y];return y.startsWith("-")?[y.replace(zf,"")]:[]}),e.cwd,r);if(h)return h;return Hf(n)}let g=o.length>0?o:[void 0];return Ie(g,(h)=>{let y=h===void 0?l:i?Xo(l,h,n.budget):Vf(l,h,n.budget),S=b("parallel.shell-dynamic",yr),E=a&&e.head==="find"?Qx(y,r):null,v=Zf(y,a,n)??E?.customResult??null,T=M(e.head),x=a&&(T==="rm"&&Na(y)||T==="xargs"&&Xf(y)||E?.rmOptions===!0),A=a&&(x||E?.executedSource===!0||E===null&&Yf(y,T)),q=n.analyzeChild(y,{...zt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:x,dynamicSourceInput:v!==null||A,shellDynamicMatch:S,dynamicSourceMatch:S,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",hr)});if(A){let Z=P(S,n.policy);if(Z)return Z}return q??v??et(y,n.policy?.rules??[])})}function Yf(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return Jx(e);if(t==="git")return Zx(e);if(t==="find")return!0;if(we.has(t))return Uf(e,Hx,cr);if(Me(t))return Uf(e,jx,go);return!1}function Na(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||nm(o)))}function Zx(e){if(Xx(e))return!0;let t=Re(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!pn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function Xx(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function Jx(e){if(ot(e))return!1;let t=rt(e);if(t!==null)return G(t);let n=nt(K(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function Uf(e,t,n){let r=n(e);if(r.some((o)=>G(o.value)))return!0;if(!e.some(G))return n([...e,$f]).some((o)=>o.value===$f);return Ho(r,t,(o)=>n(e.map((i)=>Qf(i,[o]))))}function Zf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(G))return St(n);return Ie(o,(i)=>et([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function Qx(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of ze(i,t))n.executedSource||=Yf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Na(a.tokens)||a.head==="xargs"&&Xf(a.tokens),n.customResult??=Zf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(tt(a)){i=[],n.executedSource||=G(a);continue}let l=yt(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function Xf(e){let t=e.slice(Ut(e).childStart);return M(t[0]??"")==="rm"&&Na(t)}function Qo(e,t){return(n)=>P(b(e,t),n.policy)}var St=Qo("parallel.shell-dynamic",yr),eR=Qo("parallel.command-stream-dynamic",$x),hn=Qo("parallel.command-stream-dynamic",Ux),Hf=Qo("parallel.rm-recursive-force-dynamic",hr);function Ma(e,t,n){return P(jo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Lt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Jf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Qf(e,t){return e.replace(Jo,(n)=>em(n,t))}function Xo(e,t,n,r=Jo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=em(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function jf(e,t,n){return Xo([e],t,n)[0]??""}function Vf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function em(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function G(e){return e.search(Jo)!==-1}function tm(e){if(Da(e))return!0;for(let t of e.matchAll(Jo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Da(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function nm(e){return/^\{[^{}\s]*\}$/.test(e)}function tR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Bx(e))return null;try{return mt(t??e,e,n)}catch{return null}}function rm(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ma(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ma(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let g=e[t+1],h=p.indexOf("="),y=h===-1?p:p.slice(0,h),S=h===-1?void 0:p.slice(h+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?S:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||Kx.has(y)){c=!0,t+=S===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=S===void 0?2:1;continue}if(Bf.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=Bf.has(p)?2:1;continue}if(qx.has(y)){c=!0;let E=S??g;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=S===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&S!==void 0){t++;continue}if(Vx.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Da:tm);let u=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let h=e[g];if(h===":::"){u.push(p),p=[];continue}if(h!==void 0)p.push(h)}u.push(p)}c||=u.length>1;let f=nR(u),d=n.some(G),m=n.length===0&&o===-1;return{template:n,jobs:f,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:m,unsupported:c,workdir:a,dryRun:l}}function nR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function om(e){return rm(e).childStart}var rR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",ei="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Wa(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function La(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function sm(e,t,n,r,o=!1,i){let a=(Bn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",rR):null;return P(a,i)??am(e,t,n,o,i)}function am(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Wa(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=sn(e,t),l=iR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((f)=>f<=l))return P(b("shell.dynamic-structure",ei),o);if(P(Uo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((f,d)=>d>l&&w(f)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&pn.has(c)&&i.some((f)=>f>l&&(u===-1||f<u)))return P(b("shell.dynamic-structure",ei),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&sR(t)?P(b("shell.dynamic-structure",ei),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=Be(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?P(b("shell.dynamic-structure",ei),o):null}if(s==="xargs")return im(e,t.slice(Ut(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return im(e,t.slice(om(t.map(w))),"parallel",n,r,o);return null}function im(e,t,n,r,o,i){if(t.length===0)return null;let s=oR(t,r);if(Bn(e,s)){let l=P(b(`${n}.shell-dynamic`,n==="xargs"?Oa:yr),i);if(l)return l}let a=am(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Wa(l)&&La(l)))return P(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?ka:hr),i);return null}function oR(e,t){let n=Ot(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function iR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(Se.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function sR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Wa(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||La(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||La(s)))return!0;continue}if(t=!0,a)return!0;let l=yt(s.text);if(l>0){n=l;continue}if(tt(s.text))o=!0,r=!0}return!1}function Ga(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!uo(t[n.tokenIndex],n.value)})}var aR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",lR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",cR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function lm(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",aR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",lR);if(e==="shred"&&n.length>0)return b("shred.target",cR);return null}var um=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Uo(e.words,Fa(e))},{heads:new Set(["find"]),analyze:(e)=>Kd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>Mf(e.words,{...cm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>qf(e.words,{...cm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})}];function cm(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ht(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Fa(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function pm(e){return um.find((t)=>t.heads.has(e))?.analyze}function Cn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,f=s?s.originalCwd:c?void 0:n.cwd,d=bo(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let m=Ot(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=m.envSplitValues??