cc-safety-net 2.4.6 → 2.4.7

package/dist/chunks/{index-c989ehp9.js → index-gsw97ch3.js}

@@ -1,45 +1,45 @@
-var Vs="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Wn="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",te="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var js={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},lo={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},a=Object.freeze({realpathAttempts:{cap:16384,...js},processedCandidateBytes:{cap:4194304,...js},pathEnvironmentExpansion:{cap:64,...js},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...lo},trackedHeredocFiles:{cap:64,...lo},controlFlowStates:{cap:64,...lo},wrapperPeelIterations:{cap:20,...lo},derivedCommandShape:lo});class s extends Error{kind;name="AnalysisLimit";constructor(O){super(a[O].reason);this.kind=O}}function mn(){let O=new Map;return{counters:O,resolvedPaths:new Map,charge(D,B=1){let Q=(O.get(D)??0)+B;if(O.set(D,Q),Q>a[D].cap)throw new s(D)}}}import{lstatSync as Fg,realpathSync as zg,statSync as Bg}from"node:fs";import{homedir as $g,tmpdir as Ug}from"node:os";import{statSync as Lg}from"node:fs";import{join as Wg}from"node:path";import{basename as Ic,dirname as og,isAbsolute as ig,join as sg,normalize as ag,resolve as Ac}from"node:path";var lg=256,ai=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function pn(O,D=process.platform){if(D!=="win32")return O;return O.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Qn(O,D=process.platform){if(D!=="win32")return!1;return(O[0]==="/"||O[0]==="\\")&&(O[1]==="/"||O[1]==="\\")}function Zs(O,D){return Ks(O,0,D)}function Ks(O,D,B){let Q="",ee=0;while(ee<O.length){if(O[ee]!=="$"){Q+=O[ee],ee++;continue}if(O[ee+1]==="{"){let je=qs(O,ee+2),at=cg(O,ee,D);if(at===null){if(ai.has(je))throw new s("pathEnvironmentExpansion");Q+=O.slice(ee);break}let lt=O.slice(ee,at+1);Q+=ug(lt,D,B),ee=at+1;continue}let he=qs(O,ee+1);if(!he){Q+="$",ee++;continue}Q+=Ys(he,B)??`$${he}`,ee+=he.length+1}return Q}function cg(O,D,B){let Q=1;for(let ee=D+2;ee<O.length;ee++){if(O[ee]==="\\"){ee++;continue}if(O[ee]==="$"&&O[ee+1]==="{"){if(Q++,B+Q>a.pathEnvironmentExpansion.cap)throw new s("pathEnvironmentExpansion");ee++;continue}if(O[ee]!=="}")continue;if(Q--,Q===0)return ee}return null}function ug(O,D,B){let Q=O.slice(2,-1),ee=qs(Q,0);if(!ee)return O;let he=Q.slice(ee.length);if(!he)return Ys(ee,B)??O;let je=[":-",":+",":=",":?","-","+","=","?"].find((ct)=>he.startsWith(ct));if(!je){if(ai.has(ee))throw new s("pathEnvironmentExpansion");return O}if(!ai.has(ee))return O;if(je.endsWith("="))throw new s("pathEnvironmentExpansion");let at=Ys(ee,B),lt=je.startsWith(":")?at!==null&&at!=="":at!==null;if(je.endsWith("?")&&!lt)throw new s("pathEnvironmentExpansion");if(je.endsWith("-")||je.endsWith("?"))return lt?at??"":Ks(he.slice(je.length),D+1,B);return lt?Ks(he.slice(je.length),D+1,B):""}function qs(O,D){if(!/[A-Za-z_]/.test(O[D]??""))return"";let B=D+1;while(/[A-Za-z0-9_]/.test(O[B]??""))B++;return O.slice(D,B)}function Ys(O,D){if(!ai.has(O))return null;if(O==="HOME")return D.env.get("HOME")??D.home;return D.env.get(O)??null}function Lt(O,D,B){if(!O)return O;let Q=B.resolvedPaths.get(O);if(Q!==void 0)return Q;let ee=[],he=O;while(!0){kc(B,he);let je=D.realpath(he);if(je!==null)return Tc(B,O,je,ee);let at=og(he);if(at===he||ee.length>=lg)return Tc(B,O,he,ee);ee.push(Ic(he)),he=at}}function Tc(O,D,B,Q){let ee=Q.length===0?B:sg(B,...Q.reverse());return O.resolvedPaths.set(D,ee),ee}function dg(O,D,B){let Q=B.resolvedPaths.get(O);if(Q!==void 0)return Q;kc(B,O);let ee=D.realpath(O);if(ee!==null)B.resolvedPaths.set(O,ee);return ee}function kc(O,D){O.charge("realpathAttempts"),O.charge("processedCandidateBytes",Buffer.byteLength(D))}function tn(O,D,B,Q){let ee=Mc(O,D,B);if(!ee)return"";return Lt(ee,B.paths,Q).replace(/\\/g,"/")}function Oc(O,D,B,Q,ee){let he=Mc(O,D,B);if(!he)return null;if(ee(Ic(he)))return Lt(he,B.paths,Q).replace(/\\/g,"/");let je=dg(he,B.paths,Q);return je===null?null:je.replace(/\\/g,"/")}function Mc(O,D,B){let Q=B.home,ee=Zs(O.trim(),B).replace(/\\/g,"/");if(!ee)return"";let he=ee==="~"?Q:ee.startsWith("~/")?Ac(Q,ee.slice(2)):ee,je=pn(he);return ag(ig(je)?je:Ac(D,je))}import{spawnSync as fg}from"node:child_process";import{existsSync as uo,lstatSync as mg,readFileSync as fo,realpathSync as Nr,statSync as co}from"node:fs";import{dirname as Xs,isAbsolute as Js,join as Lr,resolve as li}from"node:path";var pg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],gg=5000;function Nc(O,D=Og(),B=gg){let Q=hg(O),ee=Q===null?null:yg(Q);if(Q===null||ee===null)return null;let he=Ig(Q,ee,D,B);return he===null?null:{recursiveSubmodules:he}}function hg(O){try{let D=Nr(li(O));return co(D).isDirectory()?D:null}catch{return null}}function yg(O){let D=Tg(O);if(!D)return null;try{let B=mg(D);if(B.isSymbolicLink()||!B.isFile())return null;let Q=Qs(D);if(!Q?.commonDir)return null;if(!Cg(Q.gitDir,D))return null;return vg(Q.gitDir,Xs(D))?{gitDir:Q.gitDir,commonDir:Q.commonDir}:null}catch{return null}}function Qs(O){try{let D=bg(O);if(!D)return null;let B=Nr(Js(D)?D:li(Xs(O),D));if(!co(B).isDirectory())return null;return{gitDir:B,commonDir:Sg(B)}}catch{return null}}function bg(O){let D=fo(O,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!D.startsWith("gitdir:"))return null;return D.slice(7).trim()||null}function Sg(O){try{let D=fo(Lr(O,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!D)return null;let B=Nr(Js(D)?D:li(O,D));return co(B).isDirectory()?B:null}catch{return null}}function Cg(O,D){let B=Eg(O);return B===null?!1:Lc(O,B,D)}function vg(O,D){let B=xg(O);return B===null?!0:Lc(O,B,D)}function Eg(O){let D=Lr(O,"gitdir");if(!uo(D))return null;let B=fo(D,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return B===""?null:B}function xg(O){let D=Lr(O,"config.worktree");return uo(D)?_g(D):null}function Lc(O,D,B){try{return Rg(Js(D)?D:li(O,D),B)}catch{return!1}}function Rg(O,D){try{let B=co(O),Q=co(D);if(B.ino!==0&&Q.ino!==0&&B.dev===Q.dev&&B.ino===Q.ino)return!0}catch{}return Dc(Nr.native(O))===Dc(Nr.native(D))}function Dc(O){let D=O.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),B=D.length>1&&D.endsWith("/")?D.slice(0,-1):D;return process.platform==="win32"?B.toLowerCase():B}function _g(O){let D=fo(O,"utf-8"),B=!1,Q=null;for(let ee of D.split(/\r?\n/)){let he=ee.trim();if(he===""||he.startsWith("#")||he.startsWith(";"))continue;if(he.startsWith("[")){B=/^\[core\]$/i.test(he);continue}if(!B)continue;let je=he.match(/^worktree\s*=\s*(.*)$/i);if(je)Q=wg(je[1]??"")}return Q}function wg(O){let D=O.trim();if(!D.startsWith('"')||!D.endsWith('"'))return D;return Ag(D.slice(1,-1))}var Pg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function Ag(O){return O.replace(/\\(.?)/gs,(D,B)=>B===""?D:Pg[B]??D)}function Tg(O){try{return ea(Nr(O))}catch{return null}}function ea(O){let D=O;while(!0){let B=Lr(D,".git");if(uo(B))return B;let Q=Xs(D);if(Q===D)return null;D=Q}}function Ig(O,D,B,Q){if(kg(D))return!0;if(B===null)return!0;let ee=fg(B,["config","--get","submodule.recurse"],{cwd:O,encoding:"utf8",env:Mg(process.env),stdio:["ignore","pipe","ignore"],timeout:Q});if(ee.error!==void 0||ee.status!==0&&ee.status!==1)return null;return ee.status===0&&Wc(ee.stdout.trim())}function kg(O){return[Lr(O.commonDir,"config"),Lr(O.gitDir,"config.worktree")].filter((D)=>uo(D)).some((D)=>Dg(D))}function Og(){return pg.find((O)=>uo(O))??null}function mo(O){return O==="GIT_CONFIG_COUNT"||O==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(O)}function Mg(O){return Object.fromEntries(Object.entries(O).filter(([D])=>!mo(D)))}function Dg(O){let D;try{D=fo(O,"utf-8")}catch{return!0}let B="",Q=!1;for(let ee of D.split(/\r?\n/)){let he=ee.trim();if(he===""||he.startsWith("#")||he.startsWith(";"))continue;let je=he.match(/^\[([^\]]+)\]$/);if(je){B=je[1]?.trim().toLowerCase()??"";continue}let at=he.indexOf("="),lt=(at===-1?he:he.slice(0,at)).trim().toLowerCase(),ct=at===-1?"true":he.slice(at+1).trim();if(Ng(B)&&lt==="path")return!0;if(B==="submodule"&&lt==="recurse")Q=Wc(ct)}return Q}function Ng(O){return O==="include"||O.startsWith("includeif ")}function Wc(O){let D=O.toLowerCase();return D!=="false"&&D!=="no"&&D!=="off"&&D!=="0"}function Gc(O,D){if(O==="")return null;let B=mn(),Q=ea(tn(O,O,D,B)),ee=Q?Gg(Q,O,D,B):null;if(!ee)return null;return Object.freeze({entries:Object.freeze([ee.entry]),markerFiles:Object.freeze(ee.markerFile?[ee.markerFile]:[]),directories:Object.freeze(ee.directories),hooksDirectories:Object.freeze(ee.hooksDirectories)})}function Gg(O,D,B,Q){try{let ee=tn(O,D,B,Q),he=Lg(O),je=he.isFile()?ee:null,at=he.isFile()?Qs(O):null,lt=(he.isDirectory()?[ee]:[at?.gitDir,at?.commonDir]).flatMap((ut)=>ut?[Wr(tn(ut,D,B,Q))]:[]),ct=[...new Set(he.isDirectory()?[Wr(O.replace(/\\/g,"/")),...lt]:lt)];return{entry:Wr(ee),markerFile:je?Wr(je):null,directories:ct,hooksDirectories:[...new Set(ct.flatMap((ut)=>{let ft=Wr(Wg(ut,"hooks").replace(/\\/g,"/"));return[ft,Wr(tn(ft,D,B,Q))]}))]}}catch{return null}}function Wr(O){return process.platform==="win32"?O.toLowerCase():O}var Hg={realpath:(O)=>{try{return zg(O)}catch{return null}},entryKind:(O)=>{let D=Fg(O,{throwIfNoEntry:!1});if(!D)return"missing";return D.isSymbolicLink()?"symlink":"present"},isDirectory:(O)=>{try{return Bg(O).isDirectory()}catch{return!1}}};function c(){return jg({env:new Map(Object.entries(process.env).flatMap(([O,D])=>D===void 0?[]:[[O,D]])),home:pn(process.env.HOME||$g()),tmpdir:Ug(),paths:Hg})}function jg(O,D={}){let B=new Map,Q=new Map,ee={...O,gitMetadata:(he)=>Fc(B,he,()=>Gc(he,ee)),worktreeFacts:(he)=>Fc(Q,he,()=>Nc(he)),...D};return ee}function Fc(O,D,B){let Q=O.get(D);if(Q!==void 0)return Q;let ee=B();return O.set(D,ee),ee}import{accessSync as Sh,constants as nu,statSync as Ch}from"node:fs";import{isAbsolute as ou,relative as vh,resolve as Eh,sep as xh}from"node:path";var Vg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function z(O){return ke(O.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function ke(O){return Vg.reduce((D,B)=>D.replace(B,"<redacted>"),O.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function Ue(O){return zc(O).reduceRight((D,B)=>`${D.slice(0,B.valueStart)}<redacted>${D.slice(B.valueEnd)}`,O)}function k(O){return ke(Ue(O))}function Ze(O){return zc(O).map((D)=>O.slice(D.valueStart,D.valueEnd))}function Ge(O){return/[A-Za-z_][A-Za-z0-9_]*=/.test(O)}function zc(O){return[...O.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((D)=>{let B=O[D.index-1];if(D.index>0&&B&&!/[\s"'([{]/.test(B))return[];let Q=D.index+D[0].length;if(Q>=O.length)return[];return[{valueStart:Q,valueEnd:Kg(O,Q)}]})}function Kg(O,D){if(O.startsWith("$(",D))return qg(O,D);let B=O[D];if(B==='"'||B==="'"){for(let ee=D+1;ee<O.length;ee++){if(B==='"'&&O[ee]==="\\"){ee++;continue}if(O[ee]===B)return ee+1}return O.length}let Q=D;while(Q<O.length&&!/\s/.test(O[Q]??""))Q++;return Q}function qg(O,D){let B=0,Q;for(let ee=D;ee<O.length;ee++){let he=O[ee];if(Q){if(Q==='"'&&he==="\\"){ee++;continue}if(he===Q)Q=void 0;continue}if(he==='"'||he==="'"){Q=he;continue}if(he==="$"&&O[ee+1]==="("){B++,ee++;continue}if(he!==")")continue;if(B--,B===0)return ee+1}return O.length}var Yg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Zg(O){let D=O.maxLen??200,B=O.redact??((ee)=>ee),Q=(ee)=>ee.length>D?`${ee.slice(0,D)}...`:ee;return[O.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${B(O.reason)}`,O.ruleId?`Rule: ${O.ruleId}`:void 0,O.toolName?`Tool: ${O.toolName}`:void 0,O.command?`Command: ${Q(B(O.command))}`:void 0,O.segment&&O.segment!==O.command?`Segment: ${Q(B(O.segment))}`:void 0,O.configWarning?`Config warning: ${B(O.configWarning)}`:void 0,O.askUser?"Approve only if you expected this command.":Yg[O.intent??"manual_only"]].filter((ee)=>ee!==void 0).join(`
+var Ks="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Wn="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",te="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Vs={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},lo={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},a=Object.freeze({realpathAttempts:{cap:16384,...Vs},processedCandidateBytes:{cap:4194304,...Vs},pathEnvironmentExpansion:{cap:64,...Vs},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...lo},trackedHeredocFiles:{cap:64,...lo},controlFlowStates:{cap:64,...lo},wrapperPeelIterations:{cap:20,...lo},derivedCommandShape:lo});class s extends Error{kind;name="AnalysisLimit";constructor(O){super(a[O].reason);this.kind=O}}function mn(){let O=new Map;return{counters:O,resolvedPaths:new Map,charge(D,B=1){let Q=(O.get(D)??0)+B;if(O.set(D,Q),Q>a[D].cap)throw new s(D)}}}import{lstatSync as $g,realpathSync as Ug,statSync as Hg}from"node:fs";import{homedir as jg,tmpdir as Vg}from"node:os";import{statSync as Fg}from"node:fs";import{join as zg}from"node:path";import{basename as Oc,dirname as ag,isAbsolute as lg,join as cg,normalize as ug,resolve as Ic}from"node:path";var dg=256,ai=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function pn(O,D=process.platform){if(D!=="win32")return O;return O.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Qn(O,D=process.platform){if(D!=="win32")return!1;return(O[0]==="/"||O[0]==="\\")&&(O[1]==="/"||O[1]==="\\")}function Xs(O,D){return qs(O,0,D)}function qs(O,D,B){let Q="",ee=0;while(ee<O.length){if(O[ee]!=="$"){Q+=O[ee],ee++;continue}if(O[ee+1]==="{"){let je=Ys(O,ee+2),at=fg(O,ee,D);if(at===null){if(ai.has(je))throw new s("pathEnvironmentExpansion");Q+=O.slice(ee);break}let lt=O.slice(ee,at+1);Q+=mg(lt,D,B),ee=at+1;continue}let he=Ys(O,ee+1);if(!he){Q+="$",ee++;continue}Q+=Zs(he,B)??`$${he}`,ee+=he.length+1}return Q}function fg(O,D,B){let Q=1;for(let ee=D+2;ee<O.length;ee++){if(O[ee]==="\\"){ee++;continue}if(O[ee]==="$"&&O[ee+1]==="{"){if(Q++,B+Q>a.pathEnvironmentExpansion.cap)throw new s("pathEnvironmentExpansion");ee++;continue}if(O[ee]!=="}")continue;if(Q--,Q===0)return ee}return null}function mg(O,D,B){let Q=O.slice(2,-1),ee=Ys(Q,0);if(!ee)return O;let he=Q.slice(ee.length);if(!he)return Zs(ee,B)??O;let je=[":-",":+",":=",":?","-","+","=","?"].find((ct)=>he.startsWith(ct));if(!je){if(ai.has(ee))throw new s("pathEnvironmentExpansion");return O}if(!ai.has(ee))return O;if(je.endsWith("="))throw new s("pathEnvironmentExpansion");let at=Zs(ee,B),lt=je.startsWith(":")?at!==null&&at!=="":at!==null;if(je.endsWith("?")&&!lt)throw new s("pathEnvironmentExpansion");if(je.endsWith("-")||je.endsWith("?"))return lt?at??"":qs(he.slice(je.length),D+1,B);return lt?qs(he.slice(je.length),D+1,B):""}function Ys(O,D){if(!/[A-Za-z_]/.test(O[D]??""))return"";let B=D+1;while(/[A-Za-z0-9_]/.test(O[B]??""))B++;return O.slice(D,B)}function Zs(O,D){if(!ai.has(O))return null;if(O==="HOME")return D.env.get("HOME")??D.home;return D.env.get(O)??null}function Wt(O,D,B){if(!O)return O;let Q=B.resolvedPaths.get(O);if(Q!==void 0)return Q;let ee=[],he=O;while(!0){Mc(B,he);let je=D.realpath(he);if(je!==null)return kc(B,O,je,ee);let at=ag(he);if(at===he||ee.length>=dg)return kc(B,O,he,ee);ee.push(Oc(he)),he=at}}function kc(O,D,B,Q){let ee=Q.length===0?B:cg(B,...Q.reverse());return O.resolvedPaths.set(D,ee),ee}function pg(O,D,B){let Q=B.resolvedPaths.get(O);if(Q!==void 0)return Q;Mc(B,O);let ee=D.realpath(O);if(ee!==null)B.resolvedPaths.set(O,ee);return ee}function Mc(O,D){O.charge("realpathAttempts"),O.charge("processedCandidateBytes",Buffer.byteLength(D))}function tn(O,D,B,Q){let ee=Nc(O,D,B);if(!ee)return"";return Wt(ee,B.paths,Q).replace(/\\/g,"/")}function Dc(O,D,B,Q,ee){let he=Nc(O,D,B);if(!he)return null;if(ee(Oc(he)))return Wt(he,B.paths,Q).replace(/\\/g,"/");let je=pg(he,B.paths,Q);return je===null?null:je.replace(/\\/g,"/")}function Nc(O,D,B){let Q=B.home,ee=Xs(O.trim(),B).replace(/\\/g,"/");if(!ee)return"";let he=ee==="~"?Q:ee.startsWith("~/")?Ic(Q,ee.slice(2)):ee,je=pn(he);return ug(lg(je)?je:Ic(D,je))}import{spawnSync as gg}from"node:child_process";import{existsSync as uo,lstatSync as hg,readFileSync as fo,realpathSync as Nr,statSync as co}from"node:fs";import{dirname as Js,isAbsolute as Qs,join as Lr,resolve as li}from"node:path";var yg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],bg=5000;function Wc(O,D=Ng(),B=bg){let Q=Sg(O),ee=Q===null?null:Cg(Q);if(Q===null||ee===null)return null;let he=Mg(Q,ee,D,B);return he===null?null:{recursiveSubmodules:he}}function Sg(O){try{let D=Nr(li(O));return co(D).isDirectory()?D:null}catch{return null}}function Cg(O){let D=Og(O);if(!D)return null;try{let B=hg(D);if(B.isSymbolicLink()||!B.isFile())return null;let Q=ea(D);if(!Q?.commonDir)return null;if(!xg(Q.gitDir,D))return null;return Rg(Q.gitDir,Js(D))?{gitDir:Q.gitDir,commonDir:Q.commonDir}:null}catch{return null}}function ea(O){try{let D=vg(O);if(!D)return null;let B=Nr(Qs(D)?D:li(Js(O),D));if(!co(B).isDirectory())return null;return{gitDir:B,commonDir:Eg(B)}}catch{return null}}function vg(O){let D=fo(O,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!D.startsWith("gitdir:"))return null;return D.slice(7).trim()||null}function Eg(O){try{let D=fo(Lr(O,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!D)return null;let B=Nr(Qs(D)?D:li(O,D));return co(B).isDirectory()?B:null}catch{return null}}function xg(O,D){let B=_g(O);return B===null?!1:Gc(O,B,D)}function Rg(O,D){let B=wg(O);return B===null?!0:Gc(O,B,D)}function _g(O){let D=Lr(O,"gitdir");if(!uo(D))return null;let B=fo(D,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return B===""?null:B}function wg(O){let D=Lr(O,"config.worktree");return uo(D)?Ag(D):null}function Gc(O,D,B){try{return Pg(Qs(D)?D:li(O,D),B)}catch{return!1}}function Pg(O,D){try{let B=co(O),Q=co(D);if(B.ino!==0&&Q.ino!==0&&B.dev===Q.dev&&B.ino===Q.ino)return!0}catch{}return Lc(Nr.native(O))===Lc(Nr.native(D))}function Lc(O){let D=O.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),B=D.length>1&&D.endsWith("/")?D.slice(0,-1):D;return process.platform==="win32"?B.toLowerCase():B}function Ag(O){let D=fo(O,"utf-8"),B=!1,Q=null;for(let ee of D.split(/\r?\n/)){let he=ee.trim();if(he===""||he.startsWith("#")||he.startsWith(";"))continue;if(he.startsWith("[")){B=/^\[core\]$/i.test(he);continue}if(!B)continue;let je=he.match(/^worktree\s*=\s*(.*)$/i);if(je)Q=Tg(je[1]??"")}return Q}function Tg(O){let D=O.trim();if(!D.startsWith('"')||!D.endsWith('"'))return D;return kg(D.slice(1,-1))}var Ig={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function kg(O){return O.replace(/\\(.?)/gs,(D,B)=>B===""?D:Ig[B]??D)}function Og(O){try{return ta(Nr(O))}catch{return null}}function ta(O){let D=O;while(!0){let B=Lr(D,".git");if(uo(B))return B;let Q=Js(D);if(Q===D)return null;D=Q}}function Mg(O,D,B,Q){if(Dg(D))return!0;if(B===null)return!0;let ee=gg(B,["config","--get","submodule.recurse"],{cwd:O,encoding:"utf8",env:Lg(process.env),stdio:["ignore","pipe","ignore"],timeout:Q});if(ee.error!==void 0||ee.status!==0&&ee.status!==1)return null;return ee.status===0&&Fc(ee.stdout.trim())}function Dg(O){return[Lr(O.commonDir,"config"),Lr(O.gitDir,"config.worktree")].filter((D)=>uo(D)).some((D)=>Wg(D))}function Ng(){return yg.find((O)=>uo(O))??null}function mo(O){return O==="GIT_CONFIG_COUNT"||O==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(O)}function Lg(O){return Object.fromEntries(Object.entries(O).filter(([D])=>!mo(D)))}function Wg(O){let D;try{D=fo(O,"utf-8")}catch{return!0}let B="",Q=!1;for(let ee of D.split(/\r?\n/)){let he=ee.trim();if(he===""||he.startsWith("#")||he.startsWith(";"))continue;let je=he.match(/^\[([^\]]+)\]$/);if(je){B=je[1]?.trim().toLowerCase()??"";continue}let at=he.indexOf("="),lt=(at===-1?he:he.slice(0,at)).trim().toLowerCase(),ct=at===-1?"true":he.slice(at+1).trim();if(Gg(B)&&lt==="path")return!0;if(B==="submodule"&&lt==="recurse")Q=Fc(ct)}return Q}function Gg(O){return O==="include"||O.startsWith("includeif ")}function Fc(O){let D=O.toLowerCase();return D!=="false"&&D!=="no"&&D!=="off"&&D!=="0"}function zc(O,D){if(O==="")return null;let B=mn(),Q=ta(tn(O,O,D,B)),ee=Q?Bg(Q,O,D,B):null;if(!ee)return null;return Object.freeze({entries:Object.freeze([ee.entry]),markerFiles:Object.freeze(ee.markerFile?[ee.markerFile]:[]),directories:Object.freeze(ee.directories),hooksDirectories:Object.freeze(ee.hooksDirectories)})}function Bg(O,D,B,Q){try{let ee=tn(O,D,B,Q),he=Fg(O),je=he.isFile()?ee:null,at=he.isFile()?ea(O):null,lt=(he.isDirectory()?[ee]:[at?.gitDir,at?.commonDir]).flatMap((ut)=>ut?[Wr(tn(ut,D,B,Q))]:[]),ct=[...new Set(he.isDirectory()?[Wr(O.replace(/\\/g,"/")),...lt]:lt)];return{entry:Wr(ee),markerFile:je?Wr(je):null,directories:ct,hooksDirectories:[...new Set(ct.flatMap((ut)=>{let ft=Wr(zg(ut,"hooks").replace(/\\/g,"/"));return[ft,Wr(tn(ft,D,B,Q))]}))]}}catch{return null}}function Wr(O){return process.platform==="win32"?O.toLowerCase():O}var Kg={realpath:(O)=>{try{return Ug(O)}catch{return null}},entryKind:(O)=>{let D=$g(O,{throwIfNoEntry:!1});if(!D)return"missing";return D.isSymbolicLink()?"symlink":"present"},isDirectory:(O)=>{try{return Hg(O).isDirectory()}catch{return!1}}};function c(){return qg({env:new Map(Object.entries(process.env).flatMap(([O,D])=>D===void 0?[]:[[O,D]])),home:pn(process.env.HOME||jg()),tmpdir:Vg(),paths:Kg})}function qg(O,D={}){let B=new Map,Q=new Map,ee={...O,gitMetadata:(he)=>Bc(B,he,()=>zc(he,ee)),worktreeFacts:(he)=>Bc(Q,he,()=>Wc(he)),...D};return ee}function Bc(O,D,B){let Q=O.get(D);if(Q!==void 0)return Q;let ee=B();return O.set(D,ee),ee}import{accessSync as Eh,constants as ou,statSync as xh}from"node:fs";import{isAbsolute as su,relative as Rh,resolve as _h,sep as wh}from"node:path";var Yg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function z(O){return ke(O.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function ke(O){return Yg.reduce((D,B)=>D.replace(B,"<redacted>"),O.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function Ue(O){return $c(O).reduceRight((D,B)=>`${D.slice(0,B.valueStart)}<redacted>${D.slice(B.valueEnd)}`,O)}function k(O){return ke(Ue(O))}function Ze(O){return $c(O).map((D)=>O.slice(D.valueStart,D.valueEnd))}function Ge(O){return/[A-Za-z_][A-Za-z0-9_]*=/.test(O)}function $c(O){return[...O.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((D)=>{let B=O[D.index-1];if(D.index>0&&B&&!/[\s"'([{]/.test(B))return[];let Q=D.index+D[0].length;if(Q>=O.length)return[];return[{valueStart:Q,valueEnd:Zg(O,Q)}]})}function Zg(O,D){if(O.startsWith("$(",D))return Xg(O,D);let B=O[D];if(B==='"'||B==="'"){for(let ee=D+1;ee<O.length;ee++){if(B==='"'&&O[ee]==="\\"){ee++;continue}if(O[ee]===B)return ee+1}return O.length}let Q=D;while(Q<O.length&&!/\s/.test(O[Q]??""))Q++;return Q}function Xg(O,D){let B=0,Q;for(let ee=D;ee<O.length;ee++){let he=O[ee];if(Q){if(Q==='"'&&he==="\\"){ee++;continue}if(he===Q)Q=void 0;continue}if(he==='"'||he==="'"){Q=he;continue}if(he==="$"&&O[ee+1]==="("){B++,ee++;continue}if(he!==")")continue;if(B--,B===0)return ee+1}return O.length}var Jg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Qg(O){let D=O.maxLen??200,B=O.redact??((ee)=>ee),Q=(ee)=>ee.length>D?`${ee.slice(0,D)}...`:ee;return[O.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${B(O.reason)}`,O.ruleId?`Rule: ${O.ruleId}`:void 0,O.toolName?`Tool: ${O.toolName}`:void 0,O.command?`Command: ${Q(B(O.command))}`:void 0,O.segment&&O.segment!==O.command?`Segment: ${Q(B(O.segment))}`:void 0,O.configWarning?`Config warning: ${B(O.configWarning)}`:void 0,O.askUser?"Approve only if you expected this command.":Jg[O.intent??"manual_only"]].filter((ee)=>ee!==void 0).join(`
 