[];if(p.length>0){let R=[...p,...i(m.words)].join(" "),I=Ae(R);if(I)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:I.reason}),de(I);if(n.strict)return ye(r);let L=So(p,i(m.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:m.cwd===void 0?n.effectiveCwd:m.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...m.envAssignments])});if(te)return te}}let g=m.rewritten?K(i(m.words)):sn(o,m.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>g.length){let R=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-g.length),output:h})}let S=new Map([...n.envAssignments??[],...d.envAssignments,...m.envAssignments]),E=h[0];if(!E)return null;if(Ft(E))throw new N("wrapperPeelIterations");let v=M(E),T=m.cwd===null?void 0:m.cwd??u,x=m.cwd===null?void 0:f,A=m.cwd===void 0?n.effectiveCwd:m.cwd,q=s?s.allowTmpdirVar:!or(S,n.environment),Z=sm(o,m.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),de(Z);let ee=Wo(h,n.policy);if(ee){for(let R of[ee.childIndex,...ee.alternativeChildIndices]){dm(y.wrapperNormalizationBudget);let I=g.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=Cn(I,t,{...y,effectiveCwd:A,envAssignments:S});if(L)return L}return null}let X=l?void 0:v==="eval"?Vo(g):v==="trap"&&!a?wf(g):void 0;if(a&&s&&v==="eval"){if(X?.kind==="dynamic")return yn(s,n.policy);if(X?.kind==="literal"){let R=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:S});if(R)return R}return bn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!Ta(n.commandView)))return ye(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:v==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let R=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:S,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?J.has(v):hm(E,v)){if(ot(h))return null;if(a&&s){let R=rt(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=yn(s,n.policy);if(L)return L}if(gr(R)){let L=yn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:A,envAssignments:S})}let I=nt(g);if(I.kind==="dynamic")return yn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?yn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?yn(s,n.policy):null}if(l){let R=rt(h),I=R?n.analyzeNested(R,{effectiveCwd:A,envAssignments:S}):nt(g).kind==="dynamic"?ye(r):null;if(I)return I}if(s===void 0){let R=mR(h,S,A,n,r,t);if(R)return R;let I=rt(h);if(I){let qt=Ko(g,I);if(qt.kind==="dynamic")return ye(r);let yi=qt.kind==="literal"?qt.source:I,pl=pR(yi);r?.recordSegment({type:"shell-wrapper",wrapper:v,innerCommand:pl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:pl,depth:t+1});let gl=n.analyzeNested(yi,{effectiveCwd:A,envAssignments:S});if(gl)return gl;return gr(yi)?ye(r):null}let L=nt(g);if(L.kind==="dynamic")return ye(r);if(L.kind==="literal")return ti(L.source,A,S,n,r,t);let te=Af(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:A,envAssignments:S})}}if(!s&&(v==="source"||v===".")){let R=h[1]==="-p"?2:null;if(R!==null){let qt=n.commandView?g[R]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return ye(r)}let I=R===null?1:3,L=h[I]==="--"?I+1:I,te=n.commandView?g[L]:void 0;if(!te)return null;if(te.provenance==="literal")return ti(te.text,A,S,n,r,t);if(n.strict||!n.commandView||!Ta(n.commandView))return ye(r)}if(we.has(v)&&!l){if(!s&&n.strict&&Ga(cr(h),g))return ye(r);let R=$d(h,(L)=>Ht(n.analyzeNested(L,{effectiveCwd:A,envAssignments:S}))),I=P(R,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),de(I)}if(Me(v)&&!l){if(!s&&n.strict&&Ga(go(h),g))return ye(r);let R=zu(h);if(a&&s)return dR(v,R,A,S,n,s);if(R){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:v,codeArg:R,paranoidBlocked:I}),I){let te=P(b("interpreter.one-liner-paranoid",Yn),n.policy);if(te)return de(te)}if(Us(v,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:A,envAssignments:S});if(L&&!gm(L,R))return L;if(Zn(R,void 0,!n.strict)){let te=P(b("interpreter.dangerous-command",cn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:cn}),de(te)}r=void 0}}if(v==="busybox"&&h.length>1)return dm(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),Cn(g.slice(1),t,{...y,effectiveCwd:A,envAssignments:S});let D=s?null:P(lm(v,h),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),de(D);let ue=r===y.trace?y:{...y,trace:r},_e={words:g,head:v,cwd:T,originalCwd:x,envAssignments:S,allowTmpdirVar:q,dynamicArguments:m.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:ue,analyzeChildTokens:(R,I)=>a&&s?za(R,t,ue,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ht(Cn(K(R),t+1,{...ue,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:S}))??et(R,ue.policy.rules),analyzeChild:(R,I)=>za(R,t,ue,I)},qe=s&&(v==="xargs"||v==="parallel")?void 0:pm(v);if(v==="rm"||v==="xargs"||v==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:S.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let ke=r&&v==="git"?Cf(_e.words,Fa(_e)):void 0,gi=fm(ke?ke.match:qe?.(_e)??null,n.policy);if(r)gR(_e,gi,ke?.relaxation??null);if(gi)return de(gi);if(a&&s&&(v==="rm"||v==="rmdir")){if(!(v==="rm"&&(Be(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?bn(s,n.policy):null)??fR(s,n.policy)}let fl=qe!==void 0,ml=!s&&!fl&&!Wr.has(v),hi=r&&ml?[]:void 0;if(ml)for(let R=1;R<h.length;R++){let I=h[R];if(!I)continue;hi?.push(I);let L=fm(uR(h,R,t,ue,T,x,A,S),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:hi??[],embeddedCommandFound:M(I)}),de(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:hi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&fl)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let _r=et(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!_r,reason:_r?.reason}),_r)return de(_r);return a&&s?bn(s,n.policy):null}function za(e,t,n,r){return Ht(Cn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function uR(e,t,n,r,o,i,s,a){for(let l of ze(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=M(c);if(hm(c,u)||pm(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=za(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!or(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function dR(e,t,n,r,o,i){if(!t)return bn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=P(b("interpreter.one-liner-paranoid",Yn),o.policy);if(a)return de(a)}if(Us(e,t))return bn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!gm(s,t))return s;if(Zn(t,void 0,!o.strict)){let a=P(b("interpreter.dangerous-command",cn),o.policy);if(a)return de(a)}return bn(i,o.policy)}function gm(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(No)||e.reason===mn)&&!Gr(t)}function yn(e,t){let n=e.shellDynamicMatch?P(e.shellDynamicMatch,t):null;return n?de(n):null}function bn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?P(e.dynamicSourceMatch,t):null;return n?de(n):null}function