-`)}function ye(O,D){if(O.decision.kind!=="deny")return;let B=D.includeEvidence?O.decision.evidence:void 0;return{reason:O.decision.reason,ruleId:O.decision.ruleId,intent:O.decision.intent,command:B?.command,segment:B?.segment,toolName:D.toolName,...O.configFallback?{configWarning:O.configFallback.reason}:{},...O.decision.ask?{ask:!0}:{}}}function P(O={}){return{reason:te,intent:"stop_and_explain",command:O.command,segment:O.segment??O.command,toolName:O.toolName}}function be(O){return Zg({...O,redact:z})}function Xe(O){return z(O instanceof Error?O.message:String(O))}import{types as Xg}from"node:util";var Jg=new Set(["applypatch","patch"]),Qg=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),eh=new Set(["grep","grepsearch","rg"]),th=new Set(["find","findbyname","glob"]),nh=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),rh=new Set(["command","diff","input","patch","patchtext"]),Bc=new TextEncoder,oh=new TextDecoder,ih=/\s/,sh=64;class f extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var po=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Vc(O){return O.replace(/[-_\s]/g,"").toLowerCase()}function ui(O){return nh.has(Vc(O))}function V(O){let D=Vc(O);if(Jg.has(D))return"patch";if(eh.has(D))return"grep";if(th.has(D))return"glob";if(Qg.has(D))return"path";return"unknown"}function ne(O){if(!O||typeof O!=="object")return;Qc(O);let D=Object.getOwnPropertyDescriptor(O,"command");if(!D){if("command"in O)Gn();return}if(D.get||D.set)Gn();let B=D.value;return typeof B==="string"&&B!==""?B:void 0}function Kc(O,D){return qc(O,D,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function qc(O,D,B,Q){let ee=Jc(O,B,Q);if(!ee)return[];let he=ee.entries.flatMap(([je,at])=>{let lt=qc(at,D,B,Q+1);return typeof at==="string"&&D.has(Yc(je))?[at]:lt});return B.ancestors.delete(ee.object),he}function Yc(O){return O.replace(/-/g,"_").toLowerCase()}function Zc(O){return Xc(O,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(lh)}function Xc(O,D,B,Q){let ee=Jc(O,B,Q);if(typeof O==="string")return D?[O]:[];if(!ee)return[];let he=ee.entries.flatMap(([je,at])=>Xc(at,ee.array?D:rh.has(Yc(je)),B,Q+1));return B.ancestors.delete(ee.object),he}function ah(O,D,B){if(D.nodes++,O!==null&&typeof O==="object"&&B>po.maxDepth||D.nodes>po.maxNodes)Gn();if(typeof O!=="string")return;let Q=Buffer.byteLength(O);if(D.stringBytes+=Q,Q>po.maxStringBytes||D.stringBytes>po.maxAggregateStringBytes)Gn()}function Jc(O,D,B){if(ah(O,D,B),!O||typeof O!=="object")return null;let Q=Qc(O);if(D.ancestors.has(O))Gn();let ee=Reflect.ownKeys(O);if(D.keys+=ee.length,D.keys>po.maxKeys)Gn();let he=ee.flatMap((je)=>{let at=Object.getOwnPropertyDescriptor(O,je);if(!at||at.get||at.set)Gn();return typeof je==="string"&&at.enumerable?[[je,at.value]]:[]});return D.ancestors.add(O),{object:O,array:Q,entries:he}}function Qc(O){if(Xg.isProxy(O))Gn();let D=Array.isArray(O),B=Object.getPrototypeOf(O);if(D&&B!==Array.prototype||!D&&B!==Object.prototype&&B!==null)Gn();return D}function Gn(){throw new f}function lh(O){let D=[],B=O.split(/\r?\n/),Q=!1,ee=!1,he=null,je=null,at=()=>{ee=!1,he=null,je=null};for(let lt=0;lt<B.length;lt++){let ct=B[lt]??"";if(ct==="*** Begin Patch"){Q=!0,at();continue}if(ct==="*** End Patch"){Q=!1,at();continue}if(ct.startsWith("@@")){let ut=ch(ct);if(ee=!0,he=ut?.oldLines??null,je=ut?.newLines??null,he===0&&je===0)at();continue}if(ee&&he!==null&&je!==null){let ut=ct.startsWith(" ")||ct.startsWith("-")?1:0,ft=ct.startsWith(" ")||ct.startsWith("+")?1:0;if(he=Math.max(0,he-ut),je=Math.max(0,je-ft),he===0&&je===0)at();continue}if(ct.startsWith("*** ")){at(),D.push(...ta(ct));continue}if(ee)continue;if(ct.startsWith("diff --git ")){D.push(...ta(ct));continue}if(ct.startsWith("--- ")){let ut=B[lt+1]??"";if(!ut.startsWith("+++ "))continue;D.push(...ra(ci(ct.slice(4),!0),ci(ut.slice(4),!0))),lt++;continue}if(!Q)D.push(...ta(ct))}return D}function ch(O){let D=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(O);if(!D)return null;return{oldLines:Number(D[1]??1),newLines:Number(D[2]??1)}}function ta(O){let D=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(O);if(D?.[1])return jc(D[1]);let B=/^\*\*\* Move to: (.+)$/.exec(O);if(B?.[1])return jc(B[1]);if(O.startsWith("diff --git "))return uh(O.slice(11));let Q=/^--- (.+)$/.exec(O);if(Q?.[1])return Hc(Q[1]);let ee=/^\+\+\+ (.+)$/.exec(O);if(ee?.[1])return Hc(ee[1]);let he=/^(?:rename|copy) (?:from|to) (.+)$/.exec(O);if(he?.[1])return yh(he[1]);return[]}function uh(O){let D=dh(O);if(D.length===2&&D[0]&&D[1])return ra(D[0],D[1]);let B=fh(O);return B?ra(O.slice(B.oldStart,B.oldEnd),O.slice(B.newStart,B.newEnd)):[]}function dh(O){let D=[],B=0;while(B<O.length&&D.length<2){while(dr(O[B]))B++;if(B>=O.length)break;let Q=O[B]==='"'||O[B]==="'"?O[B]:void 0;if(!Q){let he=B;while(B<O.length&&!dr(O[B]))B++;D.push(O.slice(he,B));continue}let ee=eu(O,B,Q);if(!ee)return[];D.push(ee.value),B=ee.end}while(dr(O[B]))B++;return B===O.length?D:[]}function fh(O){let D=0;while(D<O.length&&dr(O[D]))D++;let B=O.length;while(B>D&&dr(O[B-1]))B--;let Q=0,ee=D;while(ee<B){if(!dr(O[ee])){ee++;continue}let he=ee;while(ee<B&&dr(O[ee]))ee++;if(he===D||ee===B)continue;if(Q++,Q>sh)Gn();if(mh(O,D,he,ee,B))return{oldStart:D,oldEnd:he,newStart:ee,newEnd:B}}return null}function mh(O,D,B,Q,ee){if(na(O,D,B,Q,ee))return!0;let he=$c(O,"/",D,B),je=$c(O,"/",Q,ee);if(he<=D||je<=Q)return!1;if(na(O,D,he,Q,je))return!1;return na(O,he+1,B,je+1,ee)}function na(O,D,B,Q,ee){if(B-D!==ee-Q)return!1;for(let he=0;he<B-D;he++)if(O[D+he]!==O[Q+he])return!1;return!0}function $c(O,D,B,Q){for(let ee=B;ee<Q;ee++)if(O[ee]===D)return ee;return-1}function dr(O){return O!==void 0&&ih.test(O)}function eu(O,D,B){let Q=[],ee=D+1;while(ee<O.length){let he=String.fromCodePoint(O.codePointAt(ee)??0);if(he===B)return{value:oh.decode(Uint8Array.from(Q)),end:ee+1};if(he!=="\\"||B==="'"){Q.push(...Bc.encode(he)),ee+=he.length;continue}let je=O.slice(ee+1),at=/^[0-7]{1,3}/.exec(je)?.[0];if(at){Q.push(Number.parseInt(at,8)),ee+=at.length+1;continue}Q.push(...Bc.encode(ph(je[0]??""))),ee+=2}return null}function ph(O){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[O]??O}function gh(O){return go(bh(O))}function ra(O,D){if(O==="/dev/null")return Uc(D);if(D==="/dev/null")return Uc(O);if(O.startsWith("a/")&&D.startsWith("b/"))return[O.slice(2),D.slice(2)].flatMap(go);let B=hh(O,D)??(O===D?tu(O):null);return[O,D,...B?[B]:[]].flatMap(go)}function Uc(O){let D=tu(O);return[O,...D?[D]:[]].flatMap(go)}function tu(O){let D=O.indexOf("/");return D>0&&D<O.length-1?O.slice(D+1):null}function hh(O,D){let B=O.indexOf("/"),Q=D.indexOf("/");if(B<1||Q<1)return null;if(O.slice(0,B)===D.slice(0,Q))return null;let ee=O.slice(B+1);return ee===D.slice(Q+1)?ee:null}function Hc(O){return gh(ci(O,!0))}function yh(O){return go(ci(O,!1))}function ci(O,D){let B=O.trim(),Q=B[0]==='"'||B[0]==="'"?B[0]:void 0;if(Q){let ee=eu(B,0,Q);if(ee&&(D||B.slice(ee.end).trim()===""))return ee.value}return D?B.split("\t",1)[0]?.trim()??"":B}function bh(O){return O.startsWith("a/")||O.startsWith("b/")?O.slice(2):O}function go(O){return O===""||O==="/dev/null"?[]:[O]}function jc(O){let D=O.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return D===""||D==="/dev/null"?[]:[D]}function ce(O){try{if(!Ch(O).isDirectory())return!1;return Sh(O,nu.R_OK|nu.X_OK),!0}catch{return!1}}function et(O,D,B){if(Qn(O))return;let Q=D.flatMap((he)=>ru(he,B));if(!Q[0])return;let ee=ru(ou(O)?O:Eh(Q[0],O),B)[0];if(!ee)return;return Q.some((he)=>Rh(ee,he))?ee:void 0}function ru(O,D){let B=D.realpath(O);if(B===null)return[];return D.isDirectory(B)?[B]:[]}function Rh(O,D){let B=vh(D,O);return B===""||B!==".."&&!B.startsWith(`..${xh}`)&&!ou(B)}var _h=8388608;async function We(O){let D=[],B=0;for await(let Q of O){let ee=typeof Q==="string"?Buffer.from(Q,"utf-8"):Buffer.from(Q.buffer,Q.byteOffset,Q.byteLength);if(B+=ee.byteLength,B>_h)throw wh(O),Error("hook input byte limit exceeded");D.push(ee)}return Buffer.concat(D,B).toString("utf-8")}function wh(O){let D=O.destroy??O.cancel;if(!D)return;try{Promise.resolve(D.call(O)).catch(()=>{})}catch{}}function d(O,D,B,Q,ee){if(B.kind!=="command")return{toolName:O,input:D,route:B,context:Q};return{toolName:O,input:D,route:B,context:Q,command:ee}}var Gr=["fail_closed","paranoid_rm","paranoid_interpreters"],di={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var o={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},fi=["standard","strict","paranoid"];function Ph(O,D){if(!D)return O;return fi.indexOf(D)>fi.indexOf(O)?D:O}function Ah(O){let D=ve(o.level,O);if(D===void 0||D==="")return;if(fi.includes(D))return D;console.error(`CC Safety Net: ignored invalid ${o.level.name}=${JSON.stringify(D.slice(0,40))}. Use ${fi.join(", ")}.`);return}function He(O){if(O===void 0||O==="all")return"all";if(O==="blocked")return"blocked";return"invalid"}function xe(O){return He(ve(o.auditScope,O))==="all"}function oa(O){if(O.failClosed&&O.paranoidRm&&O.paranoidInterpreters)return"paranoid";if(O.failClosed&&!O.paranoidRm&&!O.paranoidInterpreters)return"strict";if(!O.failClosed&&!O.paranoidRm&&!O.paranoidInterpreters)return"standard";return"custom"}function R(O={},D){let B=O.safety?.level??"standard",Q=Ah(D),ee=Ph(B,Q),he=di[ee],je={failClosed:he.fail_closed,paranoidRm:he.paranoid_rm,paranoidInterpreters:he.paranoid_interpreters},at={failClosed:ee===B?"preset":"environment",paranoidRm:ee===B?"preset":"environment",paranoidInterpreters:ee===B?"preset":"environment"},lt={failClosed:[`policy safety.level=${B}`],paranoidRm:[`policy safety.level=${B}`],paranoidInterpreters:[`policy safety.level=${B}`]};if(ee!==B)lt.failClosed.push(`env ${o.level.name}=${Q}`),lt.paranoidRm.push(`env ${o.level.name}=${Q}`),lt.paranoidInterpreters.push(`env ${o.level.name}=${Q}`);if(O.safety?.overrides?.failClosed!==void 0)je.failClosed=O.safety.overrides.failClosed,at.failClosed="capability_override",lt.failClosed.push("policy safety.overrides.fail_closed");if(O.safety?.overrides?.paranoidRm!==void 0)je.paranoidRm=O.safety.overrides.paranoidRm,at.paranoidRm="capability_override",lt.paranoidRm.push("policy safety.overrides.paranoid_rm");if(O.safety?.overrides?.paranoidInterpreters!==void 0)je.paranoidInterpreters=O.safety.overrides.paranoidInterpreters,at.paranoidInterpreters="capability_override",lt.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(L(o.strict,D))je.failClosed=!0,at.failClosed="environment",lt.failClosed.push(`env ${o.strict.name}`);if(L(o.paranoid,D))je.paranoidRm=!0,je.paranoidInterpreters=!0,at.paranoidRm="environment",at.paranoidInterpreters="environment",lt.paranoidRm.push(`env ${o.paranoid.name}`),lt.paranoidInterpreters.push(`env ${o.paranoid.name}`);if(L(o.paranoidRm,D))je.paranoidRm=!0,at.paranoidRm="environment",lt.paranoidRm.push(`env ${o.paranoidRm.name}`);if(L(o.paranoidInterpreters,D))je.paranoidInterpreters=!0,at.paranoidInterpreters="environment",lt.paranoidInterpreters.push(`env ${o.paranoidInterpreters.name}`);let ct=!!O.worktreeMode||L(o.worktree,D);return{strict:je.failClosed,paranoidRm:je.paranoidRm,paranoidInterpreters:je.paranoidInterpreters,worktreeMode:ct,effectiveLevel:oa(je),capabilities:{fail_closed:{enabled:je.failClosed,source:at.failClosed,sources:lt.failClosed},paranoid_rm:{enabled:je.paranoidRm,source:at.paranoidRm,sources:lt.paranoidRm},paranoid_interpreters:{enabled:je.paranoidInterpreters,source:at.paranoidInterpreters,sources:lt.paranoidInterpreters}}}}function L(O,D){let B=typeof O==="string"?ho(O,D):ve(O,D);return B==="1"||B?.toLowerCase()==="true"}function ho(O,D){return D.get(O)}function ve(O,D){let B=ho(O.name,D);if(B!==void 0)return B;if(O.legacyName)return ho(O.legacyName,D);return}function Qe(O,D){return ho(O.name,D)!==void 0||!!O.legacyName&&ho(O.legacyName,D)!==void 0}import{dirname as hr}from"node:path";import{closeSync as Th,constants as yo,fstatSync as ia,fsyncSync as Ih,lstatSync as vn,mkdirSync as iu,openSync as su,readdirSync as aa,readFileSync as kh,realpathSync as Fr,renameSync as Oh,rmdirSync as au,statSync as sa,unlinkSync as la,writeFileSync as Mh}from"node:fs";import{isAbsolute as lu,join as fr,normalize as Dh,parse as mi,relative as ca,resolve as ua,sep as pi}from"node:path";function Re(){let O=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${O()}${O()}`}var Nh=Symbol("PolicyFilesystemScope"),Lh=Symbol("PolicyFilesystemTarget"),cu=yo.O_NOFOLLOW??0;class r extends Error{name="PolicyFilesystemError";constructor(O){super(`Unable to access ${O} filesystem safely.`)}}function v(O,D){return{[Nh]:!0,root:ua(O),label:D}}function bo(O,D){let B=Dh(D);if(D===""||lu(D)||B===".."||B.startsWith(`..${pi}`))throw new r(O.label);return{[Lh]:!0,scope:O,relativePath:B,path:fr(O.root,B)}}function i(O,D){return bo(O,ca(O.root,ua(D)))}function re(O,D="rules policy"){let B=ua(O),Q=mi(B).dir;return bo(v(Q,D),ca(Q,B))}function n(O){return $n(O.scope.label,()=>{if(!Zt(O))return null;let D=su(O.path,yo.O_RDONLY|cu);return du(D,()=>{let B=ia(D);if(!B.isFile())throw new r(O.scope.label);let Q=kh(D,"utf-8"),ee=vn(O.path);if(!ee.isFile()||ee.isSymbolicLink()||B.dev!==ee.dev||B.ino!==ee.ino)throw new r(O.scope.label);return Zt(O),Q})})}function g(O,D,B=384,Q){let ee=`${O.path}.${Re()}.tmp`;$n(O.scope.label,()=>{Gh(O),Zt(O);let he=su(ee,yo.O_CREAT|yo.O_EXCL|yo.O_WRONLY|cu,B),je=du(he,()=>{let at=ia(he);if(!at.isFile())throw new r(O.scope.label);Mh(he,D,"utf-8"),Ih(he);let lt=ia(he);if(!lt.isFile()||lt.dev!==at.dev||lt.ino!==at.ino)throw new r(O.scope.label);return lt});Zt(O),zh(O,ee,je.dev,je.ino),Oh(ee,O.path),Q?.(O.path),Zt(O)},()=>Bh(ee))}function uu(O,D){if(O.path===D.path)return!0;return $n(O.scope.label,()=>{if(!Zt(O)||!Zt(D))return!1;let B=(Q)=>fr(Fr(mi(Q).dir),mi(Q).base);return B(O.path)===B(D.path)})}function le(O){let D=$n(O.scope.label,()=>{if(!Zt(O,"directory"))return null;let B=aa(O.path);return Zt(O,"directory"),B});if(!D)return null;return $n(O.scope.label,()=>{let B=D.map((Q)=>{let ee=bo(O.scope,fr(O.relativePath,Q)),he=vn(ee.path);if(he.isSymbolicLink()||!he.isFile()&&!he.isDirectory())throw new r(O.scope.label);return gi(da(O.scope),Fr(ee.path),O.scope.label),{name:Q,kind:he.isDirectory()?"directory":"file"}});return Zt(O,"directory"),B})}function N(O){$n(O.scope.label,()=>{if(!Zt(O))return;la(O.path),Zt(O)})}function tt(O){$n(O.scope.label,()=>{if(!Wh(O))return;mu(O),Zt(O,"directory")})}function nt(O){$n(O.scope.label,()=>{if(!Zt(O,"directory"))return;au(O.path),Zt(O,"directory")})}function Wh(O){return $n(O.scope.label,()=>{if(!Zt(O,"directory"))return!1;return fu(O),!0})}function $n(O,D,B){try{return D()}catch(Q){if(B?.(),Q instanceof r)throw Q;throw new r(O)}}function du(O,D){try{return D()}finally{Th(O)}}function Zt(O,D="file"){let B=pu(O.scope);if(!B)return!1;let Q=O.relativePath.split(pi);for(let ee of Q.keys()){let he=fr(O.scope.root,...Q.slice(0,ee+1)),je=vn(he,{throwIfNoEntry:!1});if(!je)return!1;if(je.isSymbolicLink())throw new r(O.scope.label);if(ee<Q.length-1&&!je.isDirectory())throw new r(O.scope.label);if(ee===Q.length-1&&(D==="file"?!je.isFile():!je.isDirectory()))throw new r(O.scope.label);gi(B,Fr(he),O.scope.label)}return!0}function fu(O){for(let D of aa(O.path)){let B=bo(O.scope,fr(O.relativePath,D)),Q=vn(B.path);if(Q.isSymbolicLink()||!Q.isDirectory()&&!Q.isFile())throw new r(O.scope.label);if(Q.isDirectory())fu(B)}Zt(O,"directory")}function mu(O){for(let D of aa(O.path)){let B=bo(O.scope,fr(O.relativePath,D)),Q=vn(B.path);if(Q.isSymbolicLink())throw new r(O.scope.label);if(Q.isDirectory()){mu(B);continue}if(!Q.isFile())throw new r(O.scope.label);la(B.path)}au(O.path)}function Gh(O){Fh(O.scope);let D=da(O.scope),B=O.relativePath.split(pi).slice(0,-1);for(let Q of B.keys()){let ee=fr(O.scope.root,...B.slice(0,Q+1));if(!vn(ee,{throwIfNoEntry:!1}))iu(ee,{mode:448});let he=vn(ee);if(!he.isDirectory()||he.isSymbolicLink())throw new r(O.scope.label);gi(D,Fr(ee),O.scope.label)}}function Fh(O){if(vn(O.root,{throwIfNoEntry:!1})){if(!sa(O.root).isDirectory())throw new r(O.label);return}let D=[],B=O.root;while(!vn(B,{throwIfNoEntry:!1})){D.unshift(B);let Q=mi(B).dir;if(Q===B)throw new r(O.label);B=Q}if(!sa(B).isDirectory())throw new r(O.label);for(let Q of D){iu(Q,{mode:448});let ee=vn(Q);if(!ee.isDirectory()||ee.isSymbolicLink())throw new r(O.label)}}function pu(O){if(!vn(O.root,{throwIfNoEntry:!1}))return null;if(!sa(O.root).isDirectory())throw new r(O.label);return Fr(O.root)}function da(O){let D=pu(O);if(!D)throw new r(O.label);return D}function zh(O,D,B,Q){let ee=vn(D);if(!ee.isFile()||ee.isSymbolicLink()||ee.dev!==B||ee.ino!==Q)throw new r(O.scope.label);gi(da(O.scope),Fr(D),O.scope.label)}function gi(O,D,B){let Q=ca(O,D);if(Q===".."||Q.startsWith(`..${pi}`)||lu(Q))throw new r(B)}function Bh(O){try{la(O)}catch{}}import{dirname as mr,isAbsolute as Vh,join as gr,relative as Kh,resolve as pr,sep as qh}from"node:path";var l=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,ue="rulebook.json",de=".cc-safety-net/rules";var gu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,$h=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,hu=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Uh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Hh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),rt=new RegExp(`^${Uh}/(${l.source.slice(1,-1)})/${Hh}$`);function jh(O){return`.cc-safety-net/rules/${O}/rulebook.json`}function yu(O){if(S(O))try{return A(O),null}catch(D){return D instanceof Error?D.message:String(D)}return l.test(O)?null:`Local rulebook sources must be bare names matching ${l}: ${O}`}function A(O){if(O.startsWith("github:"))throw Error(`Invalid rulebook source: ${O}`);let D=O.match(gu);if(!D?.[1]||!D[2]||!D[3])throw Error(`Invalid GitHub rulebook source: ${O}`);let B=D[3].lastIndexOf("/");if(B<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${O}`);let Q=D[3].slice(0,B),ee=D[3].slice(B+1);if(!Q||!hu.test(Q))throw Error(`GitHub rulebook refs must use valid path segments: ${O}`);if(!ee||!l.test(ee))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${O}`);return{owner:D[1],repo:D[2],ref:Q,path:jh(ee),name:ee}}function q(O){return $h.test(O)}function oe(O){return hu.test(O)}function S(O){return gu.test(O)}function ot(O){if(!l.test(O))throw Error(`Local rulebook sources must be bare names matching ${l}: ${O}`)}var bu="rule.json",hi="policy.json",Su=".cc-safety-net",Yh="rules",Zh="CC_SAFETY_NET_HOME",Cu="`cc-safety-net rule update`";function Xh(O){return pr(O,de)}function F(O){return gr(Xh(O),bu)}function b(O){return gr(pr(O),Su,hi)}function Se(O,D={}){return D.userConfigDir??(D.userConfigPath?mr(D.userConfigPath):gr(Jh(O),Yh))}function Jh(O){let D=O.env.get(Zh);return D?pr(pn(D)):gr(O.home,Su)}function M(O,D={}){return gr(Se(O,D),bu)}function u(O,D={}){return gr(mr(Se(O,D)),hi)}function K(O,D){let B=D.userConfigPath??M(O,D),Q=D.projectConfigPath??F(D.cwd),ee=Be(O,D),he=ze(Q,D.cwd);return{userConfigPath:B,projectConfigPath:Q,userScope:ee,projectScope:he,userConfigTarget:i(ee,B),projectConfigTarget:i(he,Q)}}function Be(O,D){let B=D.userConfigPath?mr(mr(pr(D.userConfigPath))):mr(pr(D.userConfigDir??Se(O,D)));return v(B,"user policy")}function ze(O,D){let B=pr(D),Q=pr(O),ee=Kh(B,Q);if(ee!==".."&&!ee.startsWith(`..${qh}`)&&!Vh(ee))return v(B,"project policy");return v(mr(mr(Q)),"project policy")}function I(O,D){return gr(O,D,ue)}var gn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),w=/^[a-zA-Z][a-zA-Z0-9_-]*$/,T=256,Kt=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),vu=new Set(["python","python3","python2","node","ruby","perl"]),yi=/^python(?:[23](?:\.\d+)*)?$/,En=new Set(["awk","gawk","nawk","mawk"]),bi=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Eu="Rulebook exceeds CC Safety Net's safe validation limits.",xu="Additional rulebook validation errors were omitted.",Pn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Ru(O){if(fa(O.allowed_commands,Pn.maxAllowedCommands)||fa(O.rules,Pn.maxRules)||fa(O.tests,Pn.maxTests))return!1;let{maxAggregateStringCodeUnits:D,maxTotalBlockArgs:B}=Pn,Q=(ee,he=!1)=>{if(typeof ee!=="string")return!0;if(ee.length>Pn.maxStringCodeUnits||he&&ee.length>Pn.maxFixtureCommandCodeUnits||ee.length>D)return!1;return D-=ee.length,!0};if(!Q(O.name)||!Q(O.version)||!Q(O.description)||!Q(O.author)||!Q(O.migrated_from))return!1;if(Array.isArray(O.allowed_commands)){for(let ee of O.allowed_commands)if(!Q(ee))return!1}if(Array.isArray(O.rules))for(let ee of O.rules){if(!ee||typeof ee!=="object")continue;let he=ee;if(!Q(he.name)||!Q(he.command)||!Q(he.subcommand)||!Q(he.reason)||!Q(he.intent))return!1;let je=he.match&&typeof he.match==="object"?he.match:{};for(let at of[he.block_args,je.command_path,je.any_args,je.exclude_args]){if(!Array.isArray(at))continue;if(at.length>Pn.maxBlockArgsPerRule||at.length>B)return!1;B-=at.length;for(let lt of at)if(!Q(lt))return!1}}if(Array.isArray(O.tests))for(let ee of O.tests){if(!ee||typeof ee!=="object")continue;let he=ee;if(!Q(he.command,!0)||!Q(he.expect)||!Q(he.rule))return!1}return!0}function fa(O,D){return Array.isArray(O)&&O.length>D}var ma=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var pe=64,fe="Rule config exceeds CC Safety Net's safe source limit.";function kt(O){return Tt(O).toLowerCase()}function Tt(O){return O.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??O}function an(O,D){let B=new Set,Q=!1;for(let ee of O){if(ee==="--"){Q=!0;continue}if(Q)continue;if(ee.startsWith("-")&&!ee.startsWith("--")&&ee.length>1)for(let he=1;he<ee.length;he++){let je=ee[he];if(!je||!/[a-zA-Z]/.test(je))break;let at=`-${je}`;if(B.add(at),D?.shortOptsWithValue?.has(at))break}}return B}var Qh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},pa=new Set(["--init-file","--rcfile"]);function ga(O,D,B,Q){let ee=!1,he=0,je=!1,at=!1,lt=!1;for(let ct=1;ct<D.length;ct++){let ut=D[ct];if(ut===void 0)break;if(O==="ksh"&&ut==="o"&&ct+1<D.length){if(Q==="argv"){let ft=D.slice(ct+1);if(D[0]==="-"&&(ft==="c"||ft[0]==="-"&&ft.endsWith("c")))je=!0}break}if(O==="ksh"&&ut==="o"&&ct+1===D.length&&(B?.startsWith("-")||B?.startsWith("+")))break;if(O==="zsh"&&ut==="o"&&ct+1<D.length)break;if(Q==="startup"&&ut==="i")ee=D[0]==="-";if(Q==="argv"&&D[0]==="-"&&ut==="c")je=!0;if(Q==="argv"&&ut==="n")lt=D[0]==="-";if(Q==="argv"&&ut==="s")at=D[0]==="-";if(!Qh[O]?.includes(ut))continue;if(ct+1===D.length)he++;break}return{interactive:ee,followingValues:he,commandSelected:je,stdinMode:at,syntaxCheck:lt}}function hn(O){let D=Tt(O[0]??"").toLowerCase(),B=!1,Q=!1,ee=!1;for(let he=1;he<O.length;he++){let je=O[he];if(je===void 0)break;if(je==="--"){let lt=B&&O[he+1]!==void 0?he+1:null;return{command:lt===null?null:O[lt]??null,commandIndex:lt,scriptIndex:!B&&!Q&&O[he+1]!==void 0?he+1:null,readsStdinAsCommands:!B&&(Q||O[he+1]===void 0),syntaxCheck:ee}}if(je==="-"||je[0]!=="-"&&je[0]!=="+")return{command:B?je:null,commandIndex:B?he:null,scriptIndex:!B&&!Q&&je!=="-"?he:null,readsStdinAsCommands:!B&&(Q||je==="-"),syntaxCheck:ee};if(je.startsWith("--")){let lt=je.split("=",1)[0]??je;if(D==="bash"&&pa.has(lt)&&!je.includes("="))he++;continue}let at=ga(D,je,O[he+1],"argv");if(at.commandSelected)B=!0;if(at.syntaxCheck)ee=!0;if(at.stdinMode)Q=!0;he+=at.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!B,syntaxCheck:ee}}function So(O,D){if(D.escaped)return D.escaped=!1,!0;if(O==="\\"&&!D.inSingle)return D.escaped=!0,!0;if(O==="'"&&!D.inDouble)return D.inSingle=!D.inSingle,!0;if(O==='"'&&!D.inSingle)return D.inDouble=!D.inDouble,!0;return!1}function Si(O){let D={inSingle:!1,inDouble:!1,escaped:!1};for(let B of ey(O))So(B,D);return D.inSingle||D.inDouble}function ey(O){let D="",B={inSingle:!1,inDouble:!1,escaped:!1},Q=!1,ee=!0;for(let he=0;he<O.length;he++){let je=O[he];if(!je)break;if(Q){if(je===`
-`||je==="\r")D+=je,Q=!1,B.escaped=!1;continue}if(je==="#"&&!B.inSingle&&!B.inDouble&&ee){Q=!0;continue}if(D+=je,!B.inSingle&&!B.inDouble&&!B.escaped)ee=/[\s;&|()<>]/.test(je);So(je,B)}return D}var ha=new Set(["rm","find","xargs","parallel"]),ty=new Set(["git","busybox",...ha,...Kt,...vu,...En]),ny=new Set(["python","node","ruby","perl"]);function Le(O){let D=kt(O);return ty.has(D)||An(D)}function An(O){return ny.has(ry(O))}function ry(O){let D=Tt(O).toLowerCase();return yi.test(D)?"python":D}var it={version:1,rules:[],overrides:{},transparent_wrappers:[]};function m(O){try{let D=n(oy(O));if(D===null)return{config:null,errors:[]};if(!D.trim())return{config:null,errors:["Config file is empty"]};let B=JSON.parse(D),Q=Ve(B);if(Q.errors.length>0)return{config:null,errors:Q.errors};return{config:{version:1,rules:B.rules??[],overrides:B.overrides??{},transparent_wrappers:B.transparent_wrappers??[]},errors:[]}}catch(D){if(D instanceof r)return{config:null,errors:[D.message]};let B=D instanceof Error?D.message:String(D);return{config:null,errors:[D instanceof SyntaxError?"Invalid JSON":B]}}}function oy(O){return typeof O==="string"?re(O):O}var e=(O,D)=>({path:O,message:D,kind:"typed"}),Xt=(O,D)=>({path:O,message:D,kind:"custom"});function Te(O){let D=new Set;return O.flatMap((B,Q)=>{let ee=zr(B)?B.name:void 0;if(typeof ee!=="string")return[];if(D.has(ee.toLowerCase()))return[Xt(["rules",Q,"name"],`duplicate rule name "${ee}"`)];return D.add(ee.toLowerCase()),[]})}var we=`must be one of ${ma.join(", ")}`,iy=/^[^/]+\/[^/]+$/,sy=["version","rules","overrides","transparent_wrappers"];function Ve(O){let D=ay(O);return{errors:ie(qe(D,sy,(B)=>B.kind==="custom"),": "," "),sources:gy(O,D)}}function ay(O){if(!zr(O))return[e([],"Config must be an object")];let D=Array.isArray(O.rules)&&O.rules.length>pe;return[...O.version===1?[]:[e(["version"],"must be 1")],...ly(O.rules,D),...dy(O.overrides),...my(O.transparent_wrappers),...D?[]:uy(O.rules),...zr(O.overrides)?Object.keys(O.overrides).filter((B)=>!iy.test(B)).map((B)=>Xt(["overrides",B],"must use <rulebook-name>/<rule-name>")):[],...py(O.transparent_wrappers)]}function ly(O,D){if(O===void 0)return[];if(!Array.isArray(O))return[e(["rules"],"must be an array of rulebook source strings"),..._u(O,pe)?[e(["rules"],fe)]:[]];if(D)return[{path:["rules"],message:fe,kind:"limit"}];return O.flatMap((B,Q)=>{if(typeof B!=="string")return[e(["rules",Q],"must be a rulebook source string"),...cy(B,1)?[e(["rules",Q],"must be a non-empty rulebook source string")]:[]];return B===""?[e(["rules",Q],"must be a non-empty rulebook source string")]:[]})}function _u(O,D){let B=wu(O);return B!==void 0&&!(B<=D)}function cy(O,D){let B=wu(O);return B!==void 0&&!(B>=D)}function wu(O){if(O===null||O===void 0)return;let D=O.length;return D===void 0?void 0:Number(D)}function uy(O){if(!Array.isArray(O))return[];let D=new Set;return O.flatMap((B,Q)=>{if(typeof B!=="string"||B==="")return[];if(B.trim()==="")return[Xt(["rules",Q],"must be a non-empty rulebook source string")];let ee=yu(B);if(ee)return[Xt(["rules",Q],ee)];if(D.has(B))return[Xt(["rules",Q],`duplicate rulebook source "${B}"`)];return D.add(B),[]})}function dy(O){if(O===void 0)return[];if(!zr(O))return[e(["overrides"],"must be an object if provided")];return Object.keys(O).flatMap((D)=>{let B=O[D];if(B==="off")return[];if(!zr(B))return[e(["overrides",D],'must be "off" or an object')];return[...fy(B.reason,["overrides",D,"reason"]),...B.intent===void 0||Ce(B.intent)?[]:[e(["overrides",D,"intent"],we)]]})}function fy(O,D){if(typeof O!=="string")return[e(D,"required non-empty string"),..._u(O,T)?[e(D,`must be at most ${T} characters`)]:[]];if(O==="")return[e(D,"required non-empty string")];return O.length>T?[e(D,`must be at most ${T} characters`)]:[]}function my(O){if(O===void 0)return[];if(!Array.isArray(O))return[e(["transparent_wrappers"],"must be an array of command strings")];return O.flatMap((D,B)=>{if(typeof D!=="string")return[e(["transparent_wrappers",B],"must be a command string")];return w.test(D)?[]:[e(["transparent_wrappers",B],"must match command pattern")]})}function py(O){if(!Array.isArray(O))return[];let D=new Set;return O.flatMap((B,Q)=>{if(typeof B!=="string"||!w.test(B))return[];if(D.has(B))return[Xt(["transparent_wrappers",Q],`duplicate command "${B}"`)];if(Le(B))return[Xt(["transparent_wrappers",Q],`reserved command "${B}" cannot be a wrapper`)];return D.add(B),[]})}function gy(O,D){let B=zr(O)?O.rules:void 0;if(!Array.isArray(B))return new Set;if(D.some((ee)=>ee.path.length===1&&ee.path[0]==="rules"))return new Set;let Q=new Set(D.filter((ee)=>ee.path[0]==="rules"&&typeof ee.path[1]==="number").map((ee)=>ee.path[1]));return new Set(B.filter((ee,he)=>typeof ee==="string"&&!Q.has(he)))}function qe(O,D,B){let Q=O.map((je)=>je.path[1]),ee=[...new Set(Q.filter((je)=>typeof je==="string"))],he=(je,at)=>[je.path.length===0?-1:D.indexOf(String(je.path[0])),typeof at==="number"?at:ee.indexOf(String(at)),B(je)?0:1];return O.map((je,at)=>({issue:je,rank:he(je,Q[at])})).sort((je,at)=>je.rank[0]-at.rank[0]||je.rank[1]-at.rank[1]||je.rank[2]-at.rank[2]).map((je)=>je.issue)}function ie(O,D,B){return[...new Set(O.map((Q)=>{let ee=ya(Q.path);if(Q.kind==="unknownKeys")return`${ee?`${ee}.`:""}unknown field "${Q.message}"`;if(Q.kind==="key"||Q.kind==="limit"||Q.path.length===0)return Q.message;return`${ee}${Q.path.length===1?B:D}${Q.message}`}))]}function ya(O){return O.map((D,B)=>{if(typeof D==="number")return`[${D}]`;return B===0?String(D):`.