fR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?P(e.rmDynamicMatch,t):null;return n?de(n):null}function mR(e,t,n,r,o,i){let s=If(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ti(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ti(a,n,t,r,o,i,!0)}function ti(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=qn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function pR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function gR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function dm(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function de(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:ar}),de(hR())}function hR(){return{id:"",reason:ar,intent:"stop_and_explain"}}function hm(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function fm(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:P(e,t)}var yR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,CR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function bR(e,t){let n=bm(e,t);if(n.length===0)return!1;let r=n[Cm(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return yR.test(e.join(" "))}function ym(e,t,n,r,o){if(e.dialect==="powershell"){let h=vR(e.words,o);if(h.kind==="none")return;if(!t||h.kind==="unknown")return null;return mm(_R(h.target),t,n.paths)}let i=e.words.map(w),s=i.some((h)=>/^CDPATH\+?=/.test(h));if(!bR(i,n))return s?null:void 0;if(!t)return null;let a=bm(i,n,t),l=Cm(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((h)=>h.length<=1||!h.startsWith("-")||h==="--");if((u===-1?c:c.slice(0,u)).some((h)=>!/^-[LP]+$/.test(h)))return null;let d=u===-1?[]:c.slice(u),m=d[0]==="--"?d.slice(1):d;if(m.length!==1)return null;let p=m[0]??"",g=e.words.some((h)=>h.provenance==="variable"&&h.text===p)?SR(p,r):p;if(g===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(g)&&(s||n.env.has("CDPATH")))return null;return mm(g,t,n.paths)}function SR(e,t){let n=fr(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function mm(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return mt(t,e,n)}catch{return null}}function vR(e,t){let n=ER(e[0])?1:0,r=e[n];if(!xR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!CR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return RR(e.slice(n+1),t)}function ER(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function xR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function RR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function _R(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Cm(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function bm(e,t,n){let r=wR(e);return pt([...r],t,n)}function wR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var AR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",jt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function ja(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Ne(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Ha(e,n);let u=`${No}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return _m(e,n),{reason:mn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return _m(e,n),{reason:mn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Ha(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=sf(n.environment.env,n.envAssignments);return oi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function oi(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],f=u?.kind==="connector"?u.operator:void 0,d=PR(e,l,c,a,f),m=a==="&&"||a==="||",p=m?s:void 0,g=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,h=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],S=m||vn(f);if(c.kind==="function"){let Z=g.flatMap((X)=>{let U=En(X);return U.functionDefinitions.set(c.name,c.body),Ba(X,[U],d,f==="&",vn(f))}),ee=$a(Z,[],h,y,a,f);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of g){let D=oi(c.body,t,n,r,[En(U)]);if(D.result)return D;if(Z.push(...Ba(U,D.states,d,f==="&",vn(f))),S)ee.push(U,...d?D.states.map((ue)=>ni(U,ue)):D.states)}let X=$a(Z,ee,h,y,a,f);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),v=e.nodes[l-2],T=ii(a)&&v?.kind==="command"?_f(v)??IR(v):void 0,x=[],A=[];for(let Z of g){let ee=kR(c,t,n,r,[En(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ni(Z,U));for(let U of X){let D=En(U),ue=NR(c,t,n.trace?{...n,trace:wm(n.trace,E)}:n,r,D,ii(a),T);if(ue)return{result:ue,states:i};let _e=ZR(c,D.functionDefinitions);if(_e)n.budget.charge("derivedTokens",si(_e));let qe=_e?t+1>=V.recursionDepth.cap?Ua(c.displayText,n,[D]):oi(_e,t+1,n,r,[D]):{result:null,states:qR(c,D)};if(qe.result)return qe;if(x.push(...Ba(Z,qe.states,d,f==="&",vn(f))),S)A.push(Z),A.push(...qe.states.map((ke)=>d?ni(Z,ke):ke))}}let q=$a(x,A,h,y,a,f);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function PR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ii(r)||ii(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&TR(e,t)}function Ba(e,t,n,r,o){let i=n?t.map((a)=>ni(e,a)):[...t],s=o?i.flatMap((a)=>Sn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ni(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function TR(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(OR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ii(e){return e==="|"||e==="|&"}function IR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function vn(e){return e==="&&"||e==="||"}function $a(e,t,n,r,o,i){let s={success:ri([...n,...e]),failure:ri([...r,...t])},a=vn(i)?s:void 0;return{states:vn(o)||a?ri([...s.success,...s.failure]):s.success,conditionalStates:a}}function wm(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function kR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=MR(e);if(s){if(t+1>=V.recursionDepth.cap)return Ua(s,n,o);let a=Ne(s,"powershell");if(a.status==="limited")return Ua(s,n,o);if(a.status!=="complete")return Sm(i,n,r,o);n.budget.charge("derivedTokens",si(a)),i.push({program:a,depth:t+1})}}return Sm(i,n,r,o)}function OR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Sm(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=oi(i.program,i.depth,t,n,[En(a)]);if(l.result)return l;s.push(...l.states)}o=ri(s)}return{result:null,states:o}}function MR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function si(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+si(o),0):n.kind==="group"||n.kind==="function"?si(n.body):0),0)}function Ua(e,t,n){return t.trace?.recordSegment({type:"error",message:He}),{result:{reason:He,segment:e,intent:"stop_and_explain"},states:[...n]}}function NR(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=BR(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Am(e,o,"before-consumer",a.environment.paths,a.budget);let c=sn(e.dialect,e.words),u=c.map(w),f=e.displayText,d=of(c,o.shellGitContextState),m=lf(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=P(Nd(e,i,JR(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return XR(f,h)}if(u.length===1&&u[0]?.includes(" ")&&!Bn(e.dialect,e.words)){let h=P(Ae(u[0]),a.policy),y=h!==null&&!a.strict&&Lu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:f,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let S=vm(e,l,o,m,s,a);if(S)return S;return xa(d,o.shellGitContextState),null}let p=Cn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:m,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let S=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=ja(h,t+1,{...a,effectiveCwd:S,envAssignments:y?.envAssignments??m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?wm(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:f};let g=vm(e,l,o,m,s,a);if(g)return g;return xa(d,o.shellGitContextState),null}function vm(e,t,n,r,o,i){let s=$R(e,t,n,r??new Map,i);if(s)return s;return Am(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),WR(e,t,n,i.environment.paths,i.budget),jR(e,n,o,i.environment,i.trace),null}var DR=new Set([">>","<>"]);function Am(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?LR(s):DR.has(s.operator)))continue;Em(s.target,t,r,o)}if(n!=="before-consumer"||!le(e.words[0],"tee"))return;let i=Pm(e.words.slice(1));if(!i)return;for(let s of i.operands)Em(s,t,r,o)}function LR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Em(e,t,n,r){let o=e?.provenance==="literal"?qn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function WR(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of GR(e)){let a=qn(s.text,n.effectiveCwd,r,o);if(!a||!Fu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function GR(e){let t=zR(e.redirections)?.target,n=xm(t)?[t]:[];if(le(e.words[0],"cat"))return FR(e.words)?n:[];if(!le(e.words[0],"tee"))return[];let r=Pm(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(xm))return[];return[...r.operands,...n]}function FR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function zR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Pm(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&le(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=Array.from(i.text.slice(1)).some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function xm(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function le(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Va(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function BR(e,t){let n=e.redirections.filter((a)=>a.operator==="<<"||a.operator==="<<-");if(n.length===0)return;if(n.length!==1)return jt;let r=n[0];if(!r?.heredoc)return jt;if(!Va(r.heredoc)&&!(t&&!/\$\(|`/.test(r.heredoc.body)))return AR;if(r.fd!==void 0&&r.fd!==0)return jt;if(e.redirections.some((a)=>a!==r&&["<","<<","<<-","<<<","<&","<>"].includes(a.operator)))return jt;let o=e.redirections.some((a)=>a!==r&&Rm(a.target));if(le(e.words[0],"cat"))return o?jt:void 0;if(le(e.words[0],"tee"))return o||e.words.slice(1).some(Rm)?jt:void 0;let i=e.words[0],s=e.words[1];if(le(i,"git")&&(le(s,"apply")||le(s,"commit")))return;if(le(i,"gh")&&(le(s,"pr")||le(s,"issue"))&&le(e.words[2],"create"))return;return jt}function Rm(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function $R(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(HR(e,i,n,r,o))return null;let a=UR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Ha(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function UR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Va(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=le(e.words[0],"uv")&&le(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Me(i.text))return;let s=o.findIndex((f)=>le(f,"-"));if(!o.slice(1,s===-1?void 0:s).every((f)=>f.provenance==="literal"&&f.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let f=P(b("interpreter.one-liner-paranoid",Yn),n.policy);if(f)return f}if(!Zn(l,void 0,!n.strict))return null;let u=P(b("interpreter.dangerous-command",cn),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function HR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Va(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Ot(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return ot(a)}function jR(e,t,n,r,o){let i=ym(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var VR=/^[A-Za-z_][A-Za-z0-9_]*$/,KR=8;function qR(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!VR.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=KR&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=En(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function En(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:af(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ri(e){let t=[];for(let n of e){if(!t.some((r)=>YR(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function YR(e,t){return e.effectiveCwd===t.effectiveCwd&&Sn(e.shellGitContextState.env,t.shellGitContextState.env)&&Sn(e.literalHeredocFiles,t.literalHeredocFiles)&&Sn(e.functionDefinitions,t.functionDefinitions)&&Sn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Sn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function Sn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function ZR(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function XR(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function JR(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Ha(e,t){let n=P(Ae(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function _m(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:mn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var QR=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Tm(e,t,n,r){let o=ja(e,0,{...t,...ou(t),budget:t.budget??Ce(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function Im(e,t,n){try{return{decision:e()}}catch(r){let o=e_(r,t,n);if(!o)throw r;return o}}function e_(e,t,n){if(!(e instanceof N)||!QR.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var t_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),qa=new Set(["cc-safety-net","ccsn"]),n_=new Set(["bunx","npx","pnpx"]),r_=new Set(["pnpm","yarn"]),o_=new Set(["npm","pnpm","yarn"]),i_=new Set(["bun","node"]);function li(e,t,n={}){if(qa.has(e))return 0;if(n_.has(e)){if(n.broad)return Ka(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return ai(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&o_.has(e)&&n.broad&&t[r]==="exec"){let o=Ka(t.slice(r+1));return o===null?null:r+1+o}if(r_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&ai(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ka(t.slice(r+1));return o===null?null:r+1+o}if(i_.has(e)){let o=n.broad&&r!==-1?r:0;if(km(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&km(t[o+1]))return o+2}return null}function Ka(e){let t=e.findIndex((r)=>ai(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!ai(r))break;n++}return n}function ai(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return qa.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return qa.has(e.slice(0,t))}function km(e){let t=e?.replaceAll("\\","/");return[...t_].some((n)=>t===n||t?.endsWith(`/${n}`))}var Om="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Mm(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=dn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>s_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function s_(e,t){let n=pt([...e],t),r=n.slice(1),o=li(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ci}from"node:path";var Wm="This path contains the protected policy config and you must not modify or delete it.",a_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Gm(e,t,n){let r=m_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Nm(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Dm(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Dm(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Nm(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Pr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Nm(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>Cr(a,n,r,o,i));return s?