${String(D)}`}).join("")}function Ce(O){return ma.includes(O)}function zr(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function se(O){let D=by(O);if(D.errors.length>0)throw Error(D.errors.join("; "));return O}var hy=`required non-empty string up to ${T} characters`,Pu="must be a non-empty array of unique non-empty strings",yy="required non-empty array of non-empty strings";function by(O){if(!er(O))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Ru(O))return{errors:[Eu],ruleNames:new Set};let D=[...O.rulebook_version===1||O.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ie(Sy(O,O.rulebook_version===2),": ",": ")];return{errors:D.length>Pn.maxValidationErrors?[...D.slice(0,Pn.maxValidationErrors),xu]:D,ruleNames:new Set(_e(O).map((B)=>B.toLowerCase()))}}function _e(O){let D=er(O)?O.rules:void 0;return(Array.isArray(D)?D:[]).flatMap((B)=>{let Q=er(B)?B.name:void 0;return typeof Q==="string"?[Q]:[]})}function Sy(O,D){return[...typeof O.name==="string"&&l.test(O.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof O.version==="string"&&O.version!==""?[]:[e(["version"],"required non-empty string")],...Cy(O.allowed_commands),...vy(O.rules,D),..._y(O.tests),...wy(O),...Py(O)]}function Cy(O){if(!Array.isArray(O))return[e(["allowed_commands"],"required array")];let D=new Set;return[...O.flatMap((B,Q)=>typeof B==="string"&&w.test(B)?[]:[e(["allowed_commands",Q],"must match command pattern")]),...O.flatMap((B,Q)=>{if(typeof B!=="string"||!w.test(B))return[];if(D.has(B))return[Xt(["allowed_commands",Q],`duplicate command "${B}"`)];return D.add(B),[]})]}function vy(O,D){if(!Array.isArray(O))return[e(["rules"],"required array")];return[...O.flatMap((B,Q)=>{if(!er(B))return[e(["rules",Q],"must be an object")];return D?xy(B,["rules",Q]):Ey(B,["rules",Q])}),...Te(O)]}function Ey(O,D){return[...Au(O.name,D),...Tu(O.command,D),...O.subcommand===void 0||typeof O.subcommand==="string"&&w.test(O.subcommand)?[]:[e([...D,"subcommand"],"must match command pattern")],...Ci(O.block_args,[...D,"block_args"],"required non-empty array",!1),...Iu(O.reason,D),...ku(O.intent,D)]}function xy(O,D){return[...Au(O.name,D),...Tu(O.command,D),...Iu(O.reason,D),...ku(O.intent,D),...Ry(O.match,[...D,"match"]),...O.subcommand===void 0?[]:[e([...D,"subcommand"],"not supported in rulebook_version 2")],...O.block_args===void 0?[]:[e([...D,"block_args"],"not supported in rulebook_version 2")]]}function Au(O,D){if(typeof O!=="string")return[e([...D,"name"],"required string")];return l.test(O)?[]:[e([...D,"name"],"must match rule name pattern")]}function Tu(O,D){return typeof O==="string"&&w.test(O)?[]:[e([...D,"command"],"required string matching command pattern")]}function Iu(O,D){return typeof O==="string"&&O!==""&&O.length<=T?[]:[e([...D,"reason"],hy)]}function ku(O,D){return O===void 0||Ce(O)?[]:[e([...D,"intent"],we)]}function Ry(O,D){if(!er(O))return[e(D,"required object")];return[...Ci(O.command_path,[...D,"command_path"],yy,!1),...O.any_args===void 0?[]:Ci(O.any_args,[...D,"any_args"],Pu,!0),...O.exclude_args===void 0?[]:Ci(O.exclude_args,[...D,"exclude_args"],Pu,!0)]}function Ci(O,D,B,Q){if(!Array.isArray(O))return[e(D,B)];let ee=O.flatMap((he,je)=>{if(typeof he!=="string")return[e([...D,je],"must be a non-empty string")];return he===""?[Xt([...D,je],"must be a non-empty string")]:[]});if(O.some((he)=>typeof he!=="string"))return ee;return[...ee,...O.length===0?[Xt(D,B)]:[],...Q&&new Set(O).size!==O.length?[Xt(D,"must not contain duplicate values")]:[]]}function _y(O){if(O===void 0)return[];if(!Array.isArray(O))return[e(["tests"],"must be an array if provided")];return O.flatMap((D,B)=>{if(!er(D))return[e(["tests",B],"must be an object")];return[...typeof D.command==="string"&&D.command.trim()!==""?[]:[e(["tests",B,"command"],"required non-empty string")],...D.expect==="blocked"||D.expect==="allowed"?[]:[e(["tests",B,"expect"],'must be "blocked" or "allowed"')],...D.rule===void 0||typeof D.rule==="string"?[]:[e(["tests",B,"rule"],"must be a string if provided")],...D.expect==="blocked"&&typeof D.rule!=="string"?[Xt(["tests",B,"rule"],"required string for blocked fixtures")]:[]]})}function wy(O){if(!Array.isArray(O.tests))return[];let D=new Set(_e(O));return[...new Set(O.tests.flatMap((B)=>er(B)&&B.expect==="blocked"&&typeof B.rule==="string"?[B.rule]:[]))].filter((B)=>!D.has(B)).map((B)=>Xt(["tests"],`blocked fixture references unknown rule "${B}"`))}function Py(O){if(!Array.isArray(O.allowed_commands)||!Array.isArray(O.rules))return[];let D=new Set(O.allowed_commands.filter((B)=>typeof B==="string"));return O.rules.flatMap((B,Q)=>{let ee=er(B)?B.command:void 0;if(typeof ee!=="string"||D.has(ee))return[];return[Xt(["rules",Q,"command"],`"${ee}" must be listed in allowed_commands`)]})}function er(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function J(O,D){let B=K(O,D),Q;try{Q=uu(B.userConfigTarget,B.projectConfigTarget)}catch(mt){if(mt instanceof r)return Ly(B,mt.message);throw mt}let ee=m(B.userConfigTarget),he=Q?{config:null,errors:[]}:m(B.projectConfigTarget),je=Mu(B.userConfigPath,ee.errors),at=Mu(B.projectConfigPath,he.errors),lt=new Set,ct=ee.config?ba(ee.config,hr(B.userConfigPath),"user",B.userScope,lt):Du(),ut=he.config?ba(he.config,hr(B.projectConfigPath),"project",B.projectScope,lt):Du(),ft=ee.config?.overrides??{},dt=he.config?.overrides??{};return{rules:[...Ou(ct.rules,ft),...Ou(ut.rules,dt)],transparent_wrappers:Dy(ee.config,he.config),rulebooks:[...ct.rulebooks,...ut.rulebooks],errors:[...je,...at,...ct.errors,...ut.errors],warnings:[...ct.warnings,...ut.warnings,...ct.canValidateOverrides?Sa(ft,ct.knownRuleIds,B.userConfigPath):[],...ct.canValidateOverrides?Ny(dt,ct.knownRuleIds,B.projectConfigPath):[],...ut.canValidateOverrides?Sa(dt,ut.knownRuleIds,B.projectConfigPath):[]],userConfig:ee.config??void 0,projectConfig:he.config??void 0,...B}}function j(O,D){let B=Ay(O,D);if(!B)return[];return[...B.scope.errors,...B.scope.warnings,...Ty(B.config,B.scope,O)]}function Ay(O,D){let B=D??v(hr(hr(O)),"rules policy"),Q=m(i(B,O)).config;if(!Q)return null;return{config:Q,scope:ba(Q,hr(O),"project",B)}}function Ty(O,D,B){return D.canValidateOverrides?Sa(O.overrides??{},D.knownRuleIds,B):[]}function ba(O,D,B,Q=v(hr(hr(D)),B==="user"?"user policy":"project policy"),ee=new Set){let he=[],je=[],at=O.rules.flatMap((ct)=>{let ut=ky(ct,D,Q);if(ut.errors.length>0||!ut.rulebook)return he.push(...ut.errors),[];let ft=ut.rulebook;if(ee.has(ft.name))return je.push(`duplicate active rulebook name "${ft.name}" for ${ct}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return ee.add(ft.name),[{rules:Iy(ft),rulebook:{source:B,spec:ct,name:ft.name,version:ft.version,rules:ft.rules.map((dt)=>`${ft.name}/${dt.name}`)}}]}),lt=at.flatMap((ct)=>ct.rules);return{rules:lt,rulebooks:at.map((ct)=>ct.rulebook),knownRuleIds:new Set(lt.map((ct)=>ct.name)),errors:he,warnings:je,canValidateOverrides:he.length===0}}function Iy(O){if(O.rulebook_version===2)return O.rules.map((D)=>({name:`${O.name}/${D.name}`,command:D.command,block_args:[],match:D.match,reason:D.reason,intent:D.intent}));return O.rules.map((D)=>({...D,name:`${O.name}/${D.name}`,match:void 0}))}function ky(O,D,B){let Q=Pe(O),ee=I(D,Q),he=My(ee,B);if("error"in he)return{rulebook:null,errors:[he.error]};if(he.content===null)return{rulebook:null,errors:[`missing rulebook file ${ee} for ${O}; ${Oy(O)}`]};let je=me(he.content);if("problem"in je)return{rulebook:null,errors:[`invalid rulebook ${ee}: ${je.problem}; fix that file`]};if(je.rulebook.name!==Q)return{rulebook:null,errors:[`rulebook name "${je.rulebook.name}" in ${ee} must match source "${O}"; fix that file`]};return{rulebook:je.rulebook,errors:[]}}function Pe(O){return S(O)?A(O).name:O}function Oy(O){return S(O)?`run ${Cu} to vendor ${O}`:"create that file or remove that source from the rules config"}function My(O,D){try{return{content:n(i(D,O))}}catch(B){if(B instanceof r)return{error:B.message};throw B}}function me(O){let D;try{D=JSON.parse(O)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:se(D)}}catch(B){return{problem:B instanceof Error?B.message:"invalid rulebook"}}}function Dy(O,D){return[...new Set([...O?.transparent_wrappers??[],...D?.transparent_wrappers??[]])]}function Ou(O,D){return O.flatMap((B)=>{let Q=D[B.name];if(Q==="off")return[];if(Q&&typeof Q==="object")return[{...B,intent:Q.intent??B.intent,reason:Q.reason}];return[B]})}function Sa(O,D,B){return Object.keys(O).filter((Q)=>!D.has(Q)).map((Q)=>`unknown override key "${Q}" in ${B}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Ny(O,D,B){return Object.keys(O).filter((Q)=>D.has(Q)).map((Q)=>`project override cannot target user-scoped rule "${Q}" in ${B}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Mu(O,D){return D.map((B)=>B.startsWith("Unable to access ")?B:`${O}: ${B}`)}function Ly(O,D){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[D],warnings:[],userConfigPath:O.userConfigPath,projectConfigPath:O.projectConfigPath}}function Du(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as qy,readFileSync as Yy}from"node:fs";var Nu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Ca=new Set(Nu.map((O)=>O.id)),U=Nu,Wy=new Map(U.map((O)=>[O.id,O.intent]));function St(O,D){return{id:O,reason:D,intent:Wy.get(O)??"manual_only"}}var va=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],vi={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Gy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Fy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ea=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Fy.flatMap((O)=>Gy.map((D)=>({id:["secret.home",O.idSlug,D.slice(1)].join("."),category:"Home path",label:[O.label,D].join(""),description:["Blocks home ",O.label,D," credential backup files."].join(""),suffixParts:[...O.directoryParts,[O.basename,D].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Ei=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Lu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],zy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],xa=Lu.map((O)=>({id:`secret.variant.${O.slug}.separator`,category:"Variant",label:`${O.label}-* / ${O.label}_*`,description:`Blocks ${O.label} variants with dash or underscore suffixes.`,prefix:O.prefix})),Ra=Lu.flatMap((O)=>zy.map((D)=>({id:`secret.variant.${O.slug}.${D.slice(1)}`,category:"Variant",label:`${O.label}${D}`,description:`Blocks ${O.label}${D} private credential variants.`,prefix:O.prefix,suffix:D}))),Co={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},_a=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((O)=>({id:`secret.ext.${O}`,category:"Extension",label:`.${O}`,description:`Blocks files with the .${O} extension.`,extension:O})),wa=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Ke=[...va,vi,...Ea,...xa,...Ra,Co,..._a,...wa,...Ei].map((O)=>({id:O.id,category:O.category,label:O.label,...O.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in O?{paths:O.paths}:{description:O.description}})),xi=new Set(Ei.flatMap((O)=>O.category==="Coding CLI config"?[O.id]:[])),Pa=new Set(Ke.map((O)=>O.id));import{isAbsolute as Aa,join as By,normalize as $y,sep as Ri}from"node:path";var Wu=process.platform==="win32",Uy=/[*?]/;function vo(O,D){if(O==="~")return D;if(O.startsWith("~/"))return`${D}${O.slice(1)}`;return O}function Ta(O,D){if(typeof O!=="string"||O.trim()==="")return"must be a non-empty path string";let B=vo(O.trim(),D);if(!Aa(B))return"must be an absolute path or start with ~/";return Eo(B,D)}function Ia(O,D){let B=Gu(O,D);if(B===null)return"must be a non-empty path string";if(!Aa(B))return null;if(Eo(B,D)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Hy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",jy="cannot cover the guard's own configuration";function Gu(O,D){if(typeof O!=="string"||O.trim()==="")return null;return vo(O.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),D)}function ka(O,D){let B=Gu(O,D);if(B===null)return"must be a non-empty path string";if(Uy.test(B))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!Aa(B))return null;if(Eo(B,D)!==null)return Hy;return Vy(B,D)?jy:null}function Vy(O,D){let B=_i(O),Q=_i(By(D,".cc-safety-net"));return B===Q||B.startsWith(`${Q}${Ri}`)}function Eo(O,D){let B=_i(O),Q=_i(D);if(B===Q)return"cannot be the home directory";let ee=B.endsWith(Ri)?B:`${B}${Ri}`;if(Q.startsWith(ee))return"cannot contain the home directory";return null}function _i(O){let D=$y(O);if(Wu)D=D.replace(/\//g,"\\").toLowerCase();if(D.length>(Wu?3:1)&&D.endsWith(Ri))D=D.slice(0,-1);return D}var Fu=30,wi=1,Pi=365;function zu(O){if(typeof O!=="number"||!Number.isInteger(O))return 30;if(O<1)return 1;return O>365?365:O}var Bu=new Set(U.filter((O)=>O.catastrophic).map((O)=>O.id));function wt(O,D){if(!O)return null;if(Bu.has(O.id))return O;if(D?.destructiveCommandProtectionEnabled===!1)return null;let B=D?.effectiveDestructiveCommandRules[O.id];return B&&!B.enabled?null:O}function Jt(O,D,B){if(Bu.has(D))return!0;if(O?.destructiveCommandProtectionEnabled===!1)return!1;return O?.effectiveDestructiveCommandRules[D]?.enabled??B}function G(O,D){return Object.freeze(Object.fromEntries(U.map((B)=>{let Q=B.activationCapability?D[B.activationCapability]:void 0,ee=Q?.enabled??!0,he=O.destructiveCommandRuleOverrides[B.id],je=B.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...he?{override:he}:{}}:O.destructiveCommandProtectionEnabled?he?{enabled:he==="on",inheritedEnabled:ee,changesInherited:he==="on"!==ee,source:"rule_override",...B.activationCapability?{activationCapability:B.activationCapability}:{},override:he}:{enabled:ee,inheritedEnabled:ee,changesInherited:!1,source:Q?.source??"built_in_default",...B.activationCapability?{activationCapability:B.activationCapability}:{}}:{enabled:!1,inheritedEnabled:ee,changesInherited:!1,source:"master_disabled",...B.activationCapability?{activationCapability:B.activationCapability}:{},...he?{override:he}:{}};return[B.id,Object.freeze(je)]})))}function $u(O,D){return Object.freeze({...O,effectiveDestructiveCommandRules:G(O,D)})}var Uu={standard:0,strict:1,paranoid:2};function Y(O,D){return{policy:{version:1,safety:{level:D.safety?.level??O.safety.level,overrides:{...O.safety.overrides,...D.safety?.overrides}},workflow:{worktree_mode:D.workflow?.worktree_mode??O.workflow.worktree_mode},destructive_command_protection:{enabled:D.destructive_command_protection?.enabled??O.destructive_command_protection.enabled,overrides:{...O.destructive_command_protection.overrides,...D.destructive_command_protection?.overrides},allow_paths:Oa(O.destructive_command_protection.allow_paths,D.destructive_command_protection?.allow_paths)},secret_protection:{enabled:D.secret_protection?.enabled??O.secret_protection.enabled,overrides:{...O.secret_protection.overrides,...D.secret_protection?.overrides},deny_paths:Oa(O.secret_protection.deny_paths,D.secret_protection?.deny_paths),allow_paths:Oa(O.secret_protection.allow_paths,D.secret_protection?.allow_paths)},audit:O.audit},weakenings:Ky(O,D)}}function Oa(O,D){return[...new Set([...O,...D??[]])]}function Ky(O,D){let B=D.safety?.level,Q=di[O.safety.level];return[...B&&Uu[B]<Uu[O.safety.level]?[`project policy lowers level: ${O.safety.level} -> ${B}`]:[],...Gr.flatMap((ee)=>D.safety?.overrides?.[ee]===!1&&(O.safety.overrides[ee]??Q[ee])?[`project policy disables ${ee}`]:[]),...D.workflow?.worktree_mode===!0&&!O.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...D.destructive_command_protection?.enabled===!1&&O.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...D.secret_protection?.enabled===!1&&O.secret_protection.enabled?["project policy disables secret protection"]:[],...Hu(D.destructive_command_protection?.overrides,(ee)=>O.destructive_command_protection.enabled&&O.destructive_command_protection.overrides[ee]!=="off"),...Hu(D.secret_protection?.overrides,(ee)=>O.secret_protection.enabled&&(O.secret_protection.overrides[ee]==="on"?!0:O.secret_protection.overrides[ee]!=="off"&&!xi.has(ee))),...O.destructive_command_protection.enabled?ju(O.destructive_command_protection.allow_paths,D.destructive_command_protection?.allow_paths).map((ee)=>`project policy adds destructive allow path: ${ee}`):[],...O.secret_protection.enabled?ju(O.secret_protection.allow_paths,D.secret_protection?.allow_paths).map((ee)=>`project policy adds secret allow path: ${ee}`):[]]}function Hu(O,D){return Object.entries(O??{}).flatMap(([B,Q])=>Q==="off"&&D(B)?[`project policy disables rule ${B}`]:[])}function ju(O,D){return(D??[]).filter((B)=>!O.includes(B))}var Na=new Set(["standard","strict","paranoid"]),Z={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Fu}};function Yu(O,D){let B=tb(u(O,D),O.home),Q=Ie(b(D.cwd),O.home),ee=ae(Q.parsed,O.home),he=Object.keys(ee.policy).length>0?Y(B.gui??Z,ee.policy):void 0,je=[...B.errors,...Q.errors,...ee.diagnostics],at=(B.fallback==="defaults"&&he?"salvaged":B.fallback)??(B.gui?void 0:Q.fallback)??(je.length>0?"salvaged":void 0),lt=ee.policy.safety?.level?"project":B.levelPresent?"user":"default";return{...he?Da(he.policy):B.policy,errors:je,...at?{fallback:at}:{},...Q.exists?{policyScopes:{levelScope:lt,weakenings:he?.weakenings??[]}}:{}}}var Zy="project policy audit settings are ignored; audit is user scope only";function ae(O,D){if(!yn(O))return{policy:{},diagnostics:[]};let B=yn(O.safety)?O.safety:{},Q=yn(O.workflow)?O.workflow:{},ee=yn(O.destructive_command_protection)?O.destructive_command_protection:{},he=yn(O.secret_protection)?O.secret_protection:{},je={...Na.has(B.level)?{level:B.level}:{},...yn(B.overrides)?Vu({overrides:Zu(B.overrides,Gr,["safety","overrides"],yr)}):{}},at={...typeof ee.enabled==="boolean"?{enabled:ee.enabled}:{},...ee.overrides!==void 0?{overrides:Ai(ee.overrides,Ca,Ju,yr)}:{},...ee.allow_paths!==void 0?{allow_paths:$r(ee.allow_paths,Ta,D,["destructive_command_protection","allow_paths"],yr)}:{}},lt={...typeof he.enabled==="boolean"?{enabled:he.enabled}:{},...he.overrides!==void 0?{overrides:Ai(he.overrides,Pa,Qu,yr)}:{},...he.deny_paths!==void 0?{deny_paths:$r(he.deny_paths,Ia,D,["secret_protection","deny_paths"],yr)}:{},...he.allow_paths!==void 0?{allow_paths:$r(he.allow_paths,ka,D,["secret_protection","allow_paths"],yr)}:{}};return{policy:Vu({safety:je,workflow:typeof Q.worktree_mode==="boolean"?{worktree_mode:Q.worktree_mode}:{},destructive_command_protection:at,secret_protection:lt}),diagnostics:O.audit===void 0?[]:[Zy]}}function Zu(O,D,B,Q){return Object.fromEntries(D.flatMap((ee)=>{let he=O[ee];if(typeof he==="boolean")return[[ee,he]];if(he!==void 0)Q(e([...B,ee],La));return[]}))}function Vu(O){return Object.fromEntries(Object.entries(O).flatMap((D)=>Object.keys(D[1]).length>0?[D]:[]))}var yr=()=>{return},La="must be a boolean",Wa="must be an object if provided",Xu=`must be an integer between ${wi} and ${Pi}`,Ju={path:["destructive_command_protection","overrides"],label:"destructive command"},Qu={path:["secret_protection","overrides"],label:"secret protection"},Je=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Ye(O,D){let B=[];return{policy:ed(O,D,(ee)=>{B.push(ee)}),issues:B}}function C(O,D){return ed(O,D,yr)}function ed(O,D,B){if(!yn(O))return B(e([],"Config must be an object")),H();if(O.version!==1)B(e(["version"],"must be 1"));let Q=Br(O.safety,["safety"],["level","overrides"],B),ee=Br(Q.overrides,["safety","overrides"],Gr,B),he=Br(O.workflow,["workflow"],["worktree_mode"],B),je=Br(O.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],B),at=Br(O.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],B),lt=Br(O.audit,["audit"],["retention_days"],B);return td(O,Je,[],B),{version:1,safety:{level:Xy(Q.level,B),overrides:Zu(ee,Gr,["safety","overrides"],B)},workflow:{worktree_mode:Ma(he.worktree_mode,["workflow","worktree_mode"],!1,B)},destructive_command_protection:{enabled:Ma(je.enabled,["destructive_command_protection","enabled"],!0,B),overrides:Ai(je.overrides,Ca,Ju,B),allow_paths:$r(je.allow_paths,Ta,D,["destructive_command_protection","allow_paths"],B)},secret_protection:{enabled:Ma(at.enabled,["secret_protection","enabled"],!0,B),overrides:Ai(at.overrides,Pa,Qu,B),deny_paths:$r(at.deny_paths,Ia,D,["secret_protection","deny_paths"],B),allow_paths:$r(at.allow_paths,ka,D,["secret_protection","allow_paths"],B)},audit:{retention_days:Jy(lt.retention_days,B)}}}function Br(O,D,B,Q){if(O===void 0)return{};if(!yn(O))return Q(e(D,Wa)),{};return td(O,B,D,Q),O}function td(O,D,B,Q){for(let ee of Object.keys(O).filter((he)=>!D.includes(he)))Q({path:B,message:ee,kind:"unknownKeys"})}function Xy(O,D){if(O===void 0)return"standard";if(Na.has(O))return O;return D(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Ma(O,D,B,Q){if(typeof O==="boolean")return O;if(O!==void 0)Q(e(D,La));return B}function Jy(O,D){if(!(O===void 0||typeof O==="number"&&Number.isInteger(O)&&O>=wi&&O<=Pi))D(e(["audit","retention_days"],Xu));return zu(O)}function Ai(O,D,B,Q){if(O===void 0)return{};if(!yn(O))return Q(e(B.path,Wa)),{};return Object.fromEntries(Object.entries(O).flatMap(([ee,he])=>{if(!D.has(ee))return Q({path:[...B.path,ee],message:`unknown ${B.label} rule id "${ee}"`,kind:"key"}),[];if(he==="on"||he==="off")return[[ee,he]];return Q(e([...B.path,ee],'must be "on" or "off"')),[]}))}function $r(O,D,B,Q,ee){if(O===void 0)return[];if(!Array.isArray(O))return ee(e(Q,"must be an array of paths")),[];return O.flatMap((he,je)=>{let at=D(he,B);if(at===null)return[he];return ee(typeof he==="string"?Xt([...Q,je],at):e([...Q,je],at)),[]})}function yn(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function H(){return structuredClone(Z)}function Ae(O,D){let B=R({safety:De(O.safety)},D),Q=G({destructiveCommandProtectionEnabled:O.destructive_command_protection.enabled,destructiveCommandRuleOverrides:O.destructive_command_protection.overrides},B.capabilities),ee=Object.values(Q),he=ee.filter((je)=>je.source!=="catastrophic");return{selectedPreset:O.safety.level,effectiveLevel:B.effectiveLevel,capabilities:B.capabilities,rules:Q,counts:{enabled:he.filter((je)=>je.enabled).length,disabled:he.filter((je)=>!je.enabled).length,effectiveCustomizations:ee.filter((je)=>je.changesInherited).length}}}function Ie(O,D){if(!qy(O))return{exists:!1,policy:H(),errors:[]};try{let B=Yy(O,"utf-8");if(!B.trim())return{exists:!0,policy:H(),errors:[`${O}: Config file is empty`],fallback:"defaults"};let Q=JSON.parse(B),ee=Ye(Q,D);if(ee.issues.length===0)return{exists:!0,parsed:Q,policy:ee.policy,errors:[]};return{exists:!0,parsed:Q,policy:ee.policy,errors:ee.issues.map((he)=>`${O}: ${eb(he)}`),fallback:yn(Q)?"salvaged":"defaults"}}catch(B){let Q=B instanceof Error?B.message:String(B);return{exists:!0,policy:H(),errors:[`${O}: ${B instanceof SyntaxError?"Invalid JSON":Q}`],fallback:"defaults"}}}var Qy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Wa,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[La,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Xu,`not an integer between ${wi} and ${Pi}`]]);function eb(O){let D=ya(O.path);if(O.kind==="unknownKeys")return`${D===""?"":`${D}.`}${O.message}: unknown field`;if(O.kind==="key")return`${D}: unknown rule id`;let B=Qy.get(O.message)??O.message;return D===""?B:`${D}: ${B}`}function tb(O,D){let B=Ie(O,D);if(!B.exists){let Q=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!yn(Q))return{policy:qu(),errors:[]};let ee=C(Q,D);return{policy:Da(ee),gui:ee,errors:[],levelPresent:Ku(Q)}}if(B.parsed===void 0)return{policy:qu(),errors:B.errors,...B.fallback?{fallback:B.fallback}:{}};return{policy:Da(B.policy),gui:B.policy,errors:B.errors,...B.fallback?{fallback:B.fallback}:{},levelPresent:Ku(B.parsed)}}function Ku(O){let D=yn(O)&&yn(O.safety)?O.safety:{};return Na.has(D.level)}function Oe(O){let D=Object.entries(O),B=new Set(D.flatMap(([Q,ee])=>ee==="on"?[Q]:[]));return[...new Set([...[...xi].filter((Q)=>!B.has(Q)),...D.flatMap(([Q,ee])=>ee==="off"?[Q]:[])])]}function qu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Oe({}),denyPaths:[],allowPaths:[]}}}function Da(O){return{safety:De(O.safety),worktreeMode:O.workflow.worktree_mode,destructiveCommandProtectionEnabled:O.destructive_command_protection.enabled,destructiveCommandRuleOverrides:O.destructive_command_protection.overrides,destructiveCommandAllowPaths:O.destructive_command_protection.allow_paths,secretProtection:{enabled:O.secret_protection.enabled,disabledRules:Oe(O.secret_protection.overrides),denyPaths:O.secret_protection.deny_paths,allowPaths:O.secret_protection.allow_paths}}}function De(O){let D={...O.overrides.fail_closed!==void 0?{failClosed:O.overrides.fail_closed}:{},...O.overrides.paranoid_rm!==void 0?{paranoidRm:O.overrides.paranoid_rm}:{},...O.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:O.overrides.paranoid_interpreters}:{}};return{level:O.level,...Object.keys(D).length>0?{overrides:D}:{}}}function E(O,D){let B=J(O,D),Q=Yu(O,D),ee={rules:B.rules,transparentWrappers:B.transparent_wrappers,safety:Q.safety,worktreeMode:Q.worktreeMode,destructiveCommandProtectionEnabled:Q.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:Q.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:Q.destructiveCommandAllowPaths,secretProtection:{enabled:Q.secretProtection.enabled??!0,disabledRules:Q.secretProtection.disabledRules??[],denyPaths:Q.secretProtection.denyPaths,allowPaths:Q.secretProtection.allowPaths??[]}},he={...B.userConfig?.overrides,...B.projectConfig?.overrides},je=Object.freeze(Object.fromEntries(ee.rules.map((at)=>{let lt=B.rulebooks.find((ut)=>ut.rules.includes(at.name)),ct=he[at.name];return[at.name,Object.freeze({id:at.name,...lt?{rulebook:Object.freeze({name:lt.name,version:lt.version}),...ib(lt.spec)?{source:lt.spec}:{}}:{},...ct&&typeof ct==="object"?{override:Object.freeze({type:"reason",reason:ct.reason})}:{}})]})));return Ee(ee,nb(B,Q),je,Q.policyScopes)}function Ne(O){if(O.state==="ready")return{state:O.state};return{state:O.state,reason:O.reason}}function nb(O,D){let B=ob(D);if(O.errors.length===0&&O.warnings.length===0&&!B)return;return{diagnostics:[...O.errors,...O.warnings,...D.errors],reason:sb(O.errors.length>0?rb(O.errors):void 0,O.warnings.length>0?Fa(O.warnings.join("; ")):void 0,B)}}function rb(O){return`${Fa(O.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function ob(O){if(O.errors.length===0)return;let D=O.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${O.errors.join("; ")}. Enforcing ${D}; the invalid values are not active. Fix the policy file manually`}function ib(O){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(O)}function Ee(O,D,B=Object.freeze({}),Q){let ee=Ga(structuredClone(O)),he=Q?{policyScopes:Ga(structuredClone(Q))}:{};if(!D)return Object.freeze({state:"ready",policy:ee,diagnostics:Object.freeze([]),ruleMetadata:B,...he});return Object.freeze({state:"degraded",policy:ee,diagnostics:Object.freeze([...D.diagnostics]),reason:D.reason,ruleMetadata:B,...he})}function Ga(O){if(typeof O!=="object"||O===null)return O;for(let D of Object.values(O))Ga(D);return Object.freeze(O)}function sb(...O){return Fa(O.filter((D)=>!!D).join("; "))}function Fa(O){return/[.!?]$/.test(O)?O:`${O}.`}function Fe(O){let D=O.effectiveCapabilities,B=O.strict??D.fail_closed.enabled,Q=O.paranoidRm??D.paranoid_rm.enabled,ee=O.paranoidInterpreters??D.paranoid_interpreters.enabled,he={fail_closed:za(D.fail_closed,O.strict,"strict"),paranoid_rm:za(D.paranoid_rm,O.paranoidRm,"paranoidRm"),paranoid_interpreters:za(D.paranoid_interpreters,O.paranoidInterpreters,"paranoidInterpreters")};return{policy:$u(O.policySnapshot.policy,he),effectiveCapabilities:he,effectiveLevel:oa({failClosed:B,paranoidRm:Q,paranoidInterpreters:ee}),strict:B,paranoidRm:Q,paranoidInterpreters:ee,worktreeMode:O.worktreeMode??!1}}function za(O,D,B){if(D===void 0||D===O.enabled)return O;return{enabled:D,source:"capability_override",sources:[...O.sources,`analysis options.${B}`]}}function xo(O,D){if(O!=="powershell")return D[0]?.provenance==="command-substitution";let B=D[0]?.text==="&"||D[0]?.text==="."?1:0,Q=D[B]?.provenance;return Q!==void 0&&Q!=="literal"}var ab=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ti(O,D){return O?.provenance==="literal"&&!O.quoted&&O.raw===D&&O.text===D}function Ro(O){let D=Ti(O.words[0],"time")?1:0,B=D===1&&Ti(O.words[D],"-p")?D+1:D,Q=D===1&&Ti(O.words[B],"--")?B+1:B,ee=Ti(O.words[Q],"!")?Q+1:Q,he=O.words.slice(ee).find((je)=>!ab.test(je.text));return he?.provenance==="literal"?he.text:void 0}var tr=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Ii(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function lb(O){return Object.freeze({...O,span:Object.freeze(O.span),words:Object.freeze(O.words),redirections:Object.freeze(O.redirections.map((D)=>Object.freeze({...D,span:Object.freeze(D.span),...D.heredoc?{heredoc:Object.freeze({...D.heredoc,bodySpan:Object.freeze(D.heredoc.bodySpan),terminatorSpan:Object.freeze(D.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(O.nested.map((D)=>ln(D)))})}function ki(O,D,B){O.push(B),D.reset()}function Oi(O){let D=[];return{parts:D,push:(B,Q,ee)=>{if(Q<=B)return;D.push({raw:O.slice(B,Q),span:{start:B,end:Q},provenance:ee})}}}function Ba(O){let D=O.parts??[{raw:O.raw,span:O.span,provenance:O.provenance}];return Object.freeze({kind:"word",...O,span:Object.freeze(O.span),parts:Object.freeze(D.map((B)=>Object.freeze({...B,span:Object.freeze(B.span)})))})}function Ur(O,D,B,Q,ee,he,je){return Ba({text:Q,raw:O.slice(D,B),span:{start:D,end:B},provenance:ee,quoted:he,...je?{parts:je}:{}})}function ln(O){return Object.freeze({...O,span:Object.freeze(O.span),issues:Object.freeze(O.issues.map((D)=>Object.freeze({...D}))),nodes:Object.freeze(O.nodes.map((D)=>{if(D.kind==="command")return lb(D);if(D.kind==="group"||D.kind==="function")return Object.freeze({...D,span:Object.freeze(D.span),body:ln(D.body)});return Object.freeze({...D,span:Object.freeze(D.span)})}))})}function $a(O,D,B){if(D>=B||rd(O[D]??""))return null;let Q="",ee=!1,he=!1,je=D;while(je<B&&!rd(O[je]??"")){let at=O[je]??"";if(at==="'"){ee=!0;let lt=nd(O,je+1,B,"'");Q+=lt.text,he||=!lt.closed,je=lt.next;continue}if(at==='"'){ee=!0;let lt=nd(O,je+1,B,'"');Q+=lt.text,he||=!lt.closed,je=lt.next;continue}if(at==="\\"){ee=!0;let lt=O[je+1];if(!lt||lt===`