{target:s}:null}function Dm(e,t,n,r,o){let i=dn(e,t,r,o,{findSegmentTarget:(s,a)=>l_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>Cr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>f_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function l_(e,t,n,r,o){if(tr(e))return null;let i=Mt([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&c_(a)){let l=u_(a).find((c)=>Lm(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(zo(i,1)||ga(i,r)){let c=(Fo(K(i))??K(["."])).find((u)=>{let f=pe(u.text,t.variables);return Cr(f,t.cwd,n,r,o)||Lm(f,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=wo(a).sources.find((c)=>p_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(d_(i,s))return null;for(let l of[...e,...i])for(let c of Fm(l))if(Cr(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function c_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function u_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function d_(e,t){if(!a_.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function f_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Fm(i))if(Cr(s,t,n,r,o))return{target:s};return null}function Fm(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function m_(e,t,n){let r=(a)=>br(se(a,e.executionCwd,t,n)),o=r(Qt(t)),i=[r(Ln(e.executionCwd)),r(Ln(e.configCwd))],s=new Set(i.map((a)=>ci(a)));for(let a=ci(o);;a=ci(a))if(s.add(a),ci(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function Cr(e,t,n,r,o){let i=Rl(e,t,r,o,(s)=>br(s)===Dr);return i!==null&&n.files.has(br(i))}function Lm(e,t,n,r,o){return n.directoriesAndAncestors.has(br(se(e,t,r,o)))}function p_(e,t,n,r,o){let i=br(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function br(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ui,posix as Xm,resolve as fi,win32 as g_}from"node:path";import{fileURLToPath as h_}from"node:url";var Jm="Access to a sensitive path is not allowed.",Qm=new Set(["echo","printf"]),y_=new Set(["find"]),C_=new Set(["!","do","elif","else","if","then","until","while"]),b_=new Set(["-exec","-execdir"]),S_=new Set([";","+"]),v_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),E_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),ep=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),x_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),R_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),tp=new Set(["-c","-e","-r","-E","--eval","--exec"]),__=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),w_=new Set(["grep","rg"]),A_=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),P_=new Set(["commit","merge","notes","stash","tag"]),T_=new Set(["-m","--message"]),I_=new Set(["--grep"]),zm=new Set(["jq","gojq","jaq"]),Bm="f",$m="file",k_="files",O_=new Set(["e","f"]),M_=new Set(["regexp","file"]),N_=new Set(["e","f","A","B","C","m"]),D_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Ya="__CC_SAFETY_NET_PIPE_INPUT__",Xa=/[\w./~@+-]*[./~][\w./~@+-]*/g,L_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,W_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,G_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Um=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Hm=/\b(?:system|exec|spawn|popen)\s*$/,F_=/\b(?:eval|exec)\s*\(/g,z_=/\b(?:eval|exec)\s*$/,B_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function jm(e,t,n,r,o,i){for(let s of e){let a=s.target;if(Gw(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=Lw(a,s.cwd,t,r,o);if(l){let c=!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(i&&(c&&r.paths.isDirectory(lp(a,s.cwd,r,o))||c&&s.written===!0&&!a.includes("$")&&!Qa(a,s.cwd,r,o)||c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!Qa(a,s.cwd,r,o)))continue;if(!l.startsWith("secret.cli.")&&Fw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function np(e,t,n,r,o={}){let i=Vm(e,n,r),s=jm(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=jm(i,t,e.invocation.context.configCwd,n,r,new Set(Vm(e,n,r,{standard:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&$_(e,n)?null:a}function $_(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of _o(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(Qe(s.text,t))}let o=st(r);if(o.length===0)return!1;let i=Ue(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return el(i,o.slice(1))}function el(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>v_.has(n))}function Vm(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?xn(s.shell,e.store,r,t,o,n,U_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function U_(e){return e.program.dialect==="powershell"}function xn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Ge;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...bw(Qe(e.source,r),t,n,r,o,i)],l=(c)=>Qe(ew(c,s),r);return Ro(e,o,r,i,{word:l,segment:(c,u,f,d,m)=>{if(c.length===0)return null;if(a.push(...mi(c,t,n,r,u.cwd,i,m)),f!==null)a.push(...j_(f,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...rp(c.consumer,[c.body],t,n,r,u.cwd,i,(f)=>V_(c.consumer??[],f,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return Js;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{written:!0}:{}}),null}}),a}function tl(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Ge;return s.status==="complete"?xn(s,t,n,r,o,i):null}function mi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:o});if(s?.size){let g=e.filter((h,y)=>!s.has(y));if(zm.has(Ue(st(g)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...mi(g,t,n,r,o,i)]}let l=Q_(e).map(a),c=st(e);if(c.length===0)return l;let u=c[0]??"",f=Ue(u).toLowerCase(),d=c.slice(1),m=c.findIndex((g)=>!C_.has(g));if(n.standard===!0&&m!==-1&&el(Ue(c[m]??"").toLowerCase(),c.slice(m+1)))return l;let p=H_(u,f,d);if(p)return[...l,...p.map(a)];if(Qm.has(f))return n.capturedOutput===!0?[...l,...op(e).map(a)]:l;if(f==="eval")return[...l,...tl(d.join(" "),t,n,r,o,i)??d.map(a)];if(f==="export")return[...l,...d.flatMap((g)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(g)?[g.slice(g.indexOf("=")+1)]:Ke(f,g)).map(a)];if(f==="git")return[...l,...nw(d).map(a)];if(f==="gh")return[...l,...Ja(f,d,A_).map(a)];if(zm.has(f))return[...l,...tw(d).map(a)];if(w_.has(f))return[...l,...Aw(d).map(a)];if(y_.has(f))return[...l,...sw(d,t,n,r,o,i).map(a)];if(we.has(f))return[...l,...d.flatMap((g)=>Ke("awk",g)).map(a),...d.flatMap((g)=>lw(g,t,n,r,o,i)),...d.flatMap(cw).map(a)];if(f==="curl")return[...l,...d.flatMap((g)=>Ke(f,g)).map(a),...rw(d).map(a)];if(nr(f)){let g=er.has(f)?ve([f,...d]):null;if(g!==null&&g.command!==null&&g.commandIndex!==null){let h=t.getShellSyntax(g.command);if(h.status==="structural-limit")throw new Ge;if(h.status==="complete")return[...l,...xn(h,t,n,r,o,i),...d.slice(g.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...aw(f,d,t,n,r,o,i)]}return[...l,...d.flatMap((g)=>Ke(f,g)).map(a)]}function H_(e,t,n){let r=li(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function j_(e,t,n,r,o,i,s){if(Z_(t,n,r,o,i,s)){let a=st(e),l=el(Ue(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...op(e),...l].map((c)=>({target:c,cwd:i}))}return rp(t,K_(e),n,r,o,i,s,()=>[])}function V_(e,t,n,r,o,i,s){let a=st(e);if(!nr(Ue(a[0]??"").toLowerCase()))return[];return tl(t,n,r,o,i,s)??[{target:t,cwd:i}]}function rp(e,t,n,r,o,i,s,a){let l=X_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>er.has(l)?xn(n.getShellSyntax(c),n,r,o,i,s):di(l,c,n,r,o,i,s))}function op(e){let t=st(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase();if(!Qm.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[nl(r.replaceAll("%%","%"))];return t.slice(1)}function K_(e){let t=st(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return q_(r);return[]}function q_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[nl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>Y_(t,r.slice(i*n,(i+1)*n)))}function Y_(e,t){let n=0;return nl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function nl(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Z_(e,t,n,r,o,i){let s=st(e);if(s.length===0||Ue(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Ut(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Ya]:l.map((f)=>f.split(c).join(Ya));return mi(u,t,n,r,o,i).some((f)=>f.target.includes(Ya))}function X_(e){let t=st(e);if(t.length===0)return null;let n=Ue(t[0]??"").toLowerCase();if(!nr(n))return null;return J_(n,t.slice(1))?n:null}function J_(e,t){let n=rl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(tp.has(o)||ip(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(B_.get(n)?.has(o))r++;continue}return!1}return!0}function rl(e){return/^python\d/.test(e)?"python":e}function Q_(e){let t=[];for(let n of e){if(ap(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Km=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function ew(e,t){if(!t||!Km.test(e))return e;return`~${e.replace(Km,"").replace(/\\/g,"/")}`}function Ke(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function tw(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Ke("jq",i))}return e.flatMap((r,o)=>o===t?[]:Ke("jq",r))}function nw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...P_.has(r)?Ja("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),T_):Ja("git",e.slice(n),I_)];if(t.push(...Ke("git",r)),!Se.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Ke("git",o)),n++}return t}function Ja(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Ke(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Ke(e,i))}return r}function rw(e){return e.flatMap((t,n)=>{let r=iw(t);if(r!==null)return qm(r.flag,r.value);let o=ow(e[n-1]);return o===null?[]:qm(o,t)})}function qm(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Za(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Za(t.slice(n+1))}return t.startsWith("@")?Za(t.slice(1)):[]}function ow(e){if(e===void 0)return null;if(ep.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function iw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return ep.has(r)?{flag:r,value:e.slice(n+1)}:null}function Za(e){return e===""||e==="-"?[]:[e]}function sw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!b_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((m)=>S_.has(m)),f=u===-1?c:c.slice(0,u),d=mi(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...d.filter((m)=>m!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,g)=>{if(!E_.has(m))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function aw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(tp.has(c)||ip(e,c)){let f=t[l+1];if(f!==void 0)a.push(...di(e,f,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...di(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function ip(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return __.get(t[t.length-1]??"")?.has(rl(e))??!1}function lw(e,t,n,r,o,i){if(!e.includes("system"))return[];return da(e)?.commands.flatMap((s)=>xn(t.getShellSyntax(s),t,n,r,o,i))??[]}function cw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function uw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(ol),...e.match(Xa)??[]]}function di(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=fw(t,dw(e));if(l===null)return uw(t).map(a);let c=l.masked.match(Um)!==null||l.literals.some((g)=>Hm.test(l.masked.slice(0,g.start))),u=l.masked.match(F_)!==null||l.literals.some((g)=>z_.test(l.masked.slice(0,g.start))),f=r.standard===!0&&!er.has(e),d=f&&!(hw(l.masked)||c||u)?[]:l.literals,m=f?Array.from(l.masked.matchAll(Um),(g)=>{let h=g.index+g[0].length;return{start:h,end:js(l.masked,h)}}):[],p=!f||m.some((g)=>Vs(l.masked,g.start))?l.literals:l.literals.filter((g)=>Hm.test(l.masked.slice(0,g.start))||m.some((h)=>g.start>=h.start&&g.start<h.end));return[...d.map((g)=>g.text).filter((g)=>g!=="").map(a),...d.flatMap((g)=>ol(g.text)).map(a),...f?[]:l.literals.flatMap((g)=>g.text.match(Xa)??[]).map(a),...c?p.flatMap((g)=>tl(g.text,n,r,o,i,s)??[a(g.text)]):[],...u?l.literals.flatMap((g)=>di(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
+`:y),n,r,o,i,s)):[],...(l.masked.match(Xa)??[]).map(a)]}function dw(e){let t=rl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function fw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(W_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&gw(e,o))return null;let a=t==="python"?mw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=pw(e,c,l);if(u===null)return null;let f=e.slice(c,u);if(/[fF]/.test(a)&&f.includes("{"))return null;if(t==="simple"&&s==='"'&&G_.test(f))return null;r.push({start:c,text:f});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function mw(e,t){return L_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function pw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function gw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function hw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(x_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>R_.has(i)))continue;if(o.length>1)return!0;if(yw(e,r)===".")return!0;if(Cw(e,r+n.length)==="(")return!0}return!1}function yw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function Cw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function bw(e,t,n,r,o,i){return Rw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...xn(a,t,{...n,capturedOutput:!0},r,o,i),...Sw(a,r)?vw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function Sw(e,t){let n=_o(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||Ue(Qe(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Qe(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function vw(e,t){return _o(e).flatMap((n)=>n.kind==="word"?[Qe(n.text,t)]:n.kind==="redirection"&&n.target?[Qe(n.target,t)]:[]).flatMap(ol)}function ol(e){let t=xw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||Ew(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function Ew(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function xw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function Rw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Wn(o,n))continue;if(sp(e,r,n)){let i=_w(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=ww(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function _w(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Wn(i,n))continue;if(sp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function ww(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function sp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function Aw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let f=u[1]??"",d=u[2];if(f===k_)o=!0;if(M_.has(f))r=!0;if(d!