-`||lt==="\r"){he=!0;break}Q+=lt,je+=2;continue}if(at==="`"||O.startsWith("$(",je)||O.startsWith("${",je)||O.startsWith("<(",je)||O.startsWith(">(",je))he=!0;Q+=at,je++}return{delimiter:Q,quoted:ee,next:je,ambiguous:he}}function Ua(O,D,B,Q){let ee=[],he=D;for(let je of Q){let at=he,lt=!1;while(he<B){let ct=cb(O,he,B);if((je.stripTabs?ct.text.replace(/^\t+/,""):ct.text)===je.delimiter){je.attach({body:je.stripTabs?ub(O.slice(at,he)):O.slice(at,he),delimiter:je.delimiter,quotedDelimiter:je.quotedDelimiter,bodySpan:{start:at,end:he},terminatorSpan:{start:he,end:ct.contentEnd}}),he=ct.next,lt=!0;break}if(ct.next<=he)break;he=ct.next}if(lt)continue;return ee.push({code:"unterminated-heredoc",message:`heredoc delimiter ${je.delimiter} was not found`}),{next:B,issues:ee,terminated:!1}}return{next:he,issues:ee,terminated:!0}}function nd(O,D,B,Q){let ee="",he=D;while(he<B&&O[he]!==`
-`&&O[he]!=="\r"){let je=O[he]??"";if(je===Q)return{text:ee,next:he+1,closed:!0};if(Q==='"'&&je==="\\"&&O[he+1]){let at=O[he+1]??"";ee+=["$","`",'"',"\\"].includes(at)?at:`\\${at}`,he+=2;continue}ee+=je,he++}return{text:ee,next:he,closed:!1}}function rd(O){return O!=="\r"&&(/[\s;&|<>)]/u.test(O)||O==="`")}function cb(O,D,B){let Q=D;while(Q<B&&O[Q]!==`
-`)Q++;let ee=Q>=B?B:Q+1;return{text:O.slice(D,Q),contentEnd:Q,next:ee}}function ub(O){return O.replace(/(^|\r\n?|\n)\t+/g,"$1")}var ad=new Set(["&&","||","|","|&"]);function ld(O,D){let B={start:0,end:O.length};if(O.length>D.maxInputLength)return ln({kind:"program",dialect:"posix",source:O,span:B,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${D.maxInputLength} UTF-16 code units`}],nodes:[]});let Q=Ni(O,0,O.length,D,{used:0,max:D.maxWords},0);return ln({kind:"program",dialect:"posix",source:O,span:B,status:Gi(Q.issues,Q.limited),issues:Q.issues,nodes:Q.nodes})}function Ni(O,D,B,Q,ee,he,je){let at=[],lt=[],ct=Ii(),ut=[],ft=()=>{if(ct.words.length===0&&ct.redirections.length===0)return;let mt={start:ct.start,end:ct.end},pt=ct.words.map((gt)=>gt.text);ki(at,ct,{kind:"command",dialect:"posix",source:O.slice(mt.start,mt.end),span:mt,words:ct.words,redirections:ct.redirections,nested:ct.nested,displayText:lt.length>0&&at.length===0?O.slice(D,B):pt.join(" ")})},dt=D;while(dt<B){let mt=O[dt];if(!mt)break;if(je&&mt===je)return ft(),sd(at,lt),{nodes:at,issues:lt,next:dt+1,closed:!0,limited:!1,pendingHeredocs:ut};if(Wi(mt)){if(mt===`
+`)}function ye(O,D){if(O.decision.kind!=="deny")return;let B=D.includeEvidence?O.decision.evidence:void 0;return{reason:O.decision.reason,ruleId:O.decision.ruleId,intent:O.decision.intent,command:B?.command,segment:B?.segment,toolName:D.toolName,...O.configFallback?{configWarning:O.configFallback.reason}:{},...O.decision.ask?{ask:!0}:{}}}function P(O={}){return{reason:te,intent:"stop_and_explain",command:O.command,segment:O.segment??O.command,toolName:O.toolName}}function be(O){return Qg({...O,redact:z})}function Xe(O){return z(O instanceof Error?O.message:String(O))}import{types as eh}from"node:util";var th=new Set(["applypatch","patch"]),nh=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),rh=new Set(["grep","grepsearch","rg"]),oh=new Set(["find","findbyname","glob"]),ih=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),sh=new Set(["command","diff","input","patch","patchtext"]),Uc=new TextEncoder,ah=new TextDecoder,lh=/\s/,ch=64;class f extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var po=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function qc(O){return O.replace(/[-_\s]/g,"").toLowerCase()}function ui(O){return ih.has(qc(O))}function V(O){let D=qc(O);if(th.has(D))return"patch";if(rh.has(D))return"grep";if(oh.has(D))return"glob";if(nh.has(D))return"path";return"unknown"}function ne(O){if(!O||typeof O!=="object")return;tu(O);let D=Object.getOwnPropertyDescriptor(O,"command");if(!D){if("command"in O)Gn();return}if(D.get||D.set)Gn();let B=D.value;return typeof B==="string"&&B!==""?B:void 0}function Yc(O,D){return Zc(O,D,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Zc(O,D,B,Q){let ee=eu(O,B,Q);if(!ee)return[];let he=ee.entries.flatMap(([je,at])=>{let lt=Zc(at,D,B,Q+1);return typeof at==="string"&&D.has(Xc(je))?[at]:lt});return B.ancestors.delete(ee.object),he}function Xc(O){return O.replace(/-/g,"_").toLowerCase()}function Jc(O){return Qc(O,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(dh)}function Qc(O,D,B,Q){let ee=eu(O,B,Q);if(typeof O==="string")return D?[O]:[];if(!ee)return[];let he=ee.entries.flatMap(([je,at])=>Qc(at,ee.array?D:sh.has(Xc(je)),B,Q+1));return B.ancestors.delete(ee.object),he}function uh(O,D,B){if(D.nodes++,O!==null&&typeof O==="object"&&B>po.maxDepth||D.nodes>po.maxNodes)Gn();if(typeof O!=="string")return;let Q=Buffer.byteLength(O);if(D.stringBytes+=Q,Q>po.maxStringBytes||D.stringBytes>po.maxAggregateStringBytes)Gn()}function eu(O,D,B){if(uh(O,D,B),!O||typeof O!=="object")return null;let Q=tu(O);if(D.ancestors.has(O))Gn();let ee=Reflect.ownKeys(O);if(D.keys+=ee.length,D.keys>po.maxKeys)Gn();let he=ee.flatMap((je)=>{let at=Object.getOwnPropertyDescriptor(O,je);if(!at||at.get||at.set)Gn();return typeof je==="string"&&at.enumerable?[[je,at.value]]:[]});return D.ancestors.add(O),{object:O,array:Q,entries:he}}function tu(O){if(eh.isProxy(O))Gn();let D=Array.isArray(O),B=Object.getPrototypeOf(O);if(D&&B!==Array.prototype||!D&&B!==Object.prototype&&B!==null)Gn();return D}function Gn(){throw new f}function dh(O){let D=[],B=O.split(/\r?\n/),Q=!1,ee=!1,he=null,je=null,at=()=>{ee=!1,he=null,je=null};for(let lt=0;lt<B.length;lt++){let ct=B[lt]??"";if(ct==="*** Begin Patch"){Q=!0,at();continue}if(ct==="*** End Patch"){Q=!1,at();continue}if(ct.startsWith("@@")){let ut=fh(ct);if(ee=!0,he=ut?.oldLines??null,je=ut?.newLines??null,he===0&&je===0)at();continue}if(ee&&he!==null&&je!==null){let ut=ct.startsWith(" ")||ct.startsWith("-")?1:0,ft=ct.startsWith(" ")||ct.startsWith("+")?1:0;if(he=Math.max(0,he-ut),je=Math.max(0,je-ft),he===0&&je===0)at();continue}if(ct.startsWith("*** ")){at(),D.push(...na(ct));continue}if(ee)continue;if(ct.startsWith("diff --git ")){D.push(...na(ct));continue}if(ct.startsWith("--- ")){let ut=B[lt+1]??"";if(!ut.startsWith("+++ "))continue;D.push(...oa(ci(ct.slice(4),!0),ci(ut.slice(4),!0))),lt++;continue}if(!Q)D.push(...na(ct))}return D}function fh(O){let D=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(O);if(!D)return null;return{oldLines:Number(D[1]??1),newLines:Number(D[2]??1)}}function na(O){let D=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(O);if(D?.[1])return Kc(D[1]);let B=/^\*\*\* Move to: (.+)$/.exec(O);if(B?.[1])return Kc(B[1]);if(O.startsWith("diff --git "))return mh(O.slice(11));let Q=/^--- (.+)$/.exec(O);if(Q?.[1])return Vc(Q[1]);let ee=/^\+\+\+ (.+)$/.exec(O);if(ee?.[1])return Vc(ee[1]);let he=/^(?:rename|copy) (?:from|to) (.+)$/.exec(O);if(he?.[1])return Ch(he[1]);return[]}function mh(O){let D=ph(O);if(D.length===2&&D[0]&&D[1])return oa(D[0],D[1]);let B=gh(O);return B?oa(O.slice(B.oldStart,B.oldEnd),O.slice(B.newStart,B.newEnd)):[]}function ph(O){let D=[],B=0;while(B<O.length&&D.length<2){while(dr(O[B]))B++;if(B>=O.length)break;let Q=O[B]==='"'||O[B]==="'"?O[B]:void 0;if(!Q){let he=B;while(B<O.length&&!dr(O[B]))B++;D.push(O.slice(he,B));continue}let ee=nu(O,B,Q);if(!ee)return[];D.push(ee.value),B=ee.end}while(dr(O[B]))B++;return B===O.length?D:[]}function gh(O){let D=0;while(D<O.length&&dr(O[D]))D++;let B=O.length;while(B>D&&dr(O[B-1]))B--;let Q=0,ee=D;while(ee<B){if(!dr(O[ee])){ee++;continue}let he=ee;while(ee<B&&dr(O[ee]))ee++;if(he===D||ee===B)continue;if(Q++,Q>ch)Gn();if(hh(O,D,he,ee,B))return{oldStart:D,oldEnd:he,newStart:ee,newEnd:B}}return null}function hh(O,D,B,Q,ee){if(ra(O,D,B,Q,ee))return!0;let he=Hc(O,"/",D,B),je=Hc(O,"/",Q,ee);if(he<=D||je<=Q)return!1;if(ra(O,D,he,Q,je))return!1;return ra(O,he+1,B,je+1,ee)}function ra(O,D,B,Q,ee){if(B-D!==ee-Q)return!1;for(let he=0;he<B-D;he++)if(O[D+he]!==O[Q+he])return!1;return!0}function Hc(O,D,B,Q){for(let ee=B;ee<Q;ee++)if(O[ee]===D)return ee;return-1}function dr(O){return O!==void 0&&lh.test(O)}function nu(O,D,B){let Q=[],ee=D+1;while(ee<O.length){let he=String.fromCodePoint(O.codePointAt(ee)??0);if(he===B)return{value:ah.decode(Uint8Array.from(Q)),end:ee+1};if(he!=="\\"||B==="'"){Q.push(...Uc.encode(he)),ee+=he.length;continue}let je=O.slice(ee+1),at=/^[0-7]{1,3}/.exec(je)?.[0];if(at){Q.push(Number.parseInt(at,8)),ee+=at.length+1;continue}Q.push(...Uc.encode(yh(je[0]??""))),ee+=2}return null}function yh(O){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[O]??O}function bh(O){return go(vh(O))}function oa(O,D){if(O==="/dev/null")return jc(D);if(D==="/dev/null")return jc(O);if(O.startsWith("a/")&&D.startsWith("b/"))return[O.slice(2),D.slice(2)].flatMap(go);let B=Sh(O,D)??(O===D?ru(O):null);return[O,D,...B?[B]:[]].flatMap(go)}function jc(O){let D=ru(O);return[O,...D?[D]:[]].flatMap(go)}function ru(O){let D=O.indexOf("/");return D>0&&D<O.length-1?O.slice(D+1):null}function Sh(O,D){let B=O.indexOf("/"),Q=D.indexOf("/");if(B<1||Q<1)return null;if(O.slice(0,B)===D.slice(0,Q))return null;let ee=O.slice(B+1);return ee===D.slice(Q+1)?ee:null}function Vc(O){return bh(ci(O,!0))}function Ch(O){return go(ci(O,!1))}function ci(O,D){let B=O.trim(),Q=B[0]==='"'||B[0]==="'"?B[0]:void 0;if(Q){let ee=nu(B,0,Q);if(ee&&(D||B.slice(ee.end).trim()===""))return ee.value}return D?B.split("\t",1)[0]?.trim()??"":B}function vh(O){return O.startsWith("a/")||O.startsWith("b/")?O.slice(2):O}function go(O){return O===""||O==="/dev/null"?[]:[O]}function Kc(O){let D=O.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return D===""||D==="/dev/null"?[]:[D]}function ce(O){try{if(!xh(O).isDirectory())return!1;return Eh(O,ou.R_OK|ou.X_OK),!0}catch{return!1}}function et(O,D,B){if(Qn(O))return;let Q=D.flatMap((he)=>iu(he,B));if(!Q[0])return;let ee=iu(su(O)?O:_h(Q[0],O),B)[0];if(!ee)return;return Q.some((he)=>Ph(ee,he))?ee:void 0}function iu(O,D){let B=D.realpath(O);if(B===null)return[];return D.isDirectory(B)?[B]:[]}function Ph(O,D){let B=Rh(D,O);return B===""||B!==".."&&!B.startsWith(`..${wh}`)&&!su(B)}var Ah=8388608;async function We(O){let D=[],B=0;for await(let Q of O){let ee=typeof Q==="string"?Buffer.from(Q,"utf-8"):Buffer.from(Q.buffer,Q.byteOffset,Q.byteLength);if(B+=ee.byteLength,B>Ah)throw Th(O),Error("hook input byte limit exceeded");D.push(ee)}return Buffer.concat(D,B).toString("utf-8")}function Th(O){let D=O.destroy??O.cancel;if(!D)return;try{Promise.resolve(D.call(O)).catch(()=>{})}catch{}}function d(O,D,B,Q,ee){if(B.kind!=="command")return{toolName:O,input:D,route:B,context:Q};return{toolName:O,input:D,route:B,context:Q,command:ee}}var Gr=["fail_closed","paranoid_rm","paranoid_interpreters"],di={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var o={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},fi=["standard","strict","paranoid"];function Ih(O,D){if(!D)return O;return fi.indexOf(D)>fi.indexOf(O)?D:O}function kh(O){let D=ve(o.level,O);if(D===void 0||D==="")return;if(fi.includes(D))return D;console.error(`CC Safety Net: ignored invalid ${o.level.name}=${JSON.stringify(D.slice(0,40))}. Use ${fi.join(", ")}.`);return}function He(O){if(O===void 0||O==="all")return"all";if(O==="blocked")return"blocked";return"invalid"}function xe(O){return He(ve(o.auditScope,O))==="all"}function ia(O){if(O.failClosed&&O.paranoidRm&&O.paranoidInterpreters)return"paranoid";if(O.failClosed&&!O.paranoidRm&&!O.paranoidInterpreters)return"strict";if(!O.failClosed&&!O.paranoidRm&&!O.paranoidInterpreters)return"standard";return"custom"}function R(O={},D){let B=O.safety?.level??"standard",Q=kh(D),ee=Ih(B,Q),he=di[ee],je={failClosed:he.fail_closed,paranoidRm:he.paranoid_rm,paranoidInterpreters:he.paranoid_interpreters},at={failClosed:ee===B?"preset":"environment",paranoidRm:ee===B?"preset":"environment",paranoidInterpreters:ee===B?"preset":"environment"},lt={failClosed:[`policy safety.level=${B}`],paranoidRm:[`policy safety.level=${B}`],paranoidInterpreters:[`policy safety.level=${B}`]};if(ee!==B)lt.failClosed.push(`env ${o.level.name}=${Q}`),lt.paranoidRm.push(`env ${o.level.name}=${Q}`),lt.paranoidInterpreters.push(`env ${o.level.name}=${Q}`);if(O.safety?.overrides?.failClosed!==void 0)je.failClosed=O.safety.overrides.failClosed,at.failClosed="capability_override",lt.failClosed.push("policy safety.overrides.fail_closed");if(O.safety?.overrides?.paranoidRm!==void 0)je.paranoidRm=O.safety.overrides.paranoidRm,at.paranoidRm="capability_override",lt.paranoidRm.push("policy safety.overrides.paranoid_rm");if(O.safety?.overrides?.paranoidInterpreters!==void 0)je.paranoidInterpreters=O.safety.overrides.paranoidInterpreters,at.paranoidInterpreters="capability_override",lt.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(L(o.strict,D))je.failClosed=!0,at.failClosed="environment",lt.failClosed.push(`env ${o.strict.name}`);if(L(o.paranoid,D))je.paranoidRm=!0,je.paranoidInterpreters=!0,at.paranoidRm="environment",at.paranoidInterpreters="environment",lt.paranoidRm.push(`env ${o.paranoid.name}`),lt.paranoidInterpreters.push(`env ${o.paranoid.name}`);if(L(o.paranoidRm,D))je.paranoidRm=!0,at.paranoidRm="environment",lt.paranoidRm.push(`env ${o.paranoidRm.name}`);if(L(o.paranoidInterpreters,D))je.paranoidInterpreters=!0,at.paranoidInterpreters="environment",lt.paranoidInterpreters.push(`env ${o.paranoidInterpreters.name}`);let ct=!!O.worktreeMode||L(o.worktree,D);return{strict:je.failClosed,paranoidRm:je.paranoidRm,paranoidInterpreters:je.paranoidInterpreters,worktreeMode:ct,effectiveLevel:ia(je),capabilities:{fail_closed:{enabled:je.failClosed,source:at.failClosed,sources:lt.failClosed},paranoid_rm:{enabled:je.paranoidRm,source:at.paranoidRm,sources:lt.paranoidRm},paranoid_interpreters:{enabled:je.paranoidInterpreters,source:at.paranoidInterpreters,sources:lt.paranoidInterpreters}}}}function L(O,D){let B=typeof O==="string"?ho(O,D):ve(O,D);return B==="1"||B?.toLowerCase()==="true"}function ho(O,D){return D.get(O)}function ve(O,D){let B=ho(O.name,D);if(B!==void 0)return B;if(O.legacyName)return ho(O.legacyName,D);return}function Qe(O,D){return ho(O.name,D)!==void 0||!!O.legacyName&&ho(O.legacyName,D)!==void 0}import{dirname as hr}from"node:path";import{closeSync as Oh,constants as yo,fstatSync as sa,fsyncSync as Mh,lstatSync as vn,mkdirSync as au,openSync as lu,readdirSync as la,readFileSync as Dh,realpathSync as Fr,renameSync as Nh,rmdirSync as cu,statSync as aa,unlinkSync as ca,writeFileSync as Lh}from"node:fs";import{isAbsolute as uu,join as fr,normalize as Wh,parse as mi,relative as ua,resolve as da,sep as pi}from"node:path";function Re(){let O=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${O()}${O()}`}var Gh=Symbol("PolicyFilesystemScope"),Fh=Symbol("PolicyFilesystemTarget"),du=yo.O_NOFOLLOW??0;class r extends Error{name="PolicyFilesystemError";constructor(O){super(`Unable to access ${O} filesystem safely.`)}}function v(O,D){return{[Gh]:!0,root:da(O),label:D}}function bo(O,D){let B=Wh(D);if(D===""||uu(D)||B===".."||B.startsWith(`..${pi}`))throw new r(O.label);return{[Fh]:!0,scope:O,relativePath:B,path:fr(O.root,B)}}function i(O,D){return bo(O,ua(O.root,da(D)))}function re(O,D="rules policy"){let B=da(O),Q=mi(B).dir;return bo(v(Q,D),ua(Q,B))}function n(O){return $n(O.scope.label,()=>{if(!Zt(O))return null;let D=lu(O.path,yo.O_RDONLY|du);return mu(D,()=>{let B=sa(D);if(!B.isFile())throw new r(O.scope.label);let Q=Dh(D,"utf-8"),ee=vn(O.path);if(!ee.isFile()||ee.isSymbolicLink()||B.dev!==ee.dev||B.ino!==ee.ino)throw new r(O.scope.label);return Zt(O),Q})})}function g(O,D,B=384,Q){let ee=`${O.path}.${Re()}.tmp`;$n(O.scope.label,()=>{Bh(O),Zt(O);let he=lu(ee,yo.O_CREAT|yo.O_EXCL|yo.O_WRONLY|du,B),je=mu(he,()=>{let at=sa(he);if(!at.isFile())throw new r(O.scope.label);Lh(he,D,"utf-8"),Mh(he);let lt=sa(he);if(!lt.isFile()||lt.dev!==at.dev||lt.ino!==at.ino)throw new r(O.scope.label);return lt});Zt(O),Uh(O,ee,je.dev,je.ino),Nh(ee,O.path),Q?.(O.path),Zt(O)},()=>Hh(ee))}function fu(O,D){if(O.path===D.path)return!0;return $n(O.scope.label,()=>{if(!Zt(O)||!Zt(D))return!1;let B=(Q)=>fr(Fr(mi(Q).dir),mi(Q).base);return B(O.path)===B(D.path)})}function le(O){let D=$n(O.scope.label,()=>{if(!Zt(O,"directory"))return null;let B=la(O.path);return Zt(O,"directory"),B});if(!D)return null;return $n(O.scope.label,()=>{let B=D.map((Q)=>{let ee=bo(O.scope,fr(O.relativePath,Q)),he=vn(ee.path);if(he.isSymbolicLink()||!he.isFile()&&!he.isDirectory())throw new r(O.scope.label);return gi(fa(O.scope),Fr(ee.path),O.scope.label),{name:Q,kind:he.isDirectory()?"directory":"file"}});return Zt(O,"directory"),B})}function N(O){$n(O.scope.label,()=>{if(!Zt(O))return;ca(O.path),Zt(O)})}function tt(O){$n(O.scope.label,()=>{if(!zh(O))return;gu(O),Zt(O,"directory")})}function nt(O){$n(O.scope.label,()=>{if(!Zt(O,"directory"))return;cu(O.path),Zt(O,"directory")})}function zh(O){return $n(O.scope.label,()=>{if(!Zt(O,"directory"))return!1;return pu(O),!0})}function $n(O,D,B){try{return D()}catch(Q){if(B?.(),Q instanceof r)throw Q;throw new r(O)}}function mu(O,D){try{return D()}finally{Oh(O)}}function Zt(O,D="file"){let B=hu(O.scope);if(!B)return!1;let Q=O.relativePath.split(pi);for(let ee of Q.keys()){let he=fr(O.scope.root,...Q.slice(0,ee+1)),je=vn(he,{throwIfNoEntry:!1});if(!je)return!1;if(je.isSymbolicLink())throw new r(O.scope.label);if(ee<Q.length-1&&!je.isDirectory())throw new r(O.scope.label);if(ee===Q.length-1&&(D==="file"?!je.isFile():!je.isDirectory()))throw new r(O.scope.label);gi(B,Fr(he),O.scope.label)}return!0}function pu(O){for(let D of la(O.path)){let B=bo(O.scope,fr(O.relativePath,D)),Q=vn(B.path);if(Q.isSymbolicLink()||!Q.isDirectory()&&!Q.isFile())throw new r(O.scope.label);if(Q.isDirectory())pu(B)}Zt(O,"directory")}function gu(O){for(let D of la(O.path)){let B=bo(O.scope,fr(O.relativePath,D)),Q=vn(B.path);if(Q.isSymbolicLink())throw new r(O.scope.label);if(Q.isDirectory()){gu(B);continue}if(!Q.isFile())throw new r(O.scope.label);ca(B.path)}cu(O.path)}function Bh(O){$h(O.scope);let D=fa(O.scope),B=O.relativePath.split(pi).slice(0,-1);for(let Q of B.keys()){let ee=fr(O.scope.root,...B.slice(0,Q+1));if(!vn(ee,{throwIfNoEntry:!1}))au(ee,{mode:448});let he=vn(ee);if(!he.isDirectory()||he.isSymbolicLink())throw new r(O.scope.label);gi(D,Fr(ee),O.scope.label)}}function $h(O){if(vn(O.root,{throwIfNoEntry:!1})){if(!aa(O.root).isDirectory())throw new r(O.label);return}let D=[],B=O.root;while(!vn(B,{throwIfNoEntry:!1})){D.unshift(B);let Q=mi(B).dir;if(Q===B)throw new r(O.label);B=Q}if(!aa(B).isDirectory())throw new r(O.label);for(let Q of D){au(Q,{mode:448});let ee=vn(Q);if(!ee.isDirectory()||ee.isSymbolicLink())throw new r(O.label)}}function hu(O){if(!vn(O.root,{throwIfNoEntry:!1}))return null;if(!aa(O.root).isDirectory())throw new r(O.label);return Fr(O.root)}function fa(O){let D=hu(O);if(!D)throw new r(O.label);return D}function Uh(O,D,B,Q){let ee=vn(D);if(!ee.isFile()||ee.isSymbolicLink()||ee.dev!==B||ee.ino!==Q)throw new r(O.scope.label);gi(fa(O.scope),Fr(D),O.scope.label)}function gi(O,D,B){let Q=ua(O,D);if(Q===".."||Q.startsWith(`..${pi}`)||uu(Q))throw new r(B)}function Hh(O){try{ca(O)}catch{}}import{dirname as mr,isAbsolute as Yh,join as gr,relative as Zh,resolve as pr,sep as Xh}from"node:path";var l=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,ue="rulebook.json",de=".cc-safety-net/rules";var yu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,jh=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,bu=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Vh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Kh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),rt=new RegExp(`^${Vh}/(${l.source.slice(1,-1)})/${Kh}$`);function qh(O){return`.cc-safety-net/rules/${O}/rulebook.json`}function Su(O){if(S(O))try{return A(O),null}catch(D){return D instanceof Error?D.message:String(D)}return l.test(O)?null:`Local rulebook sources must be bare names matching ${l}: ${O}`}function A(O){if(O.startsWith("github:"))throw Error(`Invalid rulebook source: ${O}`);let D=O.match(yu);if(!D?.[1]||!D[2]||!D[3])throw Error(`Invalid GitHub rulebook source: ${O}`);let B=D[3].lastIndexOf("/");if(B<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${O}`);let Q=D[3].slice(0,B),ee=D[3].slice(B+1);if(!Q||!bu.test(Q))throw Error(`GitHub rulebook refs must use valid path segments: ${O}`);if(!ee||!l.test(ee))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${O}`);return{owner:D[1],repo:D[2],ref:Q,path:qh(ee),name:ee}}function q(O){return jh.test(O)}function oe(O){return bu.test(O)}function S(O){return yu.test(O)}function ot(O){if(!l.test(O))throw Error(`Local rulebook sources must be bare names matching ${l}: ${O}`)}var Cu="rule.json",hi="policy.json",vu=".cc-safety-net",Jh="rules",Qh="CC_SAFETY_NET_HOME",Eu="`cc-safety-net rule update`";function ey(O){return pr(O,de)}function F(O){return gr(ey(O),Cu)}function b(O){return gr(pr(O),vu,hi)}function Se(O,D={}){return D.userConfigDir??(D.userConfigPath?mr(D.userConfigPath):gr(ty(O),Jh))}function ty(O){let D=O.env.get(Qh);return D?pr(pn(D)):gr(O.home,vu)}function M(O,D={}){return gr(Se(O,D),Cu)}function u(O,D={}){return gr(mr(Se(O,D)),hi)}function K(O,D){let B=D.userConfigPath??M(O,D),Q=D.projectConfigPath??F(D.cwd),ee=Be(O,D),he=ze(Q,D.cwd);return{userConfigPath:B,projectConfigPath:Q,userScope:ee,projectScope:he,userConfigTarget:i(ee,B),projectConfigTarget:i(he,Q)}}function Be(O,D){let B=D.userConfigPath?mr(mr(pr(D.userConfigPath))):mr(pr(D.userConfigDir??Se(O,D)));return v(B,"user policy")}function ze(O,D){let B=pr(D),Q=pr(O),ee=Zh(B,Q);if(ee!==".."&&!ee.startsWith(`..${Xh}`)&&!Yh(ee))return v(B,"project policy");return v(mr(mr(Q)),"project policy")}function I(O,D){return gr(O,D,ue)}var gn=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),w=/^[a-zA-Z][a-zA-Z0-9_-]*$/,T=256,Kt=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),xu=new Set(["python","python3","python2","node","ruby","perl"]),yi=/^python(?:[23](?:\.\d+)*)?$/,En=new Set(["awk","gawk","nawk","mawk"]),bi=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Ru="Rulebook exceeds CC Safety Net's safe validation limits.",_u="Additional rulebook validation errors were omitted.",Pn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function wu(O){if(ma(O.allowed_commands,Pn.maxAllowedCommands)||ma(O.rules,Pn.maxRules)||ma(O.tests,Pn.maxTests))return!1;let{maxAggregateStringCodeUnits:D,maxTotalBlockArgs:B}=Pn,Q=(ee,he=!1)=>{if(typeof ee!=="string")return!0;if(ee.length>Pn.maxStringCodeUnits||he&&ee.length>Pn.maxFixtureCommandCodeUnits||ee.length>D)return!1;return D-=ee.length,!0};if(!Q(O.name)||!Q(O.version)||!Q(O.description)||!Q(O.author)||!Q(O.migrated_from))return!1;if(Array.isArray(O.allowed_commands)){for(let ee of O.allowed_commands)if(!Q(ee))return!1}if(Array.isArray(O.rules))for(let ee of O.rules){if(!ee||typeof ee!=="object")continue;let he=ee;if(!Q(he.name)||!Q(he.command)||!Q(he.subcommand)||!Q(he.reason)||!Q(he.intent))return!1;let je=he.match&&typeof he.match==="object"?he.match:{};for(let at of[he.block_args,je.command_path,je.any_args,je.exclude_args]){if(!Array.isArray(at))continue;if(at.length>Pn.maxBlockArgsPerRule||at.length>B)return!1;B-=at.length;for(let lt of at)if(!Q(lt))return!1}}if(Array.isArray(O.tests))for(let ee of O.tests){if(!ee||typeof ee!=="object")continue;let he=ee;if(!Q(he.command,!0)||!Q(he.expect)||!Q(he.rule))return!1}return!0}function ma(O,D){return Array.isArray(O)&&O.length>D}var pa=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var pe=64,fe="Rule config exceeds CC Safety Net's safe source limit.";function kt(O){return Tt(O).toLowerCase()}function Tt(O){return O.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??O}function an(O,D){let B=new Set,Q=!1;for(let ee of O){if(ee==="--"){Q=!0;continue}if(Q)continue;if(ee.startsWith("-")&&!ee.startsWith("--")&&ee.length>1)for(let he=1;he<ee.length;he++){let je=ee[he];if(!je||!/[a-zA-Z]/.test(je))break;let at=`-${je}`;if(B.add(at),D?.shortOptsWithValue?.has(at))break}}return B}var ny={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ga=new Set(["--init-file","--rcfile"]);function ha(O,D,B,Q){let ee=!1,he=0,je=!1,at=!1,lt=!1;for(let ct=1;ct<D.length;ct++){let ut=D[ct];if(ut===void 0)break;if(O==="ksh"&&ut==="o"&&ct+1<D.length){if(Q==="argv"){let ft=D.slice(ct+1);if(D[0]==="-"&&(ft==="c"||ft[0]==="-"&&ft.endsWith("c")))je=!0}break}if(O==="ksh"&&ut==="o"&&ct+1===D.length&&(B?.startsWith("-")||B?.startsWith("+")))break;if(O==="zsh"&&ut==="o"&&ct+1<D.length)break;if(Q==="startup"&&ut==="i")ee=D[0]==="-";if(Q==="argv"&&D[0]==="-"&&ut==="c")je=!0;if(Q==="argv"&&ut==="n")lt=D[0]==="-";if(Q==="argv"&&ut==="s")at=D[0]==="-";if(!ny[O]?.includes(ut))continue;if(ct+1===D.length)he++;break}return{interactive:ee,followingValues:he,commandSelected:je,stdinMode:at,syntaxCheck:lt}}function hn(O){let D=Tt(O[0]??"").toLowerCase(),B=!1,Q=!1,ee=!1;for(let he=1;he<O.length;he++){let je=O[he];if(je===void 0)break;if(je==="--"){let lt=B&&O[he+1]!==void 0?he+1:null;return{command:lt===null?null:O[lt]??null,commandIndex:lt,scriptIndex:!B&&!Q&&O[he+1]!==void 0?he+1:null,readsStdinAsCommands:!B&&(Q||O[he+1]===void 0),syntaxCheck:ee}}if(je==="-"||je[0]!=="-"&&je[0]!=="+")return{command:B?je:null,commandIndex:B?he:null,scriptIndex:!B&&!Q&&je!=="-"?he:null,readsStdinAsCommands:!B&&(Q||je==="-"),syntaxCheck:ee};if(je.startsWith("--")){let lt=je.split("=",1)[0]??je;if(D==="bash"&&ga.has(lt)&&!je.includes("="))he++;continue}let at=ha(D,je,O[he+1],"argv");if(at.commandSelected)B=!0;if(at.syntaxCheck)ee=!0;if(at.stdinMode)Q=!0;he+=at.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!B,syntaxCheck:ee}}function So(O,D){if(D.escaped)return D.escaped=!1,!0;if(O==="\\"&&!D.inSingle)return D.escaped=!0,!0;if(O==="'"&&!D.inDouble)return D.inSingle=!D.inSingle,!0;if(O==='"'&&!D.inSingle)return D.inDouble=!D.inDouble,!0;return!1}function Si(O){let D={inSingle:!1,inDouble:!1,escaped:!1};for(let B of ry(O))So(B,D);return D.inSingle||D.inDouble}function ry(O){let D="",B={inSingle:!1,inDouble:!1,escaped:!1},Q=!1,ee=!0;for(let he=0;he<O.length;he++){let je=O[he];if(!je)break;if(Q){if(je===`
+`||je==="\r")D+=je,Q=!1,B.escaped=!1;continue}if(je==="#"&&!B.inSingle&&!B.inDouble&&ee){Q=!0;continue}if(D+=je,!B.inSingle&&!B.inDouble&&!B.escaped)ee=/[\s;&|()<>]/.test(je);So(je,B)}return D}var ya=new Set(["rm","find","xargs","parallel"]),oy=new Set(["git","busybox",...ya,...Kt,...xu,...En]),iy=new Set(["python","node","ruby","perl"]);function Le(O){let D=kt(O);return oy.has(D)||An(D)}function An(O){return iy.has(sy(O))}function sy(O){let D=Tt(O).toLowerCase();return yi.test(D)?"python":D}var it={version:1,rules:[],overrides:{},transparent_wrappers:[]};function m(O){try{let D=n(ay(O));if(D===null)return{config:null,errors:[]};if(!D.trim())return{config:null,errors:["Config file is empty"]};let B=JSON.parse(D),Q=Ve(B);if(Q.errors.length>0)return{config:null,errors:Q.errors};return{config:{version:1,rules:B.rules??[],overrides:B.overrides??{},transparent_wrappers:B.transparent_wrappers??[]},errors:[]}}catch(D){if(D instanceof r)return{config:null,errors:[D.message]};let B=D instanceof Error?D.message:String(D);return{config:null,errors:[D instanceof SyntaxError?"Invalid JSON":B]}}}function ay(O){return typeof O==="string"?re(O):O}var e=(O,D)=>({path:O,message:D,kind:"typed"}),Xt=(O,D)=>({path:O,message:D,kind:"custom"});function Te(O){let D=new Set;return O.flatMap((B,Q)=>{let ee=zr(B)?B.name:void 0;if(typeof ee!=="string")return[];if(D.has(ee.toLowerCase()))return[Xt(["rules",Q,"name"],`duplicate rule name "${ee}"`)];return D.add(ee.toLowerCase()),[]})}var we=`must be one of ${pa.join(", ")}`,ly=/^[^/]+\/[^/]+$/,cy=["version","rules","overrides","transparent_wrappers"];function Ve(O){let D=uy(O);return{errors:ie(qe(D,cy,(B)=>B.kind==="custom"),": "," "),sources:by(O,D)}}function uy(O){if(!zr(O))return[e([],"Config must be an object")];let D=Array.isArray(O.rules)&&O.rules.length>pe;return[...O.version===1?[]:[e(["version"],"must be 1")],...dy(O.rules,D),...py(O.overrides),...hy(O.transparent_wrappers),...D?[]:my(O.rules),...zr(O.overrides)?Object.keys(O.overrides).filter((B)=>!ly.test(B)).map((B)=>Xt(["overrides",B],"must use <rulebook-name>/<rule-name>")):[],...yy(O.transparent_wrappers)]}function dy(O,D){if(O===void 0)return[];if(!Array.isArray(O))return[e(["rules"],"must be an array of rulebook source strings"),...Pu(O,pe)?[e(["rules"],fe)]:[]];if(D)return[{path:["rules"],message:fe,kind:"limit"}];return O.flatMap((B,Q)=>{if(typeof B!=="string")return[e(["rules",Q],"must be a rulebook source string"),...fy(B,1)?[e(["rules",Q],"must be a non-empty rulebook source string")]:[]];return B===""?[e(["rules",Q],"must be a non-empty rulebook source string")]:[]})}function Pu(O,D){let B=Au(O);return B!==void 0&&!(B<=D)}function fy(O,D){let B=Au(O);return B!==void 0&&!(B>=D)}function Au(O){if(O===null||O===void 0)return;let D=O.length;return D===void 0?void 0:Number(D)}function my(O){if(!Array.isArray(O))return[];let D=new Set;return O.flatMap((B,Q)=>{if(typeof B!=="string"||B==="")return[];if(B.trim()==="")return[Xt(["rules",Q],"must be a non-empty rulebook source string")];let ee=Su(B);if(ee)return[Xt(["rules",Q],ee)];if(D.has(B))return[Xt(["rules",Q],`duplicate rulebook source "${B}"`)];return D.add(B),[]})}function py(O){if(O===void 0)return[];if(!zr(O))return[e(["overrides"],"must be an object if provided")];return Object.keys(O).flatMap((D)=>{let B=O[D];if(B==="off")return[];if(!zr(B))return[e(["overrides",D],'must be "off" or an object')];return[...gy(B.reason,["overrides",D,"reason"]),...B.intent===void 0||Ce(B.intent)?[]:[e(["overrides",D,"intent"],we)]]})}function gy(O,D){if(typeof O!=="string")return[e(D,"required non-empty string"),...Pu(O,T)?[e(D,`must be at most ${T} characters`)]:[]];if(O==="")return[e(D,"required non-empty string")];return O.length>T?[e(D,`must be at most ${T} characters`)]:[]}function hy(O){if(O===void 0)return[];if(!Array.isArray(O))return[e(["transparent_wrappers"],"must be an array of command strings")];return O.flatMap((D,B)=>{if(typeof D!=="string")return[e(["transparent_wrappers",B],"must be a command string")];return w.test(D)?[]:[e(["transparent_wrappers",B],"must match command pattern")]})}function yy(O){if(!Array.isArray(O))return[];let D=new Set;return O.flatMap((B,Q)=>{if(typeof B!=="string"||!w.test(B))return[];if(D.has(B))return[Xt(["transparent_wrappers",Q],`duplicate command "${B}"`)];if(Le(B))return[Xt(["transparent_wrappers",Q],`reserved command "${B}" cannot be a wrapper`)];return D.add(B),[]})}function by(O,D){let B=zr(O)?O.rules:void 0;if(!Array.isArray(B))return new Set;if(D.some((ee)=>ee.path.length===1&&ee.path[0]==="rules"))return new Set;let Q=new Set(D.filter((ee)=>ee.path[0]==="rules"&&typeof ee.path[1]==="number").map((ee)=>ee.path[1]));return new Set(B.filter((ee,he)=>typeof ee==="string"&&!Q.has(he)))}function qe(O,D,B){let Q=O.map((je)=>je.path[1]),ee=[...new Set(Q.filter((je)=>typeof je==="string"))],he=(je,at)=>[je.path.length===0?-1:D.indexOf(String(je.path[0])),typeof at==="number"?at:ee.indexOf(String(at)),B(je)?0:1];return O.map((je,at)=>({issue:je,rank:he(je,Q[at])})).sort((je,at)=>je.rank[0]-at.rank[0]||je.rank[1]-at.rank[1]||je.rank[2]-at.rank[2]).map((je)=>je.issue)}function ie(O,D,B){return[...new Set(O.map((Q)=>{let ee=ba(Q.path);if(Q.kind==="unknownKeys")return`${ee?`${ee}.`:""}unknown field "${Q.message}"`;if(Q.kind==="key"||Q.kind==="limit"||Q.path.length===0)return Q.message;return`${ee}${Q.path.length===1?B:D}${Q.message}`}))]}function ba(O){return O.map((D,B)=>{if(typeof D==="number")return`[${D}]`;return B===0?String(D):`.${String(D)}`}).join("")}function Ce(O){return pa.includes(O)}function zr(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function se(O){let D=vy(O);if(D.errors.length>0)throw Error(D.errors.join("; "));return O}var Sy=`required non-empty string up to ${T} characters`,Tu="must be a non-empty array of unique non-empty strings",Cy="required non-empty array of non-empty strings";function vy(O){if(!er(O))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!wu(O))return{errors:[Ru],ruleNames:new Set};let D=[...O.rulebook_version===1||O.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ie(Ey(O,O.rulebook_version===2),": ",": ")];return{errors:D.length>Pn.maxValidationErrors?[...D.slice(0,Pn.maxValidationErrors),_u]:D,ruleNames:new Set(_e(O).map((B)=>B.toLowerCase()))}}function _e(O){let D=er(O)?O.rules:void 0;return(Array.isArray(D)?D:[]).flatMap((B)=>{let Q=er(B)?B.name:void 0;return typeof Q==="string"?[Q]:[]})}function Ey(O,D){return[...typeof O.name==="string"&&l.test(O.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof O.version==="string"&&O.version!==""?[]:[e(["version"],"required non-empty string")],...xy(O.allowed_commands),...Ry(O.rules,D),...Ay(O.tests),...Ty(O),...Iy(O)]}function xy(O){if(!Array.isArray(O))return[e(["allowed_commands"],"required array")];let D=new Set;return[...O.flatMap((B,Q)=>typeof B==="string"&&w.test(B)?[]:[e(["allowed_commands",Q],"must match command pattern")]),...O.flatMap((B,Q)=>{if(typeof B!=="string"||!w.test(B))return[];if(D.has(B))return[Xt(["allowed_commands",Q],`duplicate command "${B}"`)];return D.add(B),[]})]}function Ry(O,D){if(!Array.isArray(O))return[e(["rules"],"required array")];return[...O.flatMap((B,Q)=>{if(!er(B))return[e(["rules",Q],"must be an object")];return D?wy(B,["rules",Q]):_y(B,["rules",Q])}),...Te(O)]}function _y(O,D){return[...Iu(O.name,D),...ku(O.command,D),...O.subcommand===void 0||typeof O.subcommand==="string"&&w.test(O.subcommand)?[]:[e([...D,"subcommand"],"must match command pattern")],...Ci(O.block_args,[...D,"block_args"],"required non-empty array",!1),...Ou(O.reason,D),...Mu(O.intent,D)]}function wy(O,D){return[...Iu(O.name,D),...ku(O.command,D),...Ou(O.reason,D),...Mu(O.intent,D),...Py(O.match,[...D,"match"]),...O.subcommand===void 0?[]:[e([...D,"subcommand"],"not supported in rulebook_version 2")],...O.block_args===void 0?[]:[e([...D,"block_args"],"not supported in rulebook_version 2")]]}function Iu(O,D){if(typeof O!=="string")return[e([...D,"name"],"required string")];return l.test(O)?[]:[e([...D,"name"],"must match rule name pattern")]}function ku(O,D){return typeof O==="string"&&w.test(O)?[]:[e([...D,"command"],"required string matching command pattern")]}function Ou(O,D){return typeof O==="string"&&O!==""&&O.length<=T?[]:[e([...D,"reason"],Sy)]}function Mu(O,D){return O===void 0||Ce(O)?[]:[e([...D,"intent"],we)]}function Py(O,D){if(!er(O))return[e(D,"required object")];return[...Ci(O.command_path,[...D,"command_path"],Cy,!1),...O.any_args===void 0?[]:Ci(O.any_args,[...D,"any_args"],Tu,!0),...O.exclude_args===void 0?[]:Ci(O.exclude_args,[...D,"exclude_args"],Tu,!0)]}function Ci(O,D,B,Q){if(!Array.isArray(O))return[e(D,B)];let ee=O.flatMap((he,je)=>{if(typeof he!=="string")return[e([...D,je],"must be a non-empty string")];return he===""?[Xt([...D,je],"must be a non-empty string")]:[]});if(O.some((he)=>typeof he!=="string"))return ee;return[...ee,...O.length===0?[Xt(D,B)]:[],...Q&&new Set(O).size!==O.length?[Xt(D,"must not contain duplicate values")]:[]]}function Ay(O){if(O===void 0)return[];if(!Array.isArray(O))return[e(["tests"],"must be an array if provided")];return O.flatMap((D,B)=>{if(!er(D))return[e(["tests",B],"must be an object")];return[...typeof D.command==="string"&&D.command.trim()!==""?[]:[e(["tests",B,"command"],"required non-empty string")],...D.expect==="blocked"||D.expect==="allowed"?[]:[e(["tests",B,"expect"],'must be "blocked" or "allowed"')],...D.rule===void 0||typeof D.rule==="string"?[]:[e(["tests",B,"rule"],"must be a string if provided")],...D.expect==="blocked"&&typeof D.rule!=="string"?[Xt(["tests",B,"rule"],"required string for blocked fixtures")]:[]]})}function Ty(O){if(!Array.isArray(O.tests))return[];let D=new Set(_e(O));return[...new Set(O.tests.flatMap((B)=>er(B)&&B.expect==="blocked"&&typeof B.rule==="string"?[B.rule]:[]))].filter((B)=>!D.has(B)).map((B)=>Xt(["tests"],`blocked fixture references unknown rule "${B}"`))}function Iy(O){if(!Array.isArray(O.allowed_commands)||!Array.isArray(O.rules))return[];let D=new Set(O.allowed_commands.filter((B)=>typeof B==="string"));return O.rules.flatMap((B,Q)=>{let ee=er(B)?B.command:void 0;if(typeof ee!=="string"||D.has(ee))return[];return[Xt(["rules",Q,"command"],`"${ee}" must be listed in allowed_commands`)]})}function er(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function J(O,D){let B=K(O,D),Q;try{Q=fu(B.userConfigTarget,B.projectConfigTarget)}catch(mt){if(mt instanceof r)return Fy(B,mt.message);throw mt}let ee=m(B.userConfigTarget),he=Q?{config:null,errors:[]}:m(B.projectConfigTarget),je=Nu(B.userConfigPath,ee.errors),at=Nu(B.projectConfigPath,he.errors),lt=new Set,ct=ee.config?Sa(ee.config,hr(B.userConfigPath),"user",B.userScope,lt):Lu(),ut=he.config?Sa(he.config,hr(B.projectConfigPath),"project",B.projectScope,lt):Lu(),ft=ee.config?.overrides??{},dt=he.config?.overrides??{};return{rules:[...Du(ct.rules,ft),...Du(ut.rules,dt)],transparent_wrappers:Wy(ee.config,he.config),rulebooks:[...ct.rulebooks,...ut.rulebooks],errors:[...je,...at,...ct.errors,...ut.errors],warnings:[...ct.warnings,...ut.warnings,...ct.canValidateOverrides?Ca(ft,ct.knownRuleIds,B.userConfigPath):[],...ct.canValidateOverrides?Gy(dt,ct.knownRuleIds,B.projectConfigPath):[],...ut.canValidateOverrides?Ca(dt,ut.knownRuleIds,B.projectConfigPath):[]],userConfig:ee.config??void 0,projectConfig:he.config??void 0,...B}}function j(O,D){let B=ky(O,D);if(!B)return[];return[...B.scope.errors,...B.scope.warnings,...Oy(B.config,B.scope,O)]}function ky(O,D){let B=D??v(hr(hr(O)),"rules policy"),Q=m(i(B,O)).config;if(!Q)return null;return{config:Q,scope:Sa(Q,hr(O),"project",B)}}function Oy(O,D,B){return D.canValidateOverrides?Ca(O.overrides??{},D.knownRuleIds,B):[]}function Sa(O,D,B,Q=v(hr(hr(D)),B==="user"?"user policy":"project policy"),ee=new Set){let he=[],je=[],at=O.rules.flatMap((ct)=>{let ut=Dy(ct,D,Q);if(ut.errors.length>0||!ut.rulebook)return he.push(...ut.errors),[];let ft=ut.rulebook;if(ee.has(ft.name))return je.push(`duplicate active rulebook name "${ft.name}" for ${ct}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return ee.add(ft.name),[{rules:My(ft),rulebook:{source:B,spec:ct,name:ft.name,version:ft.version,rules:ft.rules.map((dt)=>`${ft.name}/${dt.name}`)}}]}),lt=at.flatMap((ct)=>ct.rules);return{rules:lt,rulebooks:at.map((ct)=>ct.rulebook),knownRuleIds:new Set(lt.map((ct)=>ct.name)),errors:he,warnings:je,canValidateOverrides:he.length===0}}function My(O){if(O.rulebook_version===2)return O.rules.map((D)=>({name:`${O.name}/${D.name}`,command:D.command,block_args:[],match:D.match,reason:D.reason,intent:D.intent}));return O.rules.map((D)=>({...D,name:`${O.name}/${D.name}`,match:void 0}))}function Dy(O,D,B){let Q=Pe(O),ee=I(D,Q),he=Ly(ee,B);if("error"in he)return{rulebook:null,errors:[he.error]};if(he.content===null)return{rulebook:null,errors:[`missing rulebook file ${ee} for ${O}; ${Ny(O)}`]};let je=me(he.content);if("problem"in je)return{rulebook:null,errors:[`invalid rulebook ${ee}: ${je.problem}; fix that file`]};if(je.rulebook.name!==Q)return{rulebook:null,errors:[`rulebook name "${je.rulebook.name}" in ${ee} must match source "${O}"; fix that file`]};return{rulebook:je.rulebook,errors:[]}}function Pe(O){return S(O)?A(O).name:O}function Ny(O){return S(O)?`run ${Eu} to vendor ${O}`:"create that file or remove that source from the rules config"}function Ly(O,D){try{return{content:n(i(D,O))}}catch(B){if(B instanceof r)return{error:B.message};throw B}}function me(O){let D;try{D=JSON.parse(O)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:se(D)}}catch(B){return{problem:B instanceof Error?B.message:"invalid rulebook"}}}function Wy(O,D){return[...new Set([...O?.transparent_wrappers??[],...D?.transparent_wrappers??[]])]}function Du(O,D){return O.flatMap((B)=>{let Q=D[B.name];if(Q==="off")return[];if(Q&&typeof Q==="object")return[{...B,intent:Q.intent??B.intent,reason:Q.reason}];return[B]})}function Ca(O,D,B){return Object.keys(O).filter((Q)=>!D.has(Q)).map((Q)=>`unknown override key "${Q}" in ${B}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Gy(O,D,B){return Object.keys(O).filter((Q)=>D.has(Q)).map((Q)=>`project override cannot target user-scoped rule "${Q}" in ${B}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Nu(O,D){return D.map((B)=>B.startsWith("Unable to access ")?B:`${O}: ${B}`)}function Fy(O,D){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[D],warnings:[],userConfigPath:O.userConfigPath,projectConfigPath:O.projectConfigPath}}function Lu(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Zy,readFileSync as Xy}from"node:fs";var Wu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],va=new Set(Wu.map((O)=>O.id)),U=Wu,zy=new Map(U.map((O)=>[O.id,O.intent]));function St(O,D){return{id:O,reason:D,intent:zy.get(O)??"manual_only"}}var Ea=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],vi={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},By=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],$y=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],xa=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...$y.flatMap((O)=>By.map((D)=>({id:["secret.home",O.idSlug,D.slice(1)].join("."),category:"Home path",label:[O.label,D].join(""),description:["Blocks home ",O.label,D," credential backup files."].join(""),suffixParts:[...O.directoryParts,[O.basename,D].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Ei=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Gu=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Uy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Ra=Gu.map((O)=>({id:`secret.variant.${O.slug}.separator`,category:"Variant",label:`${O.label}-* / ${O.label}_*`,description:`Blocks ${O.label} variants with dash or underscore suffixes.`,prefix:O.prefix})),_a=Gu.flatMap((O)=>Uy.map((D)=>({id:`secret.variant.${O.slug}.${D.slice(1)}`,category:"Variant",label:`${O.label}${D}`,description:`Blocks ${O.label}${D} private credential variants.`,prefix:O.prefix,suffix:D}))),Co={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},wa=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((O)=>({id:`secret.ext.${O}`,category:"Extension",label:`.${O}`,description:`Blocks files with the .${O} extension.`,extension:O})),Pa=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Ke=[...Ea,vi,...xa,...Ra,..._a,Co,...wa,...Pa,...Ei].map((O)=>({id:O.id,category:O.category,label:O.label,...O.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in O?{paths:O.paths}:{description:O.description}})),xi=new Set(Ei.flatMap((O)=>O.category==="Coding CLI config"?[O.id]:[])),Aa=new Set(Ke.map((O)=>O.id));import{isAbsolute as Ta,join as Hy,normalize as jy,sep as Ri}from"node:path";var _i=process.platform==="win32",Fu=/[*?]/;function Ia(O){let D=O.trim(),B=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(_i?D.replaceAll("\\","/"):D);if(!B)return null;let Q=B[1]??"",ee=B[2]??"";if(Fu.test(Q)||ee==="."||ee==="..")return null;return{root:Q||"/",name:ee}}function vo(O,D){if(O==="~")return D;if(O.startsWith("~/"))return`${D}${O.slice(1)}`;return O}function ka(O,D){if(typeof O!=="string"||O.trim()==="")return"must be a non-empty path string";let B=vo(O.trim(),D);if(!Ta(B))return"must be an absolute path or start with ~/";return Eo(B,D)}function Oa(O,D){let B=zu(O,D);if(B===null)return"must be a non-empty path string";if(!Ta(B))return null;if(Eo(B,D)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Vy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Ky="cannot cover the guard's own configuration";function zu(O,D){if(typeof O!=="string"||O.trim()==="")return null;let B=O.trim(),Q=_i?B.replaceAll("\\","/"):B;return vo(Q.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),D)}function Ma(O,D){let B=zu(O,D);if(B===null)return"must be a non-empty path string";let Q=Ia(B)?.root??B;if(Fu.test(Q))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Ta(Q))return null;if(Eo(Q,D)!==null)return Vy;return qy(Q,D)?Ky:null}function qy(O,D){let B=wi(O),Q=wi(Hy(D,".cc-safety-net"));return B===Q||B.startsWith(`${Q}${Ri}`)}function Eo(O,D){let B=wi(O),Q=wi(D);if(B===Q)return"cannot be the home directory";let ee=B.endsWith(Ri)?B:`${B}${Ri}`;if(Q.startsWith(ee))return"cannot contain the home directory";return null}function wi(O){let D=jy(O);if(_i)D=D.replace(/\//g,"\\").toLowerCase();if(D.length>(_i?3:1)&&D.endsWith(Ri))D=D.slice(0,-1);return D}var Bu=30,Pi=1,Ai=365;function $u(O){if(typeof O!=="number"||!Number.isInteger(O))return 30;if(O<1)return 1;return O>365?365:O}var Uu=new Set(U.filter((O)=>O.catastrophic).map((O)=>O.id));function wt(O,D){if(!O)return null;if(Uu.has(O.id))return O;if(D?.destructiveCommandProtectionEnabled===!1)return null;let B=D?.effectiveDestructiveCommandRules[O.id];return B&&!B.enabled?null:O}function Jt(O,D,B){if(Uu.has(D))return!0;if(O?.destructiveCommandProtectionEnabled===!1)return!1;return O?.effectiveDestructiveCommandRules[D]?.enabled??B}function G(O,D){return Object.freeze(Object.fromEntries(U.map((B)=>{let Q=B.activationCapability?D[B.activationCapability]:void 0,ee=Q?.enabled??!0,he=O.destructiveCommandRuleOverrides[B.id],je=B.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...he?{override:he}:{}}:O.destructiveCommandProtectionEnabled?he?{enabled:he==="on",inheritedEnabled:ee,changesInherited:he==="on"!==ee,source:"rule_override",...B.activationCapability?{activationCapability:B.activationCapability}:{},override:he}:{enabled:ee,inheritedEnabled:ee,changesInherited:!1,source:Q?.source??"built_in_default",...B.activationCapability?{activationCapability:B.activationCapability}:{}}:{enabled:!1,inheritedEnabled:ee,changesInherited:!1,source:"master_disabled",...B.activationCapability?{activationCapability:B.activationCapability}:{},...he?{override:he}:{}};return[B.id,Object.freeze(je)]})))}function Hu(O,D){return Object.freeze({...O,effectiveDestructiveCommandRules:G(O,D)})}var ju={standard:0,strict:1,paranoid:2};function Y(O,D){return{policy:{version:1,safety:{level:D.safety?.level??O.safety.level,overrides:{...O.safety.overrides,...D.safety?.overrides}},workflow:{worktree_mode:D.workflow?.worktree_mode??O.workflow.worktree_mode},destructive_command_protection:{enabled:D.destructive_command_protection?.enabled??O.destructive_command_protection.enabled,overrides:{...O.destructive_command_protection.overrides,...D.destructive_command_protection?.overrides},allow_paths:Da(O.destructive_command_protection.allow_paths,D.destructive_command_protection?.allow_paths)},secret_protection:{enabled:D.secret_protection?.enabled??O.secret_protection.enabled,overrides:{...O.secret_protection.overrides,...D.secret_protection?.overrides},deny_paths:Da(O.secret_protection.deny_paths,D.secret_protection?.deny_paths),allow_paths:Da(O.secret_protection.allow_paths,D.secret_protection?.allow_paths)},audit:O.audit},weakenings:Yy(O,D)}}function Da(O,D){return[...new Set([...O,...D??[]])]}function Yy(O,D){let B=D.safety?.level,Q=di[O.safety.level];return[...B&&ju[B]<ju[O.safety.level]?[`project policy lowers level: ${O.safety.level} -> ${B}`]:[],...Gr.flatMap((ee)=>D.safety?.overrides?.[ee]===!1&&(O.safety.overrides[ee]??Q[ee])?[`project policy disables ${ee}`]:[]),...D.workflow?.worktree_mode===!0&&!O.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...D.destructive_command_protection?.enabled===!1&&O.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...D.secret_protection?.enabled===!1&&O.secret_protection.enabled?["project policy disables secret protection"]:[],...Vu(D.destructive_command_protection?.overrides,(ee)=>O.destructive_command_protection.enabled&&O.destructive_command_protection.overrides[ee]!=="off"),...Vu(D.secret_protection?.overrides,(ee)=>O.secret_protection.enabled&&(O.secret_protection.overrides[ee]==="on"?!0:O.secret_protection.overrides[ee]!=="off"&&!xi.has(ee))),...O.destructive_command_protection.enabled?Ku(O.destructive_command_protection.allow_paths,D.destructive_command_protection?.allow_paths).map((ee)=>`project policy adds destructive allow path: ${ee}`):[],...O.secret_protection.enabled?Ku(O.secret_protection.allow_paths,D.secret_protection?.allow_paths).map((ee)=>`project policy adds secret allow path: ${ee}`):[]]}function Vu(O,D){return Object.entries(O??{}).flatMap(([B,Q])=>Q==="off"&&D(B)?[`project policy disables rule ${B}`]:[])}function Ku(O,D){return(D??[]).filter((B)=>!O.includes(B))}var Wa=new Set(["standard","strict","paranoid"]),Z={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Bu}};function Xu(O,D){let B=rb(u(O,D),O.home),Q=Ie(b(D.cwd),O.home),ee=ae(Q.parsed,O.home),he=Object.keys(ee.policy).length>0?Y(B.gui??Z,ee.policy):void 0,je=[...B.errors,...Q.errors,...ee.diagnostics],at=(B.fallback==="defaults"&&he?"salvaged":B.fallback)??(B.gui?void 0:Q.fallback)??(je.length>0?"salvaged":void 0),lt=ee.policy.safety?.level?"project":B.levelPresent?"user":"default";return{...he?La(he.policy):B.policy,errors:je,...at?{fallback:at}:{},...Q.exists?{policyScopes:{levelScope:lt,weakenings:he?.weakenings??