==void 0){if(f===$m)t.push(d);continue}if(D_.has(f)){let m=e[l+1];if(f===$m&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),d="",m="";for(let g=0;g<f.length;g++){let h=f[g]??"";if(O_.has(h))r=!0;if(N_.has(h)){d=h,m=f.slice(g+1);break}}if(d==="")continue;if(m.length>0){if(d===Bm)t.push(m);continue}let p=e[l+1];if(d===Bm&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function st(e){let t=e.findIndex((n)=>!ap(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function ap(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var Pw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Tw=".env.",Iw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),kw=[".env.example.",".env.sample."];function Ow(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Mw(e){return e.length>0&&!/\s/.test(e)}function Qa(e,t,n,r){let o=lp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function lp(e,t,n,r){try{return Er(e,t,n,r)}catch(o){if(o instanceof N)throw o;return""}}var Nw=new Set(["node_modules","__pycache__"]),Dw=[["vendor","bundle"],["vendor","cache"]];function Lw(e,t,n,r,o){if(Ow(e))return null;let i=Ve(e,t,r,o);if(!i)return null;let s=F(i.split("/").pop()??""),a=F(i),l=()=>Mw(s)||Qa(e,t,r,o);if(Iw.has(s)||kw.some((d)=>s.startsWith(d)))return null;let c=F($w(e,t,r,o));for(let d of ss){let m=`~/${d.suffixParts.join("/")}`;if((Zm(a,m)||Zm(c,m))&&it(d.id,n))return d.id}let u=Ww(i,t,n,r,o);if(u)return u;if(Pw.has(s))return null;for(let d of is)if(s===d.basename&&it(d.id,n))return d.id;if(s.startsWith(Tw)&&it($r.id,n)&&l())return $r.id;for(let d of as)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let m=s.slice(d.prefix.length)[0];if((m==="-"||m==="_")&&it(d.id,n)&&l())return d.id}for(let d of ls)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&it(d.id,n))return d.id}if(zw(a))return null;if(!s.includes(".")&&Gn.pattern.test(s)&&it(Gn.id,n))return Gn.id;let f=Bw(s,n);if(f)return f;return null}function Ww(e,t,n,r,o){return Ur.find((i)=>{if(!it(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=F(e).split("/");return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||vr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,Ve("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Sr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=F(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=F(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?vr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,Ve(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Sr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Sr(e,s,["credentials"])||Sr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=F(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=F(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>vr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?B(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(F(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?vr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,Ve(u,t,r,o),l))}case"secret.cli.pi":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ve("~",t,r,o);return[ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Sr(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(Ve("~",t,r,o),".config","amp")],l=F(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?vr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(B(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,Ve("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||F(e).split("/").at(-1)==="mcp-auth.json"&&Vt(F(e),F(a))}case"secret.cli.cursor.config":{let s=F(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=F(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,Ve("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Ym=new WeakMap;function B(e,t,n,r,o){let i=Ym.get(o)??new Map;Ym.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ve(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>cp(e,ce(t,r)))}function Sr(e,t,n){return n.some((r)=>Vt(F(e),F(ce(t,r))))}function vr(e,t,n,r,o){return cp(e,Ve(t,n,r,o))}function cp(e,t){return F(e)===F(t)}function ce(e,...t){return $e([e,...t].filter(Boolean).join("/"))}function Gw(e,t,n,r,o,i){if(n.length===0)return!1;let s=F(Er(e,t,o,i));return n.some((a)=>Vt(s,F(Er(a,r,o,i))))}function Fw(e,t,n,r,o,i){if(n.length===0)return!1;let s=F(Er(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?$e(z(be(a),o.paths,i)):"",c=F(l),u=o.env.get("CC_SAFETY_NET_HOME"),f=F(u?$e(z(fi(be(u)),o.paths,i)):l&&$e(z(`${l}/.cc-safety-net`,o.paths,i)));if(f&&Vt(s,f))return!1;return n.some((d)=>{let m=ms(d);if(m&&Xm.basename(s)!==F(m.name))return!1;let p=F(Er(m?.root??d,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return Vt(s,p)&&!(m&&s===p)})}function zw(e){let t=e.split("/");return t.some((n)=>Nw.has(n))||Dw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Bw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of cs)if(r===o.extension&&it(o.id,t))return o.id;for(let o of us)if(o.pattern.test(r)&&it(o.id,t))return o.id;return null}function F(e){return e.toLowerCase()}function it(e,t){return!t?.disabledRules?.includes(e)}function Ve(e,t,n,r){let{home:o,normalized:i}=il(e,n,r);if(!i)return"";if(!o)return i;let s=sl(i,o),a=ui(s)?s:$e(fi(t,s)),l=$e(z(a,n.paths,r));if(!Vt(l,o)){if(ui(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Zm(e,t){return e===t||e.startsWith(`${t}/`)}function $w(e,t,n,r){let{home:o,normalized:i}=il(e,n,r);if(!i||!o)return"";let s=sl(i,o),a=Xm.normalize(ui(s)?s:$e(fi(t,s))),l=$e(be(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Vt(c(a),c(d)));if(u===void 0)return"";let f=a.slice(u.length);return f?`~${f}`:"~"}function Er(e,t,n,r){let{home:o,normalized:i}=il(e,n,r);if(!i)return"";let s=o?sl(i,o):i;return $e(z(ui(s)?s:fi(t,s),n.paths,r))}function il(e,t,n){let r=t.env.get("HOME")??t.home,o=r?$e(z(be(r),t.paths,n)):"",i=$e(be(Uw(Qe(e,t))));return{home:o,normalized:i}}function Uw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return h_(e)}catch{return e}}function sl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function Hw(e){if(process.platform==="win32")return!0;return g_.parse(e).root.length>1}function $e(e){let t=e.trim(),n=(t.includes("\\")&&Hw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Vt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function Ue(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Kt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var jw={findPolicyMutation:Gm,findGitMetadataMutation:hd,resolveGitMetadata:Vw,loadPolicySnapshot:ru,findSensitiveTarget:np,analyzeCommand:Tm,getModes:Ni};function up(e,t){let n={...jw,...t.dependencies},r=Yw(e),o=xr(e)?e.command:r,i=vt("policy-protection",o,()=>rr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(xr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:He,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Dd,intent:"stop_and_explain"}};let l=Ce(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Wm,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let f=vt("policy-protection",o,()=>Mm(i,t.environment,l));if(f){let E=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Om,intent:"hard_stop",evidence:{command:E,segment:f.