[]}}:{}}}var Jy="project policy audit settings are ignored; audit is user scope only";function ae(O,D){if(!yn(O))return{policy:{},diagnostics:[]};let B=yn(O.safety)?O.safety:{},Q=yn(O.workflow)?O.workflow:{},ee=yn(O.destructive_command_protection)?O.destructive_command_protection:{},he=yn(O.secret_protection)?O.secret_protection:{},je={...Wa.has(B.level)?{level:B.level}:{},...yn(B.overrides)?qu({overrides:Ju(B.overrides,Gr,["safety","overrides"],yr)}):{}},at={...typeof ee.enabled==="boolean"?{enabled:ee.enabled}:{},...ee.overrides!==void 0?{overrides:Ti(ee.overrides,va,ed,yr)}:{},...ee.allow_paths!==void 0?{allow_paths:$r(ee.allow_paths,ka,D,["destructive_command_protection","allow_paths"],yr)}:{}},lt={...typeof he.enabled==="boolean"?{enabled:he.enabled}:{},...he.overrides!==void 0?{overrides:Ti(he.overrides,Aa,td,yr)}:{},...he.deny_paths!==void 0?{deny_paths:$r(he.deny_paths,Oa,D,["secret_protection","deny_paths"],yr)}:{},...he.allow_paths!==void 0?{allow_paths:$r(he.allow_paths,Ma,D,["secret_protection","allow_paths"],yr)}:{}};return{policy:qu({safety:je,workflow:typeof Q.worktree_mode==="boolean"?{worktree_mode:Q.worktree_mode}:{},destructive_command_protection:at,secret_protection:lt}),diagnostics:O.audit===void 0?[]:[Jy]}}function Ju(O,D,B,Q){return Object.fromEntries(D.flatMap((ee)=>{let he=O[ee];if(typeof he==="boolean")return[[ee,he]];if(he!==void 0)Q(e([...B,ee],Ga));return[]}))}function qu(O){return Object.fromEntries(Object.entries(O).flatMap((D)=>Object.keys(D[1]).length>0?[D]:[]))}var yr=()=>{return},Ga="must be a boolean",Fa="must be an object if provided",Qu=`must be an integer between ${Pi} and ${Ai}`,ed={path:["destructive_command_protection","overrides"],label:"destructive command"},td={path:["secret_protection","overrides"],label:"secret protection"},Je=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Ye(O,D){let B=[];return{policy:nd(O,D,(ee)=>{B.push(ee)}),issues:B}}function C(O,D){return nd(O,D,yr)}function nd(O,D,B){if(!yn(O))return B(e([],"Config must be an object")),H();if(O.version!==1)B(e(["version"],"must be 1"));let Q=Br(O.safety,["safety"],["level","overrides"],B),ee=Br(Q.overrides,["safety","overrides"],Gr,B),he=Br(O.workflow,["workflow"],["worktree_mode"],B),je=Br(O.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],B),at=Br(O.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],B),lt=Br(O.audit,["audit"],["retention_days"],B);return rd(O,Je,[],B),{version:1,safety:{level:Qy(Q.level,B),overrides:Ju(ee,Gr,["safety","overrides"],B)},workflow:{worktree_mode:Na(he.worktree_mode,["workflow","worktree_mode"],!1,B)},destructive_command_protection:{enabled:Na(je.enabled,["destructive_command_protection","enabled"],!0,B),overrides:Ti(je.overrides,va,ed,B),allow_paths:$r(je.allow_paths,ka,D,["destructive_command_protection","allow_paths"],B)},secret_protection:{enabled:Na(at.enabled,["secret_protection","enabled"],!0,B),overrides:Ti(at.overrides,Aa,td,B),deny_paths:$r(at.deny_paths,Oa,D,["secret_protection","deny_paths"],B),allow_paths:$r(at.allow_paths,Ma,D,["secret_protection","allow_paths"],B)},audit:{retention_days:eb(lt.retention_days,B)}}}function Br(O,D,B,Q){if(O===void 0)return{};if(!yn(O))return Q(e(D,Fa)),{};return rd(O,B,D,Q),O}function rd(O,D,B,Q){for(let ee of Object.keys(O).filter((he)=>!D.includes(he)))Q({path:B,message:ee,kind:"unknownKeys"})}function Qy(O,D){if(O===void 0)return"standard";if(Wa.has(O))return O;return D(e(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Na(O,D,B,Q){if(typeof O==="boolean")return O;if(O!==void 0)Q(e(D,Ga));return B}function eb(O,D){if(!(O===void 0||typeof O==="number"&&Number.isInteger(O)&&O>=Pi&&O<=Ai))D(e(["audit","retention_days"],Qu));return $u(O)}function Ti(O,D,B,Q){if(O===void 0)return{};if(!yn(O))return Q(e(B.path,Fa)),{};return Object.fromEntries(Object.entries(O).flatMap(([ee,he])=>{if(!D.has(ee))return Q({path:[...B.path,ee],message:`unknown ${B.label} rule id "${ee}"`,kind:"key"}),[];if(he==="on"||he==="off")return[[ee,he]];return Q(e([...B.path,ee],'must be "on" or "off"')),[]}))}function $r(O,D,B,Q,ee){if(O===void 0)return[];if(!Array.isArray(O))return ee(e(Q,"must be an array of paths")),[];return O.flatMap((he,je)=>{let at=D(he,B);if(at===null)return[he];return ee(typeof he==="string"?Xt([...Q,je],at):e([...Q,je],at)),[]})}function yn(O){return!!O&&typeof O==="object"&&!Array.isArray(O)}function H(){return structuredClone(Z)}function Ae(O,D){let B=R({safety:De(O.safety)},D),Q=G({destructiveCommandProtectionEnabled:O.destructive_command_protection.enabled,destructiveCommandRuleOverrides:O.destructive_command_protection.overrides},B.capabilities),ee=Object.values(Q),he=ee.filter((je)=>je.source!=="catastrophic");return{selectedPreset:O.safety.level,effectiveLevel:B.effectiveLevel,capabilities:B.capabilities,rules:Q,counts:{enabled:he.filter((je)=>je.enabled).length,disabled:he.filter((je)=>!je.enabled).length,effectiveCustomizations:ee.filter((je)=>je.changesInherited).length}}}function Ie(O,D){if(!Zy(O))return{exists:!1,policy:H(),errors:[]};try{let B=Xy(O,"utf-8");if(!B.trim())return{exists:!0,policy:H(),errors:[`${O}: Config file is empty`],fallback:"defaults"};let Q=JSON.parse(B),ee=Ye(Q,D);if(ee.issues.length===0)return{exists:!0,parsed:Q,policy:ee.policy,errors:[]};return{exists:!0,parsed:Q,policy:ee.policy,errors:ee.issues.map((he)=>`${O}: ${nb(he)}`),fallback:yn(Q)?"salvaged":"defaults"}}catch(B){let Q=B instanceof Error?B.message:String(B);return{exists:!0,policy:H(),errors:[`${O}: ${B instanceof SyntaxError?"Invalid JSON":Q}`],fallback:"defaults"}}}var tb=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Fa,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Ga,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Qu,`not an integer between ${Pi} and ${Ai}`]]);function nb(O){let D=ba(O.path);if(O.kind==="unknownKeys")return`${D===""?"":`${D}.`}${O.message}: unknown field`;if(O.kind==="key")return`${D}: unknown rule id`;let B=tb.get(O.message)??O.message;return D===""?B:`${D}: ${B}`}function rb(O,D){let B=Ie(O,D);if(!B.exists){let Q=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!yn(Q))return{policy:Zu(),errors:[]};let ee=C(Q,D);return{policy:La(ee),gui:ee,errors:[],levelPresent:Yu(Q)}}if(B.parsed===void 0)return{policy:Zu(),errors:B.errors,...B.fallback?{fallback:B.fallback}:{}};return{policy:La(B.policy),gui:B.policy,errors:B.errors,...B.fallback?{fallback:B.fallback}:{},levelPresent:Yu(B.parsed)}}function Yu(O){let D=yn(O)&&yn(O.safety)?O.safety:{};return Wa.has(D.level)}function Oe(O){let D=Object.entries(O),B=new Set(D.flatMap(([Q,ee])=>ee==="on"?[Q]:[]));return[...new Set([...[...xi].filter((Q)=>!B.has(Q)),...D.flatMap(([Q,ee])=>ee==="off"?[Q]:[])])]}function Zu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Oe({}),denyPaths:[],allowPaths:[]}}}function La(O){return{safety:De(O.safety),worktreeMode:O.workflow.worktree_mode,destructiveCommandProtectionEnabled:O.destructive_command_protection.enabled,destructiveCommandRuleOverrides:O.destructive_command_protection.overrides,destructiveCommandAllowPaths:O.destructive_command_protection.allow_paths,secretProtection:{enabled:O.secret_protection.enabled,disabledRules:Oe(O.secret_protection.overrides),denyPaths:O.secret_protection.deny_paths,allowPaths:O.secret_protection.allow_paths}}}function De(O){let D={...O.overrides.fail_closed!==void 0?{failClosed:O.overrides.fail_closed}:{},...O.overrides.paranoid_rm!==void 0?{paranoidRm:O.overrides.paranoid_rm}:{},...O.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:O.overrides.paranoid_interpreters}:{}};return{level:O.level,...Object.keys(D).length>0?{overrides:D}:{}}}function E(O,D){let B=J(O,D),Q=Xu(O,D),ee={rules:B.rules,transparentWrappers:B.transparent_wrappers,safety:Q.safety,worktreeMode:Q.worktreeMode,destructiveCommandProtectionEnabled:Q.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:Q.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:Q.destructiveCommandAllowPaths,secretProtection:{enabled:Q.secretProtection.enabled??!0,disabledRules:Q.secretProtection.disabledRules??[],denyPaths:Q.secretProtection.denyPaths,allowPaths:Q.secretProtection.allowPaths??[]}},he={...B.userConfig?.overrides,...B.projectConfig?.overrides},je=Object.freeze(Object.fromEntries(ee.rules.map((at)=>{let lt=B.rulebooks.find((ut)=>ut.rules.includes(at.name)),ct=he[at.name];return[at.name,Object.freeze({id:at.name,...lt?{rulebook:Object.freeze({name:lt.name,version:lt.version}),...ab(lt.spec)?{source:lt.spec}:{}}:{},...ct&&typeof ct==="object"?{override:Object.freeze({type:"reason",reason:ct.reason})}:{}})]})));return Ee(ee,ob(B,Q),je,Q.policyScopes)}function Ne(O){if(O.state==="ready")return{state:O.state};return{state:O.state,reason:O.reason}}function ob(O,D){let B=sb(D);if(O.errors.length===0&&O.warnings.length===0&&!B)return;return{diagnostics:[...O.errors,...O.warnings,...D.errors],reason:lb(O.errors.length>0?ib(O.errors):void 0,O.warnings.length>0?Ba(O.warnings.join("; ")):void 0,B)}}function ib(O){return`${Ba(O.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function sb(O){if(O.errors.length===0)return;let D=O.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${O.errors.join("; ")}. Enforcing ${D}; the invalid values are not active. Fix the policy file manually`}function ab(O){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(O)}function Ee(O,D,B=Object.freeze({}),Q){let ee=za(structuredClone(O)),he=Q?{policyScopes:za(structuredClone(Q))}:{};if(!D)return Object.freeze({state:"ready",policy:ee,diagnostics:Object.freeze([]),ruleMetadata:B,...he});return Object.freeze({state:"degraded",policy:ee,diagnostics:Object.freeze([...D.diagnostics]),reason:D.reason,ruleMetadata:B,...he})}function za(O){if(typeof O!=="object"||O===null)return O;for(let D of Object.values(O))za(D);return Object.freeze(O)}function lb(...O){return Ba(O.filter((D)=>!!D).join("; "))}function Ba(O){return/[.!?]$/.test(O)?O:`${O}.`}function Fe(O){let D=O.effectiveCapabilities,B=O.strict??D.fail_closed.enabled,Q=O.paranoidRm??D.paranoid_rm.enabled,ee=O.paranoidInterpreters??D.paranoid_interpreters.enabled,he={fail_closed:$a(D.fail_closed,O.strict,"strict"),paranoid_rm:$a(D.paranoid_rm,O.paranoidRm,"paranoidRm"),paranoid_interpreters:$a(D.paranoid_interpreters,O.paranoidInterpreters,"paranoidInterpreters")};return{policy:Hu(O.policySnapshot.policy,he),effectiveCapabilities:he,effectiveLevel:ia({failClosed:B,paranoidRm:Q,paranoidInterpreters:ee}),strict:B,paranoidRm:Q,paranoidInterpreters:ee,worktreeMode:O.worktreeMode??!1}}function $a(O,D,B){if(D===void 0||D===O.enabled)return O;return{enabled:D,source:"capability_override",sources:[...O.sources,`analysis options.${B}`]}}function xo(O,D){if(O!=="powershell")return D[0]?.provenance==="command-substitution";let B=D[0]?.text==="&"||D[0]?.text==="."?1:0,Q=D[B]?.provenance;return Q!==void 0&&Q!=="literal"}var cb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ii(O,D){return O?.provenance==="literal"&&!O.quoted&&O.raw===D&&O.text===D}function Ro(O){let D=Ii(O.words[0],"time")?1:0,B=D===1&&Ii(O.words[D],"-p")?D+1:D,Q=D===1&&Ii(O.words[B],"--")?B+1:B,ee=Ii(O.words[Q],"!")?Q+1:Q,he=O.words.slice(ee).find((je)=>!cb.test(je.text));return he?.provenance==="literal"?he.text:void 0}var tr=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function ki(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function ub(O){return Object.freeze({...O,span:Object.freeze(O.span),words:Object.freeze(O.words),redirections:Object.freeze(O.redirections.map((D)=>Object.freeze({...D,span:Object.freeze(D.span),...D.heredoc?{heredoc:Object.freeze({...D.heredoc,bodySpan:Object.freeze(D.heredoc.bodySpan),terminatorSpan:Object.freeze(D.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(O.nested.map((D)=>ln(D)))})}function Oi(O,D,B){O.push(B),D.reset()}function Mi(O){let D=[];return{parts:D,push:(B,Q,ee)=>{if(Q<=B)return;D.push({raw:O.slice(B,Q),span:{start:B,end:Q},provenance:ee})}}}function Ua(O){let D=O.parts??[{raw:O.raw,span:O.span,provenance:O.provenance}];return Object.freeze({kind:"word",...O,span:Object.freeze(O.span),parts:Object.freeze(D.map((B)=>Object.freeze({...B,span:Object.freeze(B.span)})))})}function Ur(O,D,B,Q,ee,he,je){return Ua({text:Q,raw:O.slice(D,B),span:{start:D,end:B},provenance:ee,quoted:he,...je?{parts:je}:{}})}function ln(O){return Object.freeze({...O,span:Object.freeze(O.span),issues:Object.freeze(O.issues.map((D)=>Object.freeze({...D}))),nodes:Object.freeze(O.nodes.map((D)=>{if(D.kind==="command")return ub(D);if(D.kind==="group"||D.kind==="function")return Object.freeze({...D,span:Object.freeze(D.span),body:ln(D.body)});return Object.freeze({...D,span:Object.freeze(D.span)})}))})}function Ha(O,D,B){if(D>=B||id(O[D]??""))return null;let Q="",ee=!1,he=!1,je=D;while(je<B&&!id(O[je]??"")){let at=O[je]??"";if(at==="'"){ee=!0;let lt=od(O,je+1,B,"'");Q+=lt.text,he||=!lt.closed,je=lt.next;continue}if(at==='"'){ee=!0;let lt=od(O,je+1,B,'"');Q+=lt.text,he||=!lt.closed,je=lt.next;continue}if(at==="\\"){ee=!0;let lt=O[je+1];if(!lt||lt===`
+`||lt==="\r"){he=!0;break}Q+=lt,je+=2;continue}if(at==="`"||O.startsWith("$(",je)||O.startsWith("${",je)||O.startsWith("<(",je)||O.startsWith(">(",je))he=!0;Q+=at,je++}return{delimiter:Q,quoted:ee,next:je,ambiguous:he}}function ja(O,D,B,Q){let ee=[],he=D;for(let je of Q){let at=he,lt=!1;while(he<B){let ct=db(O,he,B);if((je.stripTabs?ct.text.replace(/^\t+/,""):ct.text)===je.delimiter){je.attach({body:je.stripTabs?fb(O.slice(at,he)):O.slice(at,he),delimiter:je.delimiter,quotedDelimiter:je.quotedDelimiter,bodySpan:{start:at,end:he},terminatorSpan:{start:he,end:ct.contentEnd}}),he=ct.next,lt=!0;break}if(ct.next<=he)break;he=ct.next}if(lt)continue;return ee.push({code:"unterminated-heredoc",message:`heredoc delimiter ${je.delimiter} was not found`}),{next:B,issues:ee,terminated:!1}}return{next:he,issues:ee,terminated:!0}}function od(O,D,B,Q){let ee="",he=D;while(he<B&&O[he]!==`
+`&&O[he]!=="\r"){let je=O[he]??"";if(je===Q)return{text:ee,next:he+1,closed:!0};if(Q==='"'&&je==="\\"&&O[he+1]){let at=O[he+1]??"";ee+=["$","`",'"',"\\"].includes(at)?at:`\\${at}`,he+=2;continue}ee+=je,he++}return{text:ee,next:he,closed:!1}}function id(O){return O!=="\r"&&(/[\s;&|<>)]/u.test(O)||O==="`")}function db(O,D,B){let Q=D;while(Q<B&&O[Q]!==`
+`)Q++;let ee=Q>=B?B:Q+1;return{text:O.slice(D,Q),contentEnd:Q,next:ee}}function fb(O){return O.replace(/(^|\r\n?|\n)\t+/g,"$1")}var cd=new Set(["&&","||","|","|&"]);function ud(O,D){let B={start:0,end:O.length};if(O.length>D.maxInputLength)return ln({kind:"program",dialect:"posix",source:O,span:B,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${D.maxInputLength} UTF-16 code units`}],nodes:[]});let Q=Li(O,0,O.length,D,{used:0,max:D.maxWords},0);return ln({kind:"program",dialect:"posix",source:O,span:B,status:Fi(Q.issues,Q.limited),issues:Q.issues,nodes:Q.nodes})}function Li(O,D,B,Q,ee,he,je){let at=[],lt=[],ct=ki(),ut=[],ft=()=>{if(ct.words.length===0&&ct.redirections.length===0)return;let mt={start:ct.start,end:ct.end},pt=ct.words.map((gt)=>gt.text);Oi(at,ct,{kind:"command",dialect:"posix",source:O.slice(mt.start,mt.end),span:mt,words:ct.words,redirections:ct.redirections,nested:ct.nested,displayText:lt.length>0&&at.length===0?O.slice(D,B):pt.join(" ")})},dt=D;while(dt<B){let mt=O[dt];if(!mt)break;if(je&&mt===je)return ft(),ld(at,lt),{nodes:at,issues:lt,next:dt+1,closed:!0,limited:!1,pendingHeredocs:ut};if(Gi(mt)){if(mt===`
 `||mt==="\r"){ft();let vt=mt==="\r"&&O[dt+1]===`
-`?dt+2:dt+1,Pt=at.at(-1);if(Pt?.kind!=="connector"||!ad.has(Pt.operator))at.push(Object.freeze({kind:"connector",operator:O.slice(dt,vt),span:Object.freeze({start:dt,end:vt})}));if(ut.length>0){let xt=Ua(O,vt,B,ut.splice(0));lt.push(...xt.issues),dt=xt.next;continue}dt=vt;continue}dt++;continue}if(mt==="#"){while(dt<B&&O[dt]!==`
-`&&O[dt]!=="\r")dt++;continue}let pt=ct.start===-1?kb(O,dt,B):void 0;if(pt){if(ja(at,lt),he>=Q.maxDepth)return Hr(at,lt,dt,"depth-limit",Q.maxDepth);if(!Ha(ee))return Hr(at,lt,dt,"word-limit",Q.maxWords);let vt=Ni(O,pt.braceIndex+1,B,Q,ee,he+1,"}"),Pt=vt.next,xt={start:pt.braceIndex+1,end:vt.closed?Pt-1:Pt},_t=od(O,xt,vt);if(at.push({kind:"function",name:pt.name,span:{start:dt,end:Pt},body:_t}),lt.push(...vt.issues),vt.pendingHeredocs.length>0||wo(vt.nodes))lt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(ut.push(...vt.pendingHeredocs),vt.limited)return Di(at,lt,vt.next);if(!vt.closed)lt.push({code:"unclosed-function-body",message:"function body is not closed"});dt=Pt;continue}let gt=Li(O,dt);if(gt){if(ft(),!hd(at.at(-1)))lt.push({code:"unexpected-connector",message:`connector ${gt} has no preceding command`});at.push(Object.freeze({kind:"connector",operator:gt,span:Object.freeze({start:dt,end:dt+gt.length})})),dt+=gt.length;continue}if(mt===")"){ft(),lt.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),at.push({kind:"unknown",source:mt,span:{start:dt,end:dt+1}}),dt++;continue}if((mt==="("||mt==="{"&&bb(O,dt,B))&&ct.start===-1){if(ja(at,lt),he>=Q.maxDepth)return Hr(at,lt,dt,"depth-limit",Q.maxDepth);let vt=mt==="("?")":"}",Pt=Ni(O,dt+1,B,Q,ee,he+1,vt),xt=Pt.next,_t={start:dt+1,end:Pt.closed?xt-1:xt},Ut=od(O,_t,Pt);if(at.push({kind:"group",style:mt==="("?"subshell":"brace",span:{start:dt,end:xt},body:Ut}),lt.push(...Pt.issues),Pt.pendingHeredocs.length>0||wo(Pt.nodes))lt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(ut.push(...Pt.pendingHeredocs),Pt.limited)return Di(at,lt,Pt.next);if(!Pt.closed)lt.push({code:mt==="("?"unclosed-subshell":"unclosed-brace-group",message:`${mt} group is not closed`});dt=xt;continue}let ht=(mt==="<"||mt===">")&&O[dt+1]!=="("?pb(O,dt):null;if(ht){let vt=ct.words.at(-1),Pt=vt&&vt.span.end===dt&&/^[0-9]+$/.test(vt.raw)?Number(vt.raw):void 0;if(Pt!==void 0)ct.words.pop();let xt=Pt===void 0?dt:vt?.span.start??dt;ct.start=ct.start===-1?dt:ct.start;let _t=dt+ht.length;while(_t<B&&/[ \t]/.test(O[_t]??""))_t++;let Ut=O[_t],jt=_t>dt+ht.length&&Ut==="#",qt=!Ut||Wi(Ut)||!!Li(O,_t)||Ut===je||Ut===")"||jt||(Ut==="<"||Ut===">")&&O[_t+1]!=="(",Vt=ht==="<<"||ht==="<<-",Ft=Vt?$a(O,_t,B):void 0,Ot=Ft?{word:Ur(O,_t,Ft.next,Ft.delimiter,"literal",Ft.quoted),nested:[],issues:[],next:Ft.next,limited:!1}:!qt?Va(O,_t,B,Q,ee,he):void 0;if(Ot){if(lt.push(...Ot.issues),Ot.limited)return Di(at,lt,Ot.next);if(!Ha(ee))return Hr(at,lt,Ot.next,"word-limit",Q.maxWords)}let on=Ot?.next??dt+ht.length,Cn={kind:"redirection",operator:ht,span:{start:xt,end:on},...Pt===void 0?{}:{fd:Pt},...Ot?{target:Ot.word}:{}};if(ct.redirections.push(Cn),Vt&&!Ft)lt.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(Ft){if(Ft.ambiguous||Ft.delimiter.length===0)lt.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Bn=ct.nested;ut.push({delimiter:Ft.delimiter,quotedDelimiter:Ft.quoted,stripTabs:ht==="<<-",attach:(wn)=>{if(Cn.heredoc=wn,wn.quotedDelimiter)return;Bn.push(...fb(O,wn.bodySpan.start,wn.bodySpan.end,Q,ee,he+1))}})}if(!Vt&&!Ot)lt.push({code:"missing-redirection-target",message:`redirection ${ht} requires a target word`});if(Ot)ct.nested.push(...Ot.nested);ct.end=on,dt=on;continue}if(ct.start===-1)ja(at,lt);let yt=Va(O,dt,B,Q,ee,he);if(lt.push(...yt.issues),yt.limited)return Di(at,lt,yt.next);let Ct=vb(ct.words)?wb(O,yt.word,ee.max-ee.used,Q.maxDepth,Q.maxInputLength):void 0;if(Ct?.limitCode)return Hr(at,lt,yt.next,Ct.limitCode,Ct.limitCode==="word-limit"?Q.maxWords:Ct.limitCode==="depth-limit"?Q.maxDepth:Q.maxInputLength);let Et=Ct?.words??[yt.word];for(let vt of Et){if(!Ha(ee))return Hr(at,lt,yt.next,"word-limit",Q.maxWords);ct.words.push(vt)}ct.start=ct.start===-1?dt:ct.start,ct.end=yt.next,ct.nested.push(...yt.nested),dt=yt.next>dt?yt.next:dt+1}return ft(),sd(at,lt),lt.push(...Ob(ut)),{nodes:at,issues:lt,next:dt,closed:je===void 0,limited:!1,pendingHeredocs:[]}}function od(O,D,B){return{kind:"program",dialect:"posix",source:O.slice(D.start,D.end),span:D,status:Gi(B.issues,B.limited),issues:B.issues,nodes:B.nodes}}function Va(O,D,B,Q,ee,he){let je="",at=D,lt=!1,ct="literal",ut=[],ft=[],dt=!1;while(at<B){let mt=O[at],pt=(mt==="<"||mt===">")&&O[at+1]==="(";if(!mt||Wi(mt)||(mt===";"||mt==="|"||mt==="&")&&Li(O,at)||(mt==="<"||mt===">")&&!pt)break;if(mt===")")break;if(mt==="'"){lt=!0;let ht=O.indexOf("'",at+1);if(ht===-1||ht>=B){je+=O.slice(at+1,B),ft.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),at=B;break}je+=O.slice(at+1,ht),at=ht+1;continue}if(mt==='"'){lt=!0;let ht=db(O,at,B,Q,ee,he);if(je+=ht.text,ut.push(...ht.nested),ft.push(...ht.issues),dt||=ht.limited,ct=_o(ct,ht.provenance),at=ht.next,dt)break;continue}if(O.startsWith("$'",at)){lt=!0;let ht=gb(O,at+2,B);if(je+=ht.text,ft.push(...ht.issues),!ht.closed)ft.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});at=ht.next;continue}if(mt==="\\"){let ht=O[at+1];if(!ht){ft.push({code:"trailing-escape",message:"escape has no following character"}),at++;break}if(ht===`
-`){at+=2;continue}je+=ht,at+=2;continue}let gt=mt==="$"||mt==="<"||mt===">"||mt==="`"?Fi(O,at,B,Q,ee,he):null;if(gt){let ht=cd(gt,ut,ft);if(dt||=ht.limited,ct=_o(ct,ht.provenance),at=ht.next,dt)break;continue}if(mt==="$"){let ht=fd(O,at,B,je,ct);je=ht.text,ct=ht.provenance,at=ht.next;continue}if(mt==="*"||mt==="?"||mt==="[")ct=_o(ct,"glob");je+=mt,at++}return{word:Ur(O,D,at,je,ct,lt,ct==="literal"?void 0:yb(O,D,at)),nested:ut,issues:ft,next:at,limited:dt}}function db(O,D,B,Q,ee,he){let je="",at="literal",lt=[],ct=[],ut=!1,ft=D+1;while(ft<B){let dt=O[ft];if(dt==='"')return{text:je,provenance:at,nested:lt,issues:ct,next:ft+1,limited:ut};if(dt==="\\"&&O[ft+1]){let pt=O[ft+1]??"";if(pt===`
+`?dt+2:dt+1,Pt=at.at(-1);if(Pt?.kind!=="connector"||!cd.has(Pt.operator))at.push(Object.freeze({kind:"connector",operator:O.slice(dt,vt),span:Object.freeze({start:dt,end:vt})}));if(ut.length>0){let xt=ja(O,vt,B,ut.splice(0));lt.push(...xt.issues),dt=xt.next;continue}dt=vt;continue}dt++;continue}if(mt==="#"){while(dt<B&&O[dt]!==`
+`&&O[dt]!=="\r")dt++;continue}let pt=ct.start===-1?Mb(O,dt,B):void 0;if(pt){if(Ka(at,lt),he>=Q.maxDepth)return Hr(at,lt,dt,"depth-limit",Q.maxDepth);if(!Va(ee))return Hr(at,lt,dt,"word-limit",Q.maxWords);let vt=Li(O,pt.braceIndex+1,B,Q,ee,he+1,"}"),Pt=vt.next,xt={start:pt.braceIndex+1,end:vt.closed?Pt-1:Pt},_t=sd(O,xt,vt);if(at.push({kind:"function",name:pt.name,span:{start:dt,end:Pt},body:_t}),lt.push(...vt.issues),vt.pendingHeredocs.length>0||wo(vt.nodes))lt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(ut.push(...vt.pendingHeredocs),vt.limited)return Ni(at,lt,vt.next);if(!vt.closed)lt.push({code:"unclosed-function-body",message:"function body is not closed"});dt=Pt;continue}let gt=Wi(O,dt);if(gt){if(ft(),!bd(at.at(-1)))lt.push({code:"unexpected-connector",message:`connector ${gt} has no preceding command`});at.push(Object.freeze({kind:"connector",operator:gt,span:Object.freeze({start:dt,end:dt+gt.length})})),dt+=gt.length;continue}if(mt===")"){ft(),lt.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),at.push({kind:"unknown",source:mt,span:{start:dt,end:dt+1}}),dt++;continue}if((mt==="("||mt==="{"&&Cb(O,dt,B))&&ct.start===-1){if(Ka(at,lt),he>=Q.maxDepth)return Hr(at,lt,dt,"depth-limit",Q.maxDepth);let vt=mt==="("?")":"}",Pt=Li(O,dt+1,B,Q,ee,he+1,vt),xt=Pt.next,_t={start:dt+1,end:Pt.closed?xt-1:xt},Ut=sd(O,_t,Pt);if(at.push({kind:"group",style:mt==="("?"subshell":"brace",span:{start:dt,end:xt},body:Ut}),lt.push(...Pt.issues),Pt.pendingHeredocs.length>0||wo(Pt.nodes))lt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(ut.push(...Pt.pendingHeredocs),Pt.limited)return Ni(at,lt,Pt.next);if(!Pt.closed)lt.push({code:mt==="("?"unclosed-subshell":"unclosed-brace-group",message:`${mt} group is not closed`});dt=xt;continue}let ht=(mt==="<"||mt===">")&&O[dt+1]!=="("?hb(O,dt):null;if(ht){let vt=ct.words.at(-1),Pt=vt&&vt.span.end===dt&&/^[0-9]+$/.test(vt.raw)?Number(vt.raw):void 0;if(Pt!==void 0)ct.words.pop();let xt=Pt===void 0?dt:vt?.span.start??dt;ct.start=ct.start===-1?dt:ct.start;let _t=dt+ht.length;while(_t<B&&/[ \t]/.test(O[_t]??""))_t++;let Ut=O[_t],jt=_t>dt+ht.length&&Ut==="#",qt=!Ut||Gi(Ut)||!!Wi(O,_t)||Ut===je||Ut===")"||jt||(Ut==="<"||Ut===">")&&O[_t+1]!=="(",Vt=ht==="<<"||ht==="<<-",Ft=Vt?Ha(O,_t,B):void 0,Ot=Ft?{word:Ur(O,_t,Ft.next,Ft.delimiter,"literal",Ft.quoted),nested:[],issues:[],next:Ft.next,limited:!1}:!qt?qa(O,_t,B,Q,ee,he):void 0;if(Ot){if(lt.push(...Ot.issues),Ot.limited)return Ni(at,lt,Ot.next);if(!Va(ee))return Hr(at,lt,Ot.next,"word-limit",Q.maxWords)}let on=Ot?.next??dt+ht.length,Cn={kind:"redirection",operator:ht,span:{start:xt,end:on},...Pt===void 0?{}:{fd:Pt},...Ot?{target:Ot.word}:{}};if(ct.redirections.push(Cn),Vt&&!Ft)lt.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(Ft){if(Ft.ambiguous||Ft.delimiter.length===0)lt.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Bn=ct.nested;ut.push({delimiter:Ft.delimiter,quotedDelimiter:Ft.quoted,stripTabs:ht==="<<-",attach:(wn)=>{if(Cn.heredoc=wn,wn.quotedDelimiter)return;Bn.push(...pb(O,wn.bodySpan.start,wn.bodySpan.end,Q,ee,he+1))}})}if(!Vt&&!Ot)lt.push({code:"missing-redirection-target",message:`redirection ${ht} requires a target word`});if(Ot)ct.nested.push(...Ot.nested);ct.end=on,dt=on;continue}if(ct.start===-1)Ka(at,lt);let yt=qa(O,dt,B,Q,ee,he);if(lt.push(...yt.issues),yt.limited)return Ni(at,lt,yt.next);let Ct=xb(ct.words)?Ab(O,yt.word,ee.max-ee.used,Q.maxDepth,Q.maxInputLength):void 0;if(Ct?.limitCode)return Hr(at,lt,yt.next,Ct.limitCode,Ct.limitCode==="word-limit"?Q.maxWords:Ct.limitCode==="depth-limit"?Q.maxDepth:Q.maxInputLength);let Et=Ct?.words??[yt.word];for(let vt of Et){if(!Va(ee))return Hr(at,lt,yt.next,"word-limit",Q.maxWords);ct.words.push(vt)}ct.start=ct.start===-1?dt:ct.start,ct.end=yt.next,ct.nested.push(...yt.nested),dt=yt.next>dt?yt.next:dt+1}return ft(),ld(at,lt),lt.push(...Db(ut)),{nodes:at,issues:lt,next:dt,closed:je===void 0,limited:!1,pendingHeredocs:[]}}function sd(O,D,B){return{kind:"program",dialect:"posix",source:O.slice(D.start,D.end),span:D,status:Fi(B.issues,B.limited),issues:B.issues,nodes:B.nodes}}function qa(O,D,B,Q,ee,he){let je="",at=D,lt=!1,ct="literal",ut=[],ft=[],dt=!1;while(at<B){let mt=O[at],pt=(mt==="<"||mt===">")&&O[at+1]==="(";if(!mt||Gi(mt)||(mt===";"||mt==="|"||mt==="&")&&Wi(O,at)||(mt==="<"||mt===">")&&!pt)break;if(mt===")")break;if(mt==="'"){lt=!0;let ht=O.indexOf("'",at+1);if(ht===-1||ht>=B){je+=O.slice(at+1,B),ft.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),at=B;break}je+=O.slice(at+1,ht),at=ht+1;continue}if(mt==='"'){lt=!0;let ht=mb(O,at,B,Q,ee,he);if(je+=ht.text,ut.push(...ht.nested),ft.push(...ht.issues),dt||=ht.limited,ct=_o(ct,ht.provenance),at=ht.next,dt)break;continue}if(O.startsWith("$'",at)){lt=!0;let ht=yb(O,at+2,B);if(je+=ht.text,ft.push(...ht.issues),!ht.closed)ft.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});at=ht.next;continue}if(mt==="\\"){let ht=O[at+1];if(!ht){ft.push({code:"trailing-escape",message:"escape has no following character"}),at++;break}if(ht===`
+`){at+=2;continue}je+=ht,at+=2;continue}let gt=mt==="$"||mt==="<"||mt===">"||mt==="`"?zi(O,at,B,Q,ee,he):null;if(gt){let ht=dd(gt,ut,ft);if(dt||=ht.limited,ct=_o(ct,ht.provenance),at=ht.next,dt)break;continue}if(mt==="$"){let ht=pd(O,at,B,je,ct);je=ht.text,ct=ht.provenance,at=ht.next;continue}if(mt==="*"||mt==="?"||mt==="[")ct=_o(ct,"glob");je+=mt,at++}return{word:Ur(O,D,at,je,ct,lt,ct==="literal"?void 0:Sb(O,D,at)),nested:ut,issues:ft,next:at,limited:dt}}function mb(O,D,B,Q,ee,he){let je="",at="literal",lt=[],ct=[],ut=!1,ft=D+1;while(ft<B){let dt=O[ft];if(dt==='"')return{text:je,provenance:at,nested:lt,issues:ct,next:ft+1,limited:ut};if(dt==="\\"&&O[ft+1]){let pt=O[ft+1]??"";if(pt===`
 `){ft+=2;continue}if(pt==="\r"&&O[ft+2]===`
-`){ft+=3;continue}je+=["$","`",'"',"\\"].includes(pt)?pt:`\\${pt}`,ft+=2;continue}if(O.startsWith("$((",ft)){let pt=Ka(O,ft+3,B,"))"),gt=pt===-1?B:pt+2;if(je+=O.slice(ft,gt),pt===-1)ct.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});ft=gt;continue}let mt=Fi(O,ft,B,Q,ee,he);if(mt){let pt=cd(mt,lt,ct);if(ft=pt.next,ut||=pt.limited,at=_o(at,pt.provenance),ut)return{text:je,provenance:at,nested:lt,issues:ct,next:ft,limited:ut};continue}if(dt==="$"){let pt=fd(O,ft,B,je,at);je=pt.text,at=pt.provenance,ft=pt.next;continue}je+=dt??"",ft++}return ct.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:je,provenance:at,nested:lt,issues:ct,next:B,limited:ut}}function Fi(O,D,B,Q,ee,he){let je=O.startsWith("$((",D),at=O.startsWith("$(",D)&&!je,lt=O.startsWith("<(",D)||O.startsWith(">(",D),ct=O[D]==="`";if(!je&&!at&&!lt&&!ct)return null;let ut=je?3:ct?1:2,ft=je?"))":ct?"`":")",dt=Ka(O,D+ut,B,ft),mt=dt===-1?B:dt,pt=dt===-1?B:dt+ft.length;if(he>=Q.maxDepth)return{program:Ib(O,D+ut,mt,"depth-limit"),next:pt,provenance:je?"arithmetic":"command-substitution"};if(je){let Ct=[],Et=[],vt=!1,Pt=D+ut;while(Pt<mt){let xt=Fi(O,Pt,mt,Q,ee,he+1);if(!xt){Pt++;continue}if(Ct.push(...xt.program.nodes),Et.push(...xt.program.issues),vt||=xt.program.status==="limited",Pt=xt.next,vt)break}if(dt===-1)Et.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:ln({kind:"program",dialect:"posix",source:O.slice(D+ut,mt),span:{start:D+ut,end:mt},status:Gi(Et,vt),issues:Et,nodes:Ct}),next:pt,provenance:"arithmetic"}}let gt=Ni(O,D+ut,mt,Q,ee,he+1),ht=dt===-1?[{code:"unclosed-command-substitution",message:`${O.slice(D,D+ut)} substitution is not closed`}]:[],yt=(ct||lt)&&wo(gt.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:ln({kind:"program",dialect:"posix",source:O.slice(D+ut,mt),span:{start:D+ut,end:mt},status:Gi([...gt.issues,...ht,...yt],gt.limited),issues:[...gt.issues,...ht,...yt],nodes:gt.nodes}),next:pt,provenance:"command-substitution"}}function fb(O,D,B,Q,ee,he){let je=[],at=D;while(at<B){let lt=O[at];if(lt==="\\"){at+=2;continue}let ct=lt==="$"||lt==="`"?Fi(O,at,B,Q,ee,he):null;if(!ct){at++;continue}if(je.push(ct.program),at=ct.next,ct.program.status==="limited")break}return je}function cd(O,D,B){return D.push(O.program),B.push(...O.program.issues),{provenance:O.provenance,next:O.next,limited:O.program.status==="limited"}}function Ka(O,D,B,Q){if(Q==="`"){for(let at=D;at<B;at++){if(O[at]==="\\"){at++;continue}if(O[at]==="`")return at}return-1}let ee=1,he={single:!1,double:!1},je=[];for(let at=D;at<B;at++){let lt=O[at];if((lt===`
+`){ft+=3;continue}je+=["$","`",'"',"\\"].includes(pt)?pt:`\\${pt}`,ft+=2;continue}if(O.startsWith("$((",ft)){let pt=Ya(O,ft+3,B,"))"),gt=pt===-1?B:pt+2;if(je+=O.slice(ft,gt),pt===-1)ct.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});ft=gt;continue}let mt=zi(O,ft,B,Q,ee,he);if(mt){let pt=dd(mt,lt,ct);if(ft=pt.next,ut||=pt.limited,at=_o(at,pt.provenance),ut)return{text:je,provenance:at,nested:lt,issues:ct,next:ft,limited:ut};continue}if(dt==="$"){let pt=pd(O,ft,B,je,at);je=pt.text,at=pt.provenance,ft=pt.next;continue}je+=dt??"",ft++}return ct.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:je,provenance:at,nested:lt,issues:ct,next:B,limited:ut}}function zi(O,D,B,Q,ee,he){let je=O.startsWith("$((",D),at=O.startsWith("$(",D)&&!je,lt=O.startsWith("<(",D)||O.startsWith(">(",D),ct=O[D]==="`";if(!je&&!at&&!lt&&!ct)return null;let ut=je?3:ct?1:2,ft=je?"))":ct?"`":")",dt=Ya(O,D+ut,B,ft),mt=dt===-1?B:dt,pt=dt===-1?B:dt+ft.length;if(he>=Q.maxDepth)return{program:Ob(O,D+ut,mt,"depth-limit"),next:pt,provenance:je?"arithmetic":"command-substitution"};if(je){let Ct=[],Et=[],vt=!1,Pt=D+ut;while(Pt<mt){let xt=zi(O,Pt,mt,Q,ee,he+1);if(!xt){Pt++;continue}if(Ct.push(...xt.program.nodes),Et.push(...xt.program.issues),vt||=xt.program.status==="limited",Pt=xt.next,vt)break}if(dt===-1)Et.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:ln({kind:"program",dialect:"posix",source:O.slice(D+ut,mt),span:{start:D+ut,end:mt},status:Fi(Et,vt),issues:Et,nodes:Ct}),next:pt,provenance:"arithmetic"}}let gt=Li(O,D+ut,mt,Q,ee,he+1),ht=dt===-1?[{code:"unclosed-command-substitution",message:`${O.slice(D,D+ut)} substitution is not closed`}]:[],yt=(ct||lt)&&wo(gt.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:ln({kind:"program",dialect:"posix",source:O.slice(D+ut,mt),span:{start:D+ut,end:mt},status:Fi([...gt.issues,...ht,...yt],gt.limited),issues:[...gt.issues,...ht,...yt],nodes:gt.nodes}),next:pt,provenance:"command-substitution"}}function pb(O,D,B,Q,ee,he){let je=[],at=D;while(at<B){let lt=O[at];if(lt==="\\"){at+=2;continue}let ct=lt==="$"||lt==="`"?zi(O,at,B,Q,ee,he):null;if(!ct){at++;continue}if(je.push(ct.program),at=ct.next,ct.program.status==="limited")break}return je}function dd(O,D,B){return D.push(O.program),B.push(...O.program.issues),{provenance:O.provenance,next:O.next,limited:O.program.status==="limited"}}function Ya(O,D,B,Q){if(Q==="`"){for(let at=D;at<B;at++){if(O[at]==="\\"){at++;continue}if(O[at]==="`")return at}return-1}let ee=1,he={single:!1,double:!1},je=[];for(let at=D;at<B;at++){let lt=O[at];if((lt===`
 `||lt==="\r")&&je.length>0){let ut=lt==="\r"&&O[at+1]===`
-`?at+2:at+1,ft=Ua(O,ut,B,je.splice(0));if(!ft.terminated)return-1;at=ft.next-1;continue}let ct=ud(O,at,D,B,he);if(ct!==null){at=ct;continue}if(!he.double&&O.startsWith("$((",at)){let ut=mb(O,at+3,B);if(ut===-1)return-1;at=ut+1;continue}if(Q===")"&&!he.double&&lt==="<"&&O[at+1]==="<"&&O[at+2]!=="<"){let ut=O[at+2]==="-",ft=at+(ut?3:2);while(ft<B&&/[ \t]/.test(O[ft]??""))ft++;let dt=$a(O,ft,B);if(dt){je.push({delimiter:dt.delimiter,quotedDelimiter:dt.quoted,stripTabs:ut,attach:()=>{return}}),at=dt.next-1;continue}}if(O.startsWith("$(",at)&&!O.startsWith("$((",at)){ee++,at++;continue}if(lt==="("&&!he.double)ee++;if(lt===")"&&!he.double){if(ee--,ee===0)return Q==="))"&&O[at+1]!==")"?-1:at}}return-1}function mb(O,D,B){let Q=1,ee={single:!1,double:!1};for(let he=D;he<B;he++){let je=O[he],at=ud(O,he,D,B,ee);if(at!==null){he=at;continue}if(O.startsWith("$(",he)&&!O.startsWith("$((",he)){Q++,he++;continue}if(je==="("&&!ee.double)Q++;if(je!==")"||ee.double)continue;if(Q--,Q===0)return O[he+1]===")"?he:-1}return-1}function ud(O,D,B,Q,ee){let he=O[D];if(he==="\\"&&!ee.single)return D+1;if(!ee.double&&he==="'")ee.single=!ee.single;if(!ee.single&&he==='"')ee.double=!ee.double;if(ee.single)return D;if(ee.double||he!=="#"||!Mb(O,D,B))return null;let je=D;while(je+1<Q&&O[je+1]!==`
-`&&O[je+1]!=="\r")je++;return je}function Li(O,D){let B=O[D];if(B===";")return";";if(B==="&")return O[D+1]==="&"?"&&":"&";if(B==="|")return O[D+1]==="|"?"||":O[D+1]==="&"?"|&":"|";return null}function pb(O,D){let B=O[D];if(B===">"){if(O[D+1]===">")return">>";if(O[D+1]==="&")return">&";return O[D+1]==="|"?">|":">"}if(B!=="<")return null;if(O.startsWith("<<<",D))return"<<<";if(O.startsWith("<<-",D))return"<<-";if(O[D+1]==="<")return"<<";if(O[D+1]==="&")return"<&";if(O[D+1]===">")return"<>";return"<"}function Wi(O){let D=O.charCodeAt(0);if(D===32||D>=9&&D<=13)return!0;if(D<128)return!1;return/\s/u.test(O)}function dd(O,D,B){if(O[D+1]==="{"){let ee=O.indexOf("}",D+2);return ee===-1||ee>=B?B:ee+1}let Q=D+1;while(Q<B&&/[A-Za-z0-9_?@#$!*-]/.test(O[Q]??""))Q++;return Q===D+1?D+1:Q}function gb(O,D,B){let Q="",ee=[],he=D;while(he<B){let je=O[he];if(je==="'")return{text:Q,next:he+1,closed:!0,issues:ee};if(je!=="\\"){Q+=je??"",he++;continue}let at=hb(O,he+1,B);if(Q+=at.text,at.invalidCodePoint!==void 0)ee.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${at.invalidCodePoint}`});he=at.next}return{text:Q,next:B,closed:!1,issues:ee}}function hb(O,D,B){let Q=O[D];if(!Q||D>=B)return{text:"\\",next:D};let ee=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(ee.has(Q))return{text:ee.get(Q)??Q,next:D+1};if(Q==="x")return Mi(O,D+1,B,16,2,D+1);if(Q==="u")return Mi(O,D+1,B,16,4,D+1);if(Q==="U")return Mi(O,D+1,B,16,8,D+1);if(/[0-7]/.test(Q))return Mi(O,D,B,8,3,D+1);return{text:Q,next:D+1}}function Mi(O,D,B,Q,ee,he){let je=Q===16?/[0-9a-fA-F]/:/[0-7]/,at="",lt=D;while(lt<B&&at.length<ee&&je.test(O[lt]??""))at+=O[lt],lt++;if(!at)return{text:O[he-1]??"",next:he};let ct=Number.parseInt(at,Q);return ct>1114111||ct>=55296&&ct<=57343?{text:"�",next:lt,invalidCodePoint:ct}:{text:String.fromCodePoint(ct),next:lt}}function Gi(O,D=!1){if(D)return"limited";if(O.some((B)=>B.code==="invalid-ansi-c-code-point"||B.code==="missing-heredoc-delimiter"||B.code==="ambiguous-heredoc-delimiter"||B.code==="unterminated-heredoc"||B.code==="unsupported-heredoc-context"))return"invalid";return O.length>0?"partial":"complete"}function fd(O,D,B,Q,ee){let he=dd(O,D,B);return{text:Q+O.slice(D,he),provenance:_o(ee,"variable"),next:he}}function yb(O,D,B){let Q=Oi(O),ee=D,he=!1,je=!1,at=D;while(at<B){let lt=O[at];if(lt==="\\"&&!he){at+=2;continue}if(!je&&lt==="'"){he=!he,at++;continue}if(!he&&lt==='"'){je=!je,at++;continue}if(he){at++;continue}let ct=O.startsWith("$((",at),ut=O.startsWith("$(",at)&&!ct,ft=!je&&(O.startsWith("<(",at)||O.startsWith(">(",at)),dt=lt==="`";if(ct||ut||ft||dt){let mt=ct?3:dt?1:2,pt=ct?"))":dt?"`":")",gt=Ka(O,at+mt,B,pt),ht=gt===-1?B:gt+pt.length;Q.push(ee,at,"literal"),Q.push(at,ht,ct?"arithmetic":"command-substitution"),at=ht,ee=ht;continue}if(lt==="$"){let mt=dd(O,at,B);if(mt>at+1){Q.push(ee,at,"literal"),Q.push(at,mt,"variable"),at=mt,ee=mt;continue}}if(!je&&(lt==="*"||lt==="?"||lt==="[")){Q.push(ee,at,"literal"),Q.push(at,at+1,"glob"),at++,ee=at;continue}at++}return Q.push(ee,B,"literal"),Q.parts}function _o(O,D){if(D==="command-substitution"||O==="command-substitution")return"command-substitution";if(D==="arithmetic"||O==="arithmetic")return"arithmetic";if(D==="variable"||O==="variable")return"variable";if(D==="glob"||O==="glob")return"glob";return O}function bb(O,D,B){return D+1>=B||Wi(O[D+1]??"")||Li(O,D+1)!==null}var Sb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Cb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function vb(O){let D=0;while(D<=O.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(O[D]?.text??""))D++;if(D===O.length)return!0;let B=Eb(O,D);if(B===void 0||B===null)return!1;D=B}return!1}function Eb(O,D){let B=O[D]?.text.toLowerCase();if(B==="command")return xb(O,D);if(B==="env")return Rb(O,D);if(B==="sudo")return _b(O,D);return}function xb(O,D){if(O[D+1]?.text==="-v")return null;for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(Q==="-p"||Q==="-v"||Q==="-V"||/^-[pvV]+$/.test(Q))continue;return B}return O.length}function Rb(O,D){for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(Sb.has(Q)){if(O[B+1]===void 0)return null;B++;continue}if(Q.startsWith("-u=")||Q.startsWith("--unset=")||Q.startsWith("-C")&&Q.length>2||Q.startsWith("--chdir=")||Q.startsWith("-S")&&Q.length>2||Q.startsWith("--split-string=")||Q.startsWith("-P"))continue;if(Q.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(Q))continue;return B}return O.length}function _b(O,D){for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(Cb.has(Q)){if(O[B+1]===void 0)return null;B++;continue}if(Q.startsWith("-"))continue;return B}return O.length}function md(O,D,B,Q){if(O.provenance!=="literal"||!O.raw.includes("{"))return;let ee=pd(O.raw,D,B,Q,!0);if(!ee)return;if("limited"in ee)return{limited:!0};let he=ee.values.map((je)=>gd(je,B));if(he.some((je)=>je===null))return{limited:!0};return{words:[...new Set(he.filter((je)=>je!==null&&je!==""))]}}function wb(O,D,B,Q,ee){if(D.provenance!=="literal"||!D.raw.includes("{"))return;let he=pd(D.raw,B,Q,ee,!1);if(!he)return;if("limited"in he){if(he.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:he.limited==="length"?"brace-expansion-limit":"word-limit"}}let je=he.values.map((at)=>gd(at,Q));if(je.some((at)=>at===null))return;return{words:je.filter((at)=>at!==null&&at!=="").map((at)=>Ur(O,D.span.start,D.span.end,at,"literal",!1))}}function pd(O,D,B,Q,ee){let he=[O],je=O.length,at=0;while(!0){let lt=he.findIndex((mt)=>id(mt,ee));if(lt===-1)break;if(++at>B)return{limited:"expansions"};let ct=he[lt]??"",ut=id(ct,ee);if(!ut||ut.kind==="range")return{limited:"expansions"};let ft=ut.start+ct.length-ut.end,dt=ut.alternatives.reduce((mt,pt)=>mt+ft+pt.length,0);if(je-ct.length+dt>Q)return{limited:"length"};if(he.length-1+ut.alternatives.length>D)return{limited:"words"};he.splice(lt,1,...Pb(ct,ut)),je+=dt-ct.length}return at===0?void 0:{values:he}}function id(O,D){let B=[],Q,ee=null,he=!1;for(let je=0;je<O.length;je++){let at=O[je];if(he){he=!1;continue}if(at==="\\"&&ee!=="'"){he=!0;continue}if(at===ee){ee=null;continue}if(ee===null&&(at==="'"||at==='"')){ee=at;continue}if(ee!==null)continue;if(at==="{"){B.push({start:je,commas:[]});continue}if(at===","&&B.length>0){B.at(-1)?.commas.push(je);continue}if(at!=="}"||B.length===0)continue;let lt=B.pop();if(!lt)continue;let ct=lt.commas.length>0?{kind:"alternatives",start:lt.start,end:je+1,commas:lt.commas}:D&&Tb(O.slice(lt.start+1,je))?{kind:"range",start:lt.start,end:je+1}:void 0;if(ct&&(!Q||ct.start<Q.start))Q=ct}if(!Q||Q.kind==="range")return Q;return{kind:Q.kind,start:Q.start,end:Q.end,alternatives:Ab(O,Q)}}function Pb(O,D){return D.alternatives.map((B)=>`${O.slice(0,D.start)}${B}${O.slice(D.end)}`)}function Ab(O,D){let B=[D.start,...D.commas,D.end-1];return B.slice(0,-1).map((Q,ee)=>O.slice(Q+1,B[ee+1]))}function Tb(O){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(O)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(O)}function gd(O,D){let B=`x${O}`,Q=Va(B,0,B.length,{maxInputLength:B.length,maxWords:1,maxDepth:D},{used:0,max:1},0);if(Q.limited||Q.issues.length>0||Q.next!==B.length||Q.word.provenance!=="literal")return null;return Q.word.text.slice(1)}function Ib(O,D,B,Q){return ln({kind:"program",dialect:"posix",source:O.slice(D,B),span:{start:D,end:B},status:"limited",issues:[{code:Q,message:"command structure exceeds parser limit"}],nodes:[]})}function Hr(O,D,B,Q,ee){return{nodes:O,issues:[...D,{code:Q,message:`command structure exceeds parser limit ${ee}`}],next:B,closed:!1,limited:!0,pendingHeredocs:[]}}function Di(O,D,B){return{nodes:O,issues:D,next:B,closed:!1,limited:!0,pendingHeredocs:[]}}function Ha(O){return O.used++,O.used<=O.max}function kb(O,D,B){let Q=O.slice(D,B),ee=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(Q)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(Q),he=ee?.[1];if(!ee||!he)return;return{name:he,braceIndex:D+ee[0].lastIndexOf("{")}}function wo(O){return O.some((D)=>{if(D.kind==="command")return D.redirections.some((B)=>B.heredoc)||D.nested.some((B)=>wo(B.nodes));return(D.kind==="group"||D.kind==="function")&&wo(D.body.nodes)})}function Ob(O){return O.map((D)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${D.delimiter} was not found`}))}function hd(O){return O?.kind==="command"||O?.kind==="group"||O?.kind==="function"}function sd(O,D){let B=O.at(-1);if(B?.kind!=="connector"||!ad.has(B.operator))return;D.push({code:"missing-command-after-connector",message:`connector ${B.operator} requires a following command`})}function ja(O,D){if(!hd(O.at(-1)))return;D.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function Mb(O,D,B){return D===B||/[\s;&|()]/u.test(O[D-1]??"")}var bd=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Db=new Set(["gc","cat","type","cp","mv","rm"]),Sd=["-rec","-for","-path","-literalpath","-whatif"],Nb=/^\$env:\w/i,Lb=/^(?:\$\{?\w+\}?|~)\\./;function Cd(O,D){let B=O.toLowerCase().replaceAll("`","");if(![...bd].some((ee)=>B.includes(ee))&&!(B.includes("rm")&&Sd.some((ee)=>B.includes(ee)))&&!B.includes("<#")&&!Wb(B))return!1;let Q=Xa(O,D);if(vd(Q))return!1;return Q.issues.some((ee)=>ee.code==="unclosed-block-comment"||ee.code==="comment-depth-limit")||Za(Q).some(Gb)}function vd(O){return O.nodes.some((D)=>{if(D.kind==="group")return vd(D.body);if(D.kind!=="command")return!1;return D.redirections.some((B)=>B.operator==="<<")})}function Wb(O){if(O.includes("$env:"))return!0;return O.includes("\\")&&(O.includes("$")||O.includes("~"))}function Gb(O){let D=O[0]==="&"||O[0]==="."?1:0,B=O[D]?.toLowerCase();if(B&&bd.has(B))return!0;let Q=O.slice(D+1);if(B&&Db.has(B)&&Q.some(Fb))return!0;if(B!=="rm")return!1;return Q.some((ee)=>{let he=ee.toLowerCase().split(":",1)[0]??"";return Sd.some((je)=>he.startsWith(je))})}function Fb(O){return Nb.test(O)||Lb.test(O)}function Xa(O,D){let B={start:0,end:O.length};if(O.length>D.maxInputLength)return ln({kind:"program",dialect:"powershell",source:O,span:B,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${D.maxInputLength} UTF-16 code units`}],nodes:[]});let Q=Ja(O,0,O.length,D,0);return ln({kind:"program",dialect:"powershell",source:O,span:B,status:Hb(Q.issues,Q.limited),issues:Q.issues,nodes:Q.nodes})}function Ja(O,D,B,Q,ee,he=!1){let je=[],at=[],lt=Ii(),ct=0,ut=!1,ft=()=>{if(lt.words.length===0&&lt.redirections.length===0)return;let mt={start:lt.start,end:lt.end};ki(je,lt,{kind:"command",dialect:"powershell",source:O.slice(mt.start,mt.end),span:mt,words:lt.words,redirections:lt.redirections,nested:lt.nested,displayText:lt.words.map((pt)=>pt.text).join(" ")})},dt=D;while(dt<B){let mt=O[dt];if(!mt)break;if(he&&mt==="}")return ft(),{nodes:je,issues:at,next:dt+1,closed:!0,words:ct,limited:ut};let pt=Ub(O,dt,B,Q.maxDepth);if(pt){if(pt.issue)at.push(pt.issue);if(pt.limited)return ft(),{nodes:je,issues:at,next:pt.next,closed:!1,words:ct,limited:!0};dt=pt.next;continue}if(/\s/.test(mt)){if(mt==="\r"||mt===`
+`?at+2:at+1,ft=ja(O,ut,B,je.splice(0));if(!ft.terminated)return-1;at=ft.next-1;continue}let ct=fd(O,at,D,B,he);if(ct!==null){at=ct;continue}if(!he.double&&O.startsWith("$((",at)){let ut=gb(O,at+3,B);if(ut===-1)return-1;at=ut+1;continue}if(Q===")"&&!he.double&&lt==="<"&&O[at+1]==="<"&&O[at+2]!=="<"){let ut=O[at+2]==="-",ft=at+(ut?3:2);while(ft<B&&/[ \t]/.test(O[ft]??""))ft++;let dt=Ha(O,ft,B);if(dt){je.push({delimiter:dt.delimiter,quotedDelimiter:dt.quoted,stripTabs:ut,attach:()=>{return}}),at=dt.next-1;continue}}if(O.startsWith("$(",at)&&!O.startsWith("$((",at)){ee++,at++;continue}if(lt==="("&&!he.double)ee++;if(lt===")"&&!he.double){if(ee--,ee===0)return Q==="))"&&O[at+1]!==")"?-1:at}}return-1}function gb(O,D,B){let Q=1,ee={single:!1,double:!1};for(let he=D;he<B;he++){let je=O[he],at=fd(O,he,D,B,ee);if(at!==null){he=at;continue}if(O.startsWith("$(",he)&&!O.startsWith("$((",he)){Q++,he++;continue}if(je==="("&&!ee.double)Q++;if(je!==")"||ee.double)continue;if(Q--,Q===0)return O[he+1]===")"?he:-1}return-1}function fd(O,D,B,Q,ee){let he=O[D];if(he==="\\"&&!ee.single)return D+1;if(!ee.double&&he==="'")ee.single=!ee.single;if(!ee.single&&he==='"')ee.double=!ee.double;if(ee.single)return D;if(ee.double||he!=="#"||!Nb(O,D,B))return null;let je=D;while(je+1<Q&&O[je+1]!==`
+`&&O[je+1]!=="\r")je++;return je}function Wi(O,D){let B=O[D];if(B===";")return";";if(B==="&")return O[D+1]==="&"?"&&":"&";if(B==="|")return O[D+1]==="|"?"||":O[D+1]==="&"?"|&":"|";return null}function hb(O,D){let B=O[D];if(B===">"){if(O[D+1]===">")return">>";if(O[D+1]==="&")return">&";return O[D+1]==="|"?">|":">"}if(B!=="<")return null;if(O.startsWith("<<<",D))return"<<<";if(O.startsWith("<<-",D))return"<<-";if(O[D+1]==="<")return"<<";if(O[D+1]==="&")return"<&";if(O[D+1]===">")return"<>";return"<"}function Gi(O){let D=O.charCodeAt(0);if(D===32||D>=9&&D<=13)return!0;if(D<128)return!1;return/\s/u.test(O)}function md(O,D,B){if(O[D+1]==="{"){let ee=O.indexOf("}",D+2);return ee===-1||ee>=B?B:ee+1}let Q=D+1;while(Q<B&&/[A-Za-z0-9_?@#$!*-]/.test(O[Q]??""))Q++;return Q===D+1?D+1:Q}function yb(O,D,B){let Q="",ee=[],he=D;while(he<B){let je=O[he];if(je==="'")return{text:Q,next:he+1,closed:!0,issues:ee};if(je!=="\\"){Q+=je??"",he++;continue}let at=bb(O,he+1,B);if(Q+=at.text,at.invalidCodePoint!==void 0)ee.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${at.invalidCodePoint}`});he=at.next}return{text:Q,next:B,closed:!1,issues:ee}}function bb(O,D,B){let Q=O[D];if(!Q||D>=B)return{text:"\\",next:D};let ee=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(ee.has(Q))return{text:ee.get(Q)??Q,next:D+1};if(Q==="x")return Di(O,D+1,B,16,2,D+1);if(Q==="u")return Di(O,D+1,B,16,4,D+1);if(Q==="U")return Di(O,D+1,B,16,8,D+1);if(/[0-7]/.test(Q))return Di(O,D,B,8,3,D+1);return{text:Q,next:D+1}}function Di(O,D,B,Q,ee,he){let je=Q===16?/[0-9a-fA-F]/:/[0-7]/,at="",lt=D;while(lt<B&&at.length<ee&&je.test(O[lt]??""))at+=O[lt],lt++;if(!at)return{text:O[he-1]??"",next:he};let ct=Number.parseInt(at,Q);return ct>1114111||ct>=55296&&ct<=57343?{text:"�",next:lt,invalidCodePoint:ct}:{text:String.fromCodePoint(ct),next:lt}}function Fi(O,D=!1){if(D)return"limited";if(O.some((B)=>B.code==="invalid-ansi-c-code-point"||B.code==="missing-heredoc-delimiter"||B.code==="ambiguous-heredoc-delimiter"||B.code==="unterminated-heredoc"||B.code==="unsupported-heredoc-context"))return"invalid";return O.length>0?"partial":"complete"}function pd(O,D,B,Q,ee){let he=md(O,D,B);return{text:Q+O.slice(D,he),provenance:_o(ee,"variable"),next:he}}function Sb(O,D,B){let Q=Mi(O),ee=D,he=!1,je=!1,at=D;while(at<B){let lt=O[at];if(lt==="\\"&&!he){at+=2;continue}if(!je&&lt==="'"){he=!he,at++;continue}if(!he&&lt==='"'){je=!je,at++;continue}if(he){at++;continue}let ct=O.startsWith("$((",at),ut=O.startsWith("$(",at)&&!ct,ft=!je&&(O.startsWith("<(",at)||O.startsWith(">(",at)),dt=lt==="`";if(ct||ut||ft||dt){let mt=ct?3:dt?1:2,pt=ct?"))":dt?"`":")",gt=Ya(O,at+mt,B,pt),ht=gt===-1?B:gt+pt.length;Q.push(ee,at,"literal"),Q.push(at,ht,ct?"arithmetic":"command-substitution"),at=ht,ee=ht;continue}if(lt==="$"){let mt=md(O,at,B);if(mt>at+1){Q.push(ee,at,"literal"),Q.push(at,mt,"variable"),at=mt,ee=mt;continue}}if(!je&&(lt==="*"||lt==="?"||lt==="[")){Q.push(ee,at,"literal"),Q.push(at,at+1,"glob"),at++,ee=at;continue}at++}return Q.push(ee,B,"literal"),Q.parts}function _o(O,D){if(D==="command-substitution"||O==="command-substitution")return"command-substitution";if(D==="arithmetic"||O==="arithmetic")return"arithmetic";if(D==="variable"||O==="variable")return"variable";if(D==="glob"||O==="glob")return"glob";return O}function Cb(O,D,B){return D+1>=B||Gi(O[D+1]??"")||Wi(O,D+1)!==null}var vb=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Eb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function xb(O){let D=0;while(D<=O.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(O[D]?.text??""))D++;if(D===O.length)return!0;let B=Rb(O,D);if(B===void 0||B===null)return!1;D=B}return!1}function Rb(O,D){let B=O[D]?.text.toLowerCase();if(B==="command")return _b(O,D);if(B==="env")return wb(O,D);if(B==="sudo")return Pb(O,D);return}function _b(O,D){if(O[D+1]?.text==="-v")return null;for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(Q==="-p"||Q==="-v"||Q==="-V"||/^-[pvV]+$/.test(Q))continue;return B}return O.length}function wb(O,D){for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(vb.has(Q)){if(O[B+1]===void 0)return null;B++;continue}if(Q.startsWith("-u=")||Q.startsWith("--unset=")||Q.startsWith("-C")&&Q.length>2||Q.startsWith("--chdir=")||Q.startsWith("-S")&&Q.length>2||Q.startsWith("--split-string=")||Q.startsWith("-P"))continue;if(Q.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(Q))continue;return B}return O.length}function Pb(O,D){for(let B=D+1;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return B+1;if(Eb.has(Q)){if(O[B+1]===void 0)return null;B++;continue}if(Q.startsWith("-"))continue;return B}return O.length}function gd(O,D,B,Q){if(O.provenance!=="literal"||!O.raw.includes("{"))return;let ee=hd(O.raw,D,B,Q,!0);if(!ee)return;if("limited"in ee)return{limited:!0};let he=ee.values.map((je)=>yd(je,B));if(he.some((je)=>je===null))return{limited:!0};return{words:[...new Set(he.filter((je)=>je!==null&&je!==""))]}}function Ab(O,D,B,Q,ee){if(D.provenance!=="literal"||!D.raw.includes("{"))return;let he=hd(D.raw,B,Q,ee,!1);if(!he)return;if("limited"in he){if(he.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:he.limited==="length"?"brace-expansion-limit":"word-limit"}}let je=he.values.map((at)=>yd(at,Q));if(je.some((at)=>at===null))return;return{words:je.filter((at)=>at!==null&&at!=="").map((at)=>Ur(O,D.span.start,D.span.end,at,"literal",!1))}}function hd(O,D,B,Q,ee){let he=[O],je=O.length,at=0;while(!0){let lt=he.findIndex((mt)=>ad(mt,ee));if(lt===-1)break;if(++at>B)return{limited:"expansions"};let ct=he[lt]??"",ut=ad(ct,ee);if(!ut||ut.kind==="range")return{limited:"expansions"};let ft=ut.start+ct.length-ut.end,dt=ut.alternatives.reduce((mt,pt)=>mt+ft+pt.length,0);if(je-ct.length+dt>Q)return{limited:"length"};if(he.length-1+ut.alternatives.length>D)return{limited:"words"};he.splice(lt,1,...Tb(ct,ut)),je+=dt-ct.length}return at===0?void 0:{values:he}}function ad(O,D){let B=[],Q,ee=null,he=!1;for(let je=0;je<O.length;je++){let at=O[je];if(he){he=!1;continue}if(at==="\\"&&ee!=="'"){he=!0;continue}if(at===ee){ee=null;continue}if(ee===null&&(at==="'"||at==='"')){ee=at;continue}if(ee!==null)continue;if(at==="{"){B.push({start:je,commas:[]});continue}if(at===","&&B.length>0){B.at(-1)?.commas.push(je);continue}if(at!=="}"||B.length===0)continue;let lt=B.pop();if(!lt)continue;let ct=lt.commas.length>0?{kind:"alternatives",start:lt.start,end:je+1,commas:lt.commas}:D&&kb(O.slice(lt.start+1,je))?