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let m=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...Kw(m)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:xr(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:Jm,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!xr(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...al("command-validation",o),...h};let S=vt("command-analysis",o,()=>Im(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},qw(i),i.store),e.command,t.trace));if(S.decision){let E=!g.strict&&S.decision.kind==="deny"&&(S.decision.ruleId==="raw-text.dangerous-command"||S.decision.reason===ar&&!/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/.test(S.decision.evidence?.segment??"")&&Ae(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in S?{errorCode:S.errorCode}:{},decision:E?{...S.decision,ask:!0}:S.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function Vw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Kw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function qw(e){return ge(e,"declared-command")?.program}function Yw(e){try{return Tn(e.input)}catch(t){let n=xr(e)?e.command:void 0;throw new Kt("policy-protection",al("policy-protection",t instanceof Ye?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Kt(e,al(e,r instanceof Ye?void 0:t,r),r)}}function al(e,t,n){let r=n instanceof N||n instanceof Ge;return{stage:e,decision:{kind:"deny",reason:r?bi:_n,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function xr(e){return e.route.kind==="command"}import{appendFileSync as lA,mkdirSync as cA}from"node:fs";import{isAbsolute as uA,join as ul}from"node:path";import{lstatSync as fp,readdirSync as Zw,readFileSync as Xw,rmdirSync as Jw,statSync as mp,unlinkSync as Qw,utimesSync as eA,writeFileSync as tA}from"node:fs";import{join as Rr}from"node:path";function dp(e,t={}){return Jr(Qt(e,t),e.home).policy.audit.retention_days}var cl=86400000,nA=".last-prune",rA=/^\d{4}-\d{2}$/,oA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,pp=(e)=>Math.floor(e/cl);function hp(e,t,n=()=>new Date){try{let r=n().getTime();if(!mp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Rr(t,nA),i=mp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&pp(i)===pp(r))return;let s=r-dp(e)*cl,a=new Date(r).toISOString().slice(0,7);for(let l of ll(t)){if(l.isDirectory()){iA(Rr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))sA(Rr(t,l.name),s)}tA(o,"",{mode:384}),eA(o,r/1000,r/1000)}catch{}}function iA(e,t,n){for(let r of ll(e)){if(!r.isDirectory()||!rA.test(r.name))continue;let o=Rr(e,r.name);for(let i of ll(o)){if(!i.isFile())continue;let s=oA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+cl;if(!Number.isFinite(a)||a>=t)continue;yp(Rr(o,i.name))}if(r.name!==n)gp(o)}gp(e)}function sA(e,t){try{let n=fp(e);if(n.mtimeMs>=t)return;let r=Xw(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(aA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(fp(e).mtimeMs!==n.mtimeMs)return;yp(e)}catch{}}function aA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function ll(e){try{return Zw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function yp(e){try{Qw(e)}catch{}}function gp(e){try{Jw(e)}catch{}}var dA="2.4.7",fA=1e4,mA=2000,pA=256,gA=32768;function hA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function yA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function dl(e,t,n,r,o,i,s={}){let a=hA(t);if(!a)return;let l=bA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=pi(at(n),s.failureStage?Number.POSITIVE_INFINITY:fA),f=pi(at(r),mA),d=s.toolName?pi(at(s.toolName),pA):void 0,m=i===null?void 0:pi(at(i),gA),p=ul(l,yA(m?.value??null),c.slice(0,7));cA(p,{recursive:!0,mode:448});let g=ul(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Li)(),v:dA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};lA(g,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),hp(e,l,s.now)}catch{}}function pi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function CA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&uA(n)?n:null}function bA(e){let t=CA(e);return t?ul(t,".cc-safety-net","logs"):null}function bp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Cp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Cp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Cp(e){return"command"in e?e.command??"":""}function Sp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;dl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function vp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;dl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function xp(e,t,n){try{let r=up(t,{environment:e,...n.guard});return Ep(e,t,r,n),r}catch(r){if(!(r instanceof Kt))throw r;throw Ep(e,t,r.evaluation,n,!(r.cause instanceof Ye),{stage:r.stage,errorCode:SA(r.cause)}),r}}function Ep(e,t,n,r,o=!0,i){Sp(e,bp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function SA(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Ye)return"tool-input-limit";if(e instanceof Ge)return"structural-shell-syntax-limit";return"unexpected-error"}function Et(e,t={}){return{malformed:!0,denial:wn(t),cwd:e}}function Rp(e,t={}){return(n,r)=>{try{return vA(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(wn())}}}function vA(e,t,n,r){let o=ql();if(n.cancelled?.(t))return n.block(wn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return vp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=yl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=xp(o,i,{guard:{auditAllowed:Yl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Kt))throw l;if(Rt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${bl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var _p="exec",EA=new Set(["auto","gateway"]);function wp(e){e.on("before_tool_call",xA(e),{matcher:[_p],priority:50})}function xA(e,t={}){return Rp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>RA(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>AA(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function RA(e,t,n,r){if(!e||typeof e!=="object")return Et(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Et(null);if(o!==_p)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Et(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Et(null,{toolName:o});if(s.host!==void 0&&!EA.has(s.host))return Et(null,{command:a,toolName:o});let l=_A(n,t.agentId,r);if(!l)return Et(null,{command:a,toolName:o});let c=wA(l,s,r);if(!c)return Et(l,{command:a,segment:typeof s.workdir==="string"?s.workdir:void 0,toolName:o});return In(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function _A(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return Ai(".",[r],n)}catch{return}}function wA(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return Ai(r,[e],n)}function AA(e){return{block:!0,blockReason:Cl(e)}}var FL={...hl,register:wp};export{FL as default};