{kind:"range",start:lt.start,end:je+1}:void 0;if(ct&&(!Q||ct.start<Q.start))Q=ct}if(!Q||Q.kind==="range")return Q;return{kind:Q.kind,start:Q.start,end:Q.end,alternatives:Ib(O,Q)}}function Tb(O,D){return D.alternatives.map((B)=>`${O.slice(0,D.start)}${B}${O.slice(D.end)}`)}function Ib(O,D){let B=[D.start,...D.commas,D.end-1];return B.slice(0,-1).map((Q,ee)=>O.slice(Q+1,B[ee+1]))}function kb(O){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(O)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(O)}function yd(O,D){let B=`x${O}`,Q=qa(B,0,B.length,{maxInputLength:B.length,maxWords:1,maxDepth:D},{used:0,max:1},0);if(Q.limited||Q.issues.length>0||Q.next!==B.length||Q.word.provenance!=="literal")return null;return Q.word.text.slice(1)}function Ob(O,D,B,Q){return ln({kind:"program",dialect:"posix",source:O.slice(D,B),span:{start:D,end:B},status:"limited",issues:[{code:Q,message:"command structure exceeds parser limit"}],nodes:[]})}function Hr(O,D,B,Q,ee){return{nodes:O,issues:[...D,{code:Q,message:`command structure exceeds parser limit ${ee}`}],next:B,closed:!1,limited:!0,pendingHeredocs:[]}}function Ni(O,D,B){return{nodes:O,issues:D,next:B,closed:!1,limited:!0,pendingHeredocs:[]}}function Va(O){return O.used++,O.used<=O.max}function Mb(O,D,B){let Q=O.slice(D,B),ee=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(Q)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(Q),he=ee?.[1];if(!ee||!he)return;return{name:he,braceIndex:D+ee[0].lastIndexOf("{")}}function wo(O){return O.some((D)=>{if(D.kind==="command")return D.redirections.some((B)=>B.heredoc)||D.nested.some((B)=>wo(B.nodes));return(D.kind==="group"||D.kind==="function")&&wo(D.body.nodes)})}function Db(O){return O.map((D)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${D.delimiter} was not found`}))}function bd(O){return O?.kind==="command"||O?.kind==="group"||O?.kind==="function"}function ld(O,D){let B=O.at(-1);if(B?.kind!=="connector"||!cd.has(B.operator))return;D.push({code:"missing-command-after-connector",message:`connector ${B.operator} requires a following command`})}function Ka(O,D){if(!bd(O.at(-1)))return;D.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function Nb(O,D,B){return D===B||/[\s;&|()]/u.test(O[D-1]??"")}var Cd=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Lb=new Set(["gc","cat","type","cp","mv","rm"]),vd=["-rec","-for","-path","-literalpath","-whatif"],Wb=/^\$env:\w/i,Gb=/^(?:\$\{?\w+\}?|~)\\./;function Ed(O,D){let B=O.toLowerCase().replaceAll("`","");if(![...Cd].some((ee)=>B.includes(ee))&&!(B.includes("rm")&&vd.some((ee)=>B.includes(ee)))&&!B.includes("<#")&&!Fb(B))return!1;let Q=Qa(O,D);if(xd(Q))return!1;return Q.issues.some((ee)=>ee.code==="unclosed-block-comment"||ee.code==="comment-depth-limit")||Ja(Q).some(zb)}function xd(O){return O.nodes.some((D)=>{if(D.kind==="group")return xd(D.body);if(D.kind!=="command")return!1;return D.redirections.some((B)=>B.operator==="<<")})}function Fb(O){if(O.includes("$env:"))return!0;return O.includes("\\")&&(O.includes("$")||O.includes("~"))}function zb(O){let D=O[0]==="&"||O[0]==="."?1:0,B=O[D]?.toLowerCase();if(B&&Cd.has(B))return!0;let Q=O.slice(D+1);if(B&&Lb.has(B)&&Q.some(Bb))return!0;if(B!=="rm")return!1;return Q.some((ee)=>{let he=ee.toLowerCase().split(":",1)[0]??"";return vd.some((je)=>he.startsWith(je))})}function Bb(O){return Wb.test(O)||Gb.test(O)}function Qa(O,D){let B={start:0,end:O.length};if(O.length>D.maxInputLength)return ln({kind:"program",dialect:"powershell",source:O,span:B,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${D.maxInputLength} UTF-16 code units`}],nodes:[]});let Q=el(O,0,O.length,D,0);return ln({kind:"program",dialect:"powershell",source:O,span:B,status:Vb(Q.issues,Q.limited),issues:Q.issues,nodes:Q.nodes})}function el(O,D,B,Q,ee,he=!1){let je=[],at=[],lt=ki(),ct=0,ut=!1,ft=()=>{if(lt.words.length===0&&lt.redirections.length===0)return;let mt={start:lt.start,end:lt.end};Oi(je,lt,{kind:"command",dialect:"powershell",source:O.slice(mt.start,mt.end),span:mt,words:lt.words,redirections:lt.redirections,nested:lt.nested,displayText:lt.words.map((pt)=>pt.text).join(" ")})},dt=D;while(dt<B){let mt=O[dt];if(!mt)break;if(he&&mt==="}")return ft(),{nodes:je,issues:at,next:dt+1,closed:!0,words:ct,limited:ut};let pt=jb(O,dt,B,Q.maxDepth);if(pt){if(pt.issue)at.push(pt.issue);if(pt.limited)return ft(),{nodes:je,issues:at,next:pt.next,closed:!1,words:ct,limited:!0};dt=pt.next;continue}if(/\s/.test(mt)){if(mt==="\r"||mt===`
 `){ft();let yt=mt==="\r"&&O[dt+1]===`
-`?dt+2:dt+1;je.push(qa(O,dt,yt)),dt=yt;continue}dt++;continue}let gt=Rd(O,dt);if(gt){ft(),je.push(qa(O,dt,dt+gt.length)),dt+=gt.length;continue}if(mt==="{"){if(ft(),ee>=Q.maxDepth)return at.push(xd(Q.maxDepth)),{nodes:je,issues:at,next:B,closed:!1,words:ct,limited:!0};let yt=Ja(O,dt+1,B,Q,ee+1,!0),Ct=yt.closed?yt.next-1:yt.next,Et=ln({kind:"program",dialect:"powershell",source:O.slice(dt+1,Ct),span:{start:dt+1,end:Ct},status:yt.limited?"limited":yt.issues.length>0?"partial":"complete",issues:yt.issues,nodes:yt.nodes});if(je.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:dt,end:yt.next}),body:Et})),at.push(...yt.issues),!yt.closed)at.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ct+=yt.words,ut||=yt.limited,dt=yt.next;continue}if(mt==="}"){ft(),je.push(qa(O,dt,dt+1)),dt++;continue}if(mt===">"||mt==="<"){lt.start=lt.start===-1?dt:lt.start;let yt=O[dt+1]===mt?dt+2:dt+1,Ct=yt;while(/[ \t]/.test(O[Ct]??""))Ct++;let Et=Ct<B?yd(O,Ct,B,Q,ee):void 0,vt=Et?.next??yt;if(lt.redirections.push(Object.freeze({kind:"redirection",operator:O.slice(dt,yt),span:Object.freeze({start:dt,end:vt}),...Et?{target:Et.word}:{}})),Et)at.push(...Et.issues),lt.nested.push(...Et.nested),ct+=Et.words,ut||=Et.limited;lt.end=vt,dt=vt;continue}if(mt===","){lt.start=lt.start===-1?dt:lt.start,lt.words.push(Ba({text:",",raw:",",span:{start:dt,end:dt+1},provenance:"literal",quoted:!1})),lt.end=++dt;continue}let ht=yd(O,dt,B,Q,ee);if(lt.start=lt.start===-1?dt:lt.start,lt.end=ht.next,lt.words.push(ht.word),at.push(...ht.issues),lt.nested.push(...ht.nested),ct+=1+ht.words,ut||=ht.limited,ct>Q.maxWords)return at.push({code:"word-limit",message:`command exceeds ${Q.maxWords} words`}),ft(),{nodes:je,issues:at,next:ht.next,closed:!1,words:ct,limited:!0};dt=ht.next>dt?ht.next:dt+1}return ft(),{nodes:je,issues:at,next:dt,closed:!he,words:ct,limited:ut}}function yd(O,D,B,Q,ee){let he="",je="literal",at=!1,lt=[],ct=[],ut=0,ft=!1,dt=(pt)=>{let gt=zb(O,pt,B,Q,ee);return he+=O.slice(pt,gt.next),ct.push(gt.program),lt.push(...gt.program.issues),ut+=Ya(gt.program),ft||=gt.program.status==="limited",je="command-substitution",gt.next},mt=D;while(mt<B){let pt=O[mt];if(!pt||/\s/.test(pt)||Rd(O,mt)||pt===">"||pt==="<"||pt==="#")break;if(pt===",")break;if(pt==="`"){let gt=O[mt+1];if(!gt){lt.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),mt++;break}he+=gt,mt+=2;continue}if(O.startsWith("$(",mt)){mt=dt(mt);continue}if(pt==="'"){at=!0,mt++;let gt=!1;while(mt<O.length){if(O[mt]==="'"&&O[mt+1]==="'"){he+="'",mt+=2;continue}if(O[mt]==="'"){gt=!0,mt++;break}he+=O[mt]??"",mt++}if(!gt)lt.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(pt==='"'){at=!0,mt++;let gt=!1;while(mt<B){let ht=O[mt];if(ht==="`"&&O[mt+1]){he+=O[mt+1],mt+=2;continue}if(ht==='"'){gt=!0,mt++;break}if(O.startsWith("$(",mt)){mt=dt(mt);continue}if(ht==="$")je=O[mt+1]==="("?"command-substitution":"variable";he+=ht??"",mt++}if(!gt)lt.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(pt==="$")je=O[mt+1]==="("?"command-substitution":"variable";if(pt==="@"&&mt===D)je="variable";he+=pt,mt++}return{word:Ur(O,D,mt,he,je,at,je==="literal"?void 0:Bb(O,D,mt)),next:mt,issues:lt,nested:ct,words:ut,limited:ft}}function zb(O,D,B,Q,ee){let he=Ed(O,D+2,B),je=he===-1?B:he,at=he===-1?B:he+1;if(ee>=Q.maxDepth)return{program:ln({kind:"program",dialect:"powershell",source:O.slice(D+2,je),span:{start:D+2,end:je},status:"limited",issues:[xd(Q.maxDepth)],nodes:[]}),next:at};let lt=Ja(O,D+2,je,Q,ee+1),ct=he===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:ln({kind:"program",dialect:"powershell",source:O.slice(D+2,je),span:{start:D+2,end:je},status:lt.limited?"limited":lt.issues.length+ct.length>0?"partial":"complete",issues:[...lt.issues,...ct],nodes:lt.nodes}),next:at}}function Ed(O,D,B){let Q=1,ee=!1,he=!1;for(let je=D;je<B;je++){let at=O[je];if(at==="`"){je++;continue}if(!he&&at==="'"){if(ee&&O[je+1]==="'"){je++;continue}ee=!ee;continue}if(!ee&&at==='"'){he=!he;continue}if(ee)continue;if(O.startsWith("$(",je)){Q++,je++;continue}if(!he&&at==="(")Q++;if(at!==")")continue;if(Q--,Q===0)return je}return-1}function Ya(O){let D=0;for(let B of O.nodes){if(B.kind==="group")D+=Ya(B.body);if(B.kind==="command"){D+=B.words.length;for(let Q of B.nested)D+=Ya(Q)}}return D}function Bb(O,D,B){let Q=Oi(O),ee=D,he=!1,je=D;while(je<B){let at=O[je];if(at==="`"){je+=2;continue}if(at==="'"){if(he&&O[je+1]==="'"){je+=2;continue}he=!he,je++;continue}if(he){je++;continue}if(O.startsWith("$(",je)){let lt=Ed(O,je+2,B),ct=lt===-1?B:lt+1;Q.push(ee,je,"literal"),Q.push(je,ct,"command-substitution"),je=ct,ee=ct;continue}if(at==="$"||at==="@"&&je===D){let lt=$b(O,je+1,B);Q.push(ee,je,"literal"),Q.push(je,lt,"variable"),je=lt,ee=lt;continue}je++}return Q.push(ee,B,"literal"),Q.parts}function $b(O,D,B){if(O[D]==="{"){let ee=O.indexOf("}",D+1);return ee===-1||ee>=B?B:ee+1}let Q=D;while(Q<B&&/[A-Za-z0-9_:?]/.test(O[Q]??""))Q++;return Q}function xd(O){return{code:"depth-limit",message:`command structure exceeds parser limit ${O}`}}function Za(O){return O.nodes.flatMap((D)=>{if(D.kind==="group")return Za(D.body);if(D.kind!=="command")return[];return[[...D.words,...D.redirections.flatMap((B)=>B.target?[B.target]:[])].sort((B,Q)=>B.span.start-Q.span.start).filter((B)=>B.text!==""&&B.raw!==",").map((B)=>B.text),...D.nested.flatMap(Za)]})}function Rd(O,D){for(let B of["&&","||",";","|"])if(O.startsWith(B,D))return B;return null}function Ub(O,D,B,Q){if(O[D]==="#"&&O[D+1]!==">"){let je=D+1;while(je<B&&O[je]!=="\r"&&O[je]!==`
-`)je++;return{next:je,limited:!1}}if(!O.startsWith("<#",D))return null;let ee=1,he=D+2;while(he<B){if(O.startsWith("<#",he)){if(ee++,ee>Q)return{next:B,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${Q}`},limited:!0};he+=2;continue}if(O.startsWith("#>",he)){if(ee--,he+=2,ee===0)return{next:he,limited:!1};continue}he++}return{next:B,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Hb(O,D){if(D)return"limited";if(O.some((B)=>B.code==="unclosed-block-comment"))return"invalid";return O.length>0?"partial":"complete"}function qa(O,D,B){return Object.freeze({kind:"connector",operator:O.slice(D,B),span:Object.freeze({start:D,end:B})})}function h(O,D="auto",B=tr){if(D==="powershell"||D==="auto"&&Cd(O.slice(0,B.maxInputLength),B))return Xa(O,B);return ld(O,B)}function t(O){return O.provenance==="command-substitution"?O.raw:O.text}function X(O,D){return O==="posix"?D:$t(D.map((B)=>B.text))}function zi(O,D){return O&&O.provenance!=="unknown"?O.provenance==="literal":!/[$`*?[\]]/.test(D)}function $t(O){return O.map((D)=>({kind:"word",text:D,raw:D,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Qa(O,D){return{value:O,work:D}}function bt(O,D){if(O.work)O.work.units=Math.min(Number.MAX_SAFE_INTEGER,O.work.units+1);return O.value[D]}function Ht(O){return O.value.length}function Po(O,D,B=1){if(O)O.units=Math.min(Number.MAX_SAFE_INTEGER,O.units+D.length*B)}function bn(O,D){Po(O,D)}function br(O){if(!O)return!1;let D=O.charCodeAt(0);return D>=48&&D<=57||D>=65&&D<=90||D===95||D>=97&&D<=122}function zt(O){if(!O)return!1;let D=O.charCodeAt(0);return D===9||D===10||D===11||D===12||D===13||D===32||D===160||D===65279||D===5760||D>=8192&&D<=8202||D===8232||D===8233||D===8239||D===8287||D===12288}function el(O){return O===`
+`?dt+2:dt+1;je.push(Za(O,dt,yt)),dt=yt;continue}dt++;continue}let gt=wd(O,dt);if(gt){ft(),je.push(Za(O,dt,dt+gt.length)),dt+=gt.length;continue}if(mt==="{"){if(ft(),ee>=Q.maxDepth)return at.push(_d(Q.maxDepth)),{nodes:je,issues:at,next:B,closed:!1,words:ct,limited:!0};let yt=el(O,dt+1,B,Q,ee+1,!0),Ct=yt.closed?yt.next-1:yt.next,Et=ln({kind:"program",dialect:"powershell",source:O.slice(dt+1,Ct),span:{start:dt+1,end:Ct},status:yt.limited?"limited":yt.issues.length>0?"partial":"complete",issues:yt.issues,nodes:yt.nodes});if(je.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:dt,end:yt.next}),body:Et})),at.push(...yt.issues),!yt.closed)at.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});ct+=yt.words,ut||=yt.limited,dt=yt.next;continue}if(mt==="}"){ft(),je.push(Za(O,dt,dt+1)),dt++;continue}if(mt===">"||mt==="<"){lt.start=lt.start===-1?dt:lt.start;let yt=O[dt+1]===mt?dt+2:dt+1,Ct=yt;while(/[ \t]/.test(O[Ct]??""))Ct++;let Et=Ct<B?Sd(O,Ct,B,Q,ee):void 0,vt=Et?.next??yt;if(lt.redirections.push(Object.freeze({kind:"redirection",operator:O.slice(dt,yt),span:Object.freeze({start:dt,end:vt}),...Et?{target:Et.word}:{}})),Et)at.push(...Et.issues),lt.nested.push(...Et.nested),ct+=Et.words,ut||=Et.limited;lt.end=vt,dt=vt;continue}if(mt===","){lt.start=lt.start===-1?dt:lt.start,lt.words.push(Ua({text:",",raw:",",span:{start:dt,end:dt+1},provenance:"literal",quoted:!1})),lt.end=++dt;continue}let ht=Sd(O,dt,B,Q,ee);if(lt.start=lt.start===-1?dt:lt.start,lt.end=ht.next,lt.words.push(ht.word),at.push(...ht.issues),lt.nested.push(...ht.nested),ct+=1+ht.words,ut||=ht.limited,ct>Q.maxWords)return at.push({code:"word-limit",message:`command exceeds ${Q.maxWords} words`}),ft(),{nodes:je,issues:at,next:ht.next,closed:!1,words:ct,limited:!0};dt=ht.next>dt?ht.next:dt+1}return ft(),{nodes:je,issues:at,next:dt,closed:!he,words:ct,limited:ut}}function Sd(O,D,B,Q,ee){let he="",je="literal",at=!1,lt=[],ct=[],ut=0,ft=!1,dt=(pt)=>{let gt=$b(O,pt,B,Q,ee);return he+=O.slice(pt,gt.next),ct.push(gt.program),lt.push(...gt.program.issues),ut+=Xa(gt.program),ft||=gt.program.status==="limited",je="command-substitution",gt.next},mt=D;while(mt<B){let pt=O[mt];if(!pt||/\s/.test(pt)||wd(O,mt)||pt===">"||pt==="<"||pt==="#")break;if(pt===",")break;if(pt==="`"){let gt=O[mt+1];if(!gt){lt.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),mt++;break}he+=gt,mt+=2;continue}if(O.startsWith("$(",mt)){mt=dt(mt);continue}if(pt==="'"){at=!0,mt++;let gt=!1;while(mt<O.length){if(O[mt]==="'"&&O[mt+1]==="'"){he+="'",mt+=2;continue}if(O[mt]==="'"){gt=!0,mt++;break}he+=O[mt]??"",mt++}if(!gt)lt.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(pt==='"'){at=!0,mt++;let gt=!1;while(mt<B){let ht=O[mt];if(ht==="`"&&O[mt+1]){he+=O[mt+1],mt+=2;continue}if(ht==='"'){gt=!0,mt++;break}if(O.startsWith("$(",mt)){mt=dt(mt);continue}if(ht==="$")je=O[mt+1]==="("?"command-substitution":"variable";he+=ht??"",mt++}if(!gt)lt.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(pt==="$")je=O[mt+1]==="("?"command-substitution":"variable";if(pt==="@"&&mt===D)je="variable";he+=pt,mt++}return{word:Ur(O,D,mt,he,je,at,je==="literal"?void 0:Ub(O,D,mt)),next:mt,issues:lt,nested:ct,words:ut,limited:ft}}function $b(O,D,B,Q,ee){let he=Rd(O,D+2,B),je=he===-1?B:he,at=he===-1?B:he+1;if(ee>=Q.maxDepth)return{program:ln({kind:"program",dialect:"powershell",source:O.slice(D+2,je),span:{start:D+2,end:je},status:"limited",issues:[_d(Q.maxDepth)],nodes:[]}),next:at};let lt=el(O,D+2,je,Q,ee+1),ct=he===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:ln({kind:"program",dialect:"powershell",source:O.slice(D+2,je),span:{start:D+2,end:je},status:lt.limited?"limited":lt.issues.length+ct.length>0?"partial":"complete",issues:[...lt.issues,...ct],nodes:lt.nodes}),next:at}}function Rd(O,D,B){let Q=1,ee=!1,he=!1;for(let je=D;je<B;je++){let at=O[je];if(at==="`"){je++;continue}if(!he&&at==="'"){if(ee&&O[je+1]==="'"){je++;continue}ee=!ee;continue}if(!ee&&at==='"'){he=!he;continue}if(ee)continue;if(O.startsWith("$(",je)){Q++,je++;continue}if(!he&&at==="(")Q++;if(at!==")")continue;if(Q--,Q===0)return je}return-1}function Xa(O){let D=0;for(let B of O.nodes){if(B.kind==="group")D+=Xa(B.body);if(B.kind==="command"){D+=B.words.length;for(let Q of B.nested)D+=Xa(Q)}}return D}function Ub(O,D,B){let Q=Mi(O),ee=D,he=!1,je=D;while(je<B){let at=O[je];if(at==="`"){je+=2;continue}if(at==="'"){if(he&&O[je+1]==="'"){je+=2;continue}he=!he,je++;continue}if(he){je++;continue}if(O.startsWith("$(",je)){let lt=Rd(O,je+2,B),ct=lt===-1?B:lt+1;Q.push(ee,je,"literal"),Q.push(je,ct,"command-substitution"),je=ct,ee=ct;continue}if(at==="$"||at==="@"&&je===D){let lt=Hb(O,je+1,B);Q.push(ee,je,"literal"),Q.push(je,lt,"variable"),je=lt,ee=lt;continue}je++}return Q.push(ee,B,"literal"),Q.parts}function Hb(O,D,B){if(O[D]==="{"){let ee=O.indexOf("}",D+1);return ee===-1||ee>=B?B:ee+1}let Q=D;while(Q<B&&/[A-Za-z0-9_:?]/.test(O[Q]??""))Q++;return Q}function _d(O){return{code:"depth-limit",message:`command structure exceeds parser limit ${O}`}}function Ja(O){return O.nodes.flatMap((D)=>{if(D.kind==="group")return Ja(D.body);if(D.kind!=="command")return[];return[[...D.words,...D.redirections.flatMap((B)=>B.target?[B.target]:[])].sort((B,Q)=>B.span.start-Q.span.start).filter((B)=>B.text!==""&&B.raw!==",").map((B)=>B.text),...D.nested.flatMap(Ja)]})}function wd(O,D){for(let B of["&&","||",";","|"])if(O.startsWith(B,D))return B;return null}function jb(O,D,B,Q){if(O[D]==="#"&&O[D+1]!==">"){let je=D+1;while(je<B&&O[je]!=="\r"&&O[je]!==`
+`)je++;return{next:je,limited:!1}}if(!O.startsWith("<#",D))return null;let ee=1,he=D+2;while(he<B){if(O.startsWith("<#",he)){if(ee++,ee>Q)return{next:B,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${Q}`},limited:!0};he+=2;continue}if(O.startsWith("#>",he)){if(ee--,he+=2,ee===0)return{next:he,limited:!1};continue}he++}return{next:B,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Vb(O,D){if(D)return"limited";if(O.some((B)=>B.code==="unclosed-block-comment"))return"invalid";return O.length>0?"partial":"complete"}function Za(O,D,B){return Object.freeze({kind:"connector",operator:O.slice(D,B),span:Object.freeze({start:D,end:B})})}function h(O,D="auto",B=tr){if(D==="powershell"||D==="auto"&&Ed(O.slice(0,B.maxInputLength),B))return Qa(O,B);return ud(O,B)}function t(O){return O.provenance==="command-substitution"?O.raw:O.text}function X(O,D){return O==="posix"?D:$t(D.map((B)=>B.text))}function Bi(O,D){return O&&O.provenance!=="unknown"?O.provenance==="literal":!/[$`*?[\]]/.test(D)}function $t(O){return O.map((D)=>({kind:"word",text:D,raw:D,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function tl(O,D){return{value:O,work:D}}function bt(O,D){if(O.work)O.work.units=Math.min(Number.MAX_SAFE_INTEGER,O.work.units+1);return O.value[D]}function Ht(O){return O.value.length}function Po(O,D,B=1){if(O)O.units=Math.min(Number.MAX_SAFE_INTEGER,O.units+D.length*B)}function bn(O,D){Po(O,D)}function br(O){if(!O)return!1;let D=O.charCodeAt(0);return D>=48&&D<=57||D>=65&&D<=90||D===95||D>=97&&D<=122}function zt(O){if(!O)return!1;let D=O.charCodeAt(0);return D===9||D===10||D===11||D===12||D===13||D===32||D===160||D===65279||D===5760||D>=8192&&D<=8202||D===8232||D===8233||D===8239||D===8287||D===12288}function nl(O){return O===`
 `||O==="\r"||O==="\u2028"||O==="\u2029"}function Bt(O,D,B){if(D+B.length>Ht(O))return!1;for(let Q=0;Q<B.length;Q++)if(bt(O,D+Q)!==B[Q])return!1;return!0}function Un(O,D,B){return!br(bt(O,D-1))&&Bt(O,D,B)&&!br(bt(O,D+B.length))}function Hn(O,D){return br(bt(O,D-1))!==br(bt(O,D))}function Qt(O){return O===`
-`||O===";"||O==="&"||O==="|"}function jr(O){return O==="|"||O===";"}function Bi(O,D,B){let Q=Qa(O,B);if(D==="rm")return jb(Q);if(D==="dd")return Kb(Q);return Id(Q,!0)}function $i(O,D,B){let Q=Qa(O,B);if(D==="rm")return qb(Q);if(D==="reset-hard")return Ad(Q,"--ha","rd");if(D==="reset-merge")return Ad(Q,"--me","rge");if(D==="clean")return Jb(Q);if(D==="checkout")return eS(Q);if(D==="push-force")return tS(Q);if(D==="push-refspec")return nS(Q);if(D==="push-delete")return rS(Q);if(D==="branch")return oS(Q);if(D==="tag")return aS(Q);if(D==="restore")return lS(Q);return Id(Q,!1)}function jb(O){let D=!1,B=!1,Q=!1,ee=-1;for(let he=0;he<=Ht(O);he++){let je=bt(O,he);if(!D){let lt=bt(O,he+2);if(Un(O,he,"rm")&&zt(lt)&&lt!==`
-`)D=!0,he++;continue}let at=Vb(O,he);if(je===`
-`||at!==-1){if(D=!1,B=!1,Q=!1,ee=-1,at!==-1)he=at-1;continue}if(je===";"||je==="&"||je==="|"||he===Ht(O)){if(ee>=0){let lt=_d(O,ee,he);B||=lt.recursive,Q||=lt.force}if(B&&Q)return!0;D=!1,B=!1,Q=!1,ee=-1;continue}if(zt(je)){if(ee<0)continue;if(Bt(O,ee,"--")&&he-ee===2){D=!1,B=!1,Q=!1,ee=-1;continue}let lt=_d(O,ee,he);if(B||=lt.recursive,Q||=lt.force,B&&Q)return!0;ee=-1;continue}if(ee<0)ee=he}return!1}function Vb(O,D){if(bt(O,D)!=="\\"||bt(O,D-1)==="\\")return-1;if(Bt(O,D,String.raw`\n`))return D+2;if(Bt(O,D,String.raw`\x0a`)||Bt(O,D,String.raw`\x0A`))return D+5;if(Bt(O,D,String.raw`\u000a`)||Bt(O,D,String.raw`\u000A`))return D+7;return Bt(O,D,String.raw`\012`)?D+4:-1}function _d(O,D,B){if(wd(O,D,B,"recursive"))return{recursive:!0,force:!1};if(wd(O,D,B,"force"))return{recursive:!1,force:!0};if(bt(O,D)!=="-"||bt(O,D+1)==="-")return{recursive:!1,force:!1};let Q=!1,ee=!1;for(let he=D+1;he<B;he++){let je=bt(O,he);Q||=je==="r"||je==="R",ee||=je==="f"||je==="F"}return{recursive:Q,force:ee}}function wd(O,D,B,Q){let ee=B-D-2;if(ee<1||ee>Q.length||!Bt(O,D,"--"))return!1;for(let he=0;he<ee;he++)if(bt(O,D+he+2)!==Q[he])return!1;return!0}function Kb(O){let D=!1;for(let B=0;B<Ht(O);B++){if(Qt(bt(O,B))){D=!1;continue}if(Un(O,B,"dd")){D=!0,B++;continue}if(!D||!Un(O,B,"of")||!Bt(O,B,"of=/dev/"))continue;let Q=B+8;if(Q<Ht(O)&&!zt(bt(O,Q))&&bt(O,Q)!=="'"&&bt(O,Q)!=='"')return!0}return!1}function qb(O){let D=!1,B=!1,Q=!1;for(let ee=0;ee<=Ht(O);){let he=bt(O,ee);if(ee===Ht(O)||Qt(he)){D=!1,B=!1,Q=!1,ee++;continue}let je=Zb(O,ee);if(je>=0){if(Yb(O,je))return!0;let at=je,lt=!1;while(zt(bt(O,at)))lt||=bt(O,at)===`
-`,at++;if(lt)B=!1,Q=!1;D=!0,ee=at;continue}if(!D){ee++;continue}if(Bt(O,ee,"--")&&(ee===0||zt(bt(O,ee-1)))&&(!bt(O,ee+2)||zt(bt(O,ee+2))||Qt(bt(O,ee+2)))){D=!1,B=!1,Q=!1,ee+=2;continue}if(B||=Bt(O,ee,"--recursive")&&Hn(O,ee+11)||tl(O,ee,"recursive"),Q||=Bt(O,ee,"--force")&&Hn(O,ee+7)||tl(O,ee,"force"),B&&Q)return!0;ee++}return!1}function tl(O,D,B){if(!Bt(O,D,"--"))return!1;let Q=0;while(Q<=B.length){let ee=bt(O,D+Q+2);if(!ee||zt(ee)||Qt(ee))break;if(ee!==B[Q])return!1;Q++}return Q>0&&Hn(O,D+Q+2)}function Yb(O,D){let B=D,Q=!1,ee=!1;while(B<Ht(O)){while(zt(bt(O,B)))B++;let he=B;while(B<Ht(O)&&!zt(bt(O,B)))B++;if(bt(O,he)!=="-"||B-he===2&&Bt(O,he,"--"))return!1;let je=Pd(O,he,"recursive"),at=Pd(O,he,"force");if(Q&&at||ee&&je)return!0;if(Q||=je,ee||=at,bt(O,he+1)==="-")continue;let lt=Xb(O,he,B);if(lt.combined||Q&&lt.forceAtBoundary||ee&&lt.recursiveAtBoundary)return!0;Q||=lt.recursive,ee||=lt.force}return!1}function Pd(O,D,B){return Bt(O,D,`--${B}`)&&Hn(O,D+B.length+2)||tl(O,D,B)}function Zb(O,D){if(D>0&&br(bt(O,D-1)))return-1;let B=D;if(bt(O,B)==="\\")B++;if(bt(O,B)!=="r")return-1;if(B++,bt(O,B)==="\\")B++;if(bt(O,B)!=="m"||!zt(bt(O,B+1)))return-1;return B+1}function Xb(O,D,B){let Q=!1,ee=!1,he=!1,je=!1,at=!1;if(bt(O,D)!=="-")return{recursive:Q,force:ee,recursiveAtBoundary:he,forceAtBoundary:je,combined:at};let lt="";for(let ct=D+1;ct<B;ct++){let ut=bt(O,ct)??"",ft=(ut==="r"||ut==="f")&&Hn(O,ct+1);Q||=ut==="r",ee||=ut==="f",he||=ut==="r"&&ft,je||=ut==="f"&&ft,at||=(lt==="r"&&ut==="f"||lt==="f"&&ut==="r")&&ft,lt=ut}return{recursive:Q,force:ee,recursiveAtBoundary:he,forceAtBoundary:je,combined:at}}function Ad(O,D,B){return To(O,"reset",jr,!0,(Q)=>bt(O,Q)==="-"&&Vr(O,Q,D,B)?!0:Q)}function Jb(O){return To(O,"clean",jr,!0,(D)=>{if(bt(O,D)!=="-")return D;if(Vr(O,D,"--fo","rce"))return!0;let B=Ao(O,D,jr);for(let Q=D+1;Q<B;Q++)if(bt(O,Q)==="f")return!0;return B-1})}function Ui(O,D,B){if(!Un(O,D,"git"))return null;let Q=D+3;if(!zt(bt(O,Q)))return{commandEnd:-1,next:Q};while(zt(bt(O,Q)))Q++;while(Q<Ht(O)){if(Qt(bt(O,Q)))return{commandEnd:-1,next:Q};let ee=Ao(O,Q,Qt);if(Un(O,Q,B))return{commandEnd:Q+B.length,next:ee};if(bt(O,Q)!=="-")return{commandEnd:-1,next:ee};let he=ee-Q===2&&Bt(O,Q,"--"),je=Qb(O,Q,ee);Q=ee;while(zt(bt(O,Q)))Q++;if(he)return{commandEnd:Un(O,Q,B)?Q+B.length:-1,next:Ao(O,Q,Qt)};if(!je)continue;if(Q>=Ht(O)||Qt(bt(O,Q)))return{commandEnd:-1,next:Q};Q=Ao(O,Q,Qt);while(zt(bt(O,Q)))Q++}return{commandEnd:-1,next:Q}}function Qb(O,D,B){for(let Q of gn)if(B-D===Q.length&&Bt(O,D,Q))return!0;return!1}function eS(O){return Td(O,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function tS(O){return To(O,"push",jr,!0,(D)=>{if(bt(O,D)!=="-")return D;if(bt(O,D+1)==="f"&&!br(bt(O,D+2))&&!Bt(O,D+2,"-with-lease"))return!0;let B=kd(O,D,"--fo","rce");if(B>=0&&!Bt(O,B,"-with-lease"))return!0;return D})}function nS(O){return To(O,"push",Qt,!1,(D)=>{if(zt(bt(O,D))&&bt(O,D+1)==="+"&&D+2<Ht(O)&&!Qt(bt(O,D+2))&&!zt(bt(O,D+2)))return!0;if(bt(O,D)===":"&&bt(O,D+1)==="+")return!0;return D})}function rS(O){return To(O,"push",Qt,!1,(D)=>{if(bt(O,D)==="-"&&Vr(O,D,"--de","lete"))return!0;if(zt(bt(O,D))&&bt(O,D+1)===":"&&D+2<Ht(O)&&!zt(bt(O,D+2))&&!Qt(bt(O,D+2)))return!0;return D})}function oS(O){let D=!1,B=!1,Q=!1;for(let ee=0;ee<=Ht(O);ee++){if(ee===Ht(O)||Qt(bt(O,ee))){if(B&&Q)return!0;D=!1,B=!1,Q=!1;continue}if(!D){let at=Ui(O,ee,"branch");if(at){D=at.commandEnd>=0,ee=Math.max(ee,(D?at.commandEnd:at.next)-1);continue}}if(!D||bt(O,ee)!=="-")continue;let he=Ao(O,ee,Qt),je=iS(O,ee,he);if(B||=je.deletion,Q||=je.force,B&&Q)return!0;ee=he-1}return!1}function iS(O,D,B){let Q=!1,ee=!1;for(let he=D;he<B;he++){if(bt(O,he)!=="-")continue;if(Vr(O,he,"--de","lete"))Q=!0;if(Vr(O,he,"--fo","rce"))ee=!0;if(bt(O,he+1)==="-")continue;let je=he+1,at=!1,lt=!1,ct=!1;while(je<B&&sS(bt(O,je))){let ut=bt(O,je);at||=ut==="d"||ut==="D",lt||=ut==="f",ct||=ut==="D",je++}if(!Hn(O,je))continue;Q||=at,ee||=lt||ct}return{deletion:Q,force:ee}}function sS(O){if(!O)return!1;let D=O.charCodeAt(0);return D>=65&&D<=90||D>=97&&D<=122}function aS(O){return Td(O,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Td(O,D){let B=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let Q=0;Q<Ht(O);Q++){let ee=bt(O,Q),he=B[B.length-1];if(!he)return!1;let je=he.escaped;if(he.escaped=!je&&he.quote!=="'"&&ee==="\\",!je&&ee==="'"&&he.quote!=='"')he.quote=he.quote==="'"?"":"'";if(!je&&ee==='"'&&he.quote!=="'")he.quote=he.quote==='"'?"":'"';if(ee==="$"&&bt(O,Q+1)==="("&&(B.length===1||!je&&he.quote!=="'")){B.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),Q++;continue}if(!je&&!he.quote&&B.length>1&&ee==="("){he.depth++;continue}if(!je&&!he.quote&&B.length>1&&ee===")"){if(he.depth--,he.depth===0)B.pop();continue}if(zt(ee))he.shortActive=!1,he.hasShortFlag=!1;if(!he.outerActive){let at=Ui(O,Q,D.command);if(at){he.outerActive=at.commandEnd>=0&&zt(bt(O,at.commandEnd)),he.shortActive=!1,he.hasShortFlag=!1,Q=Math.max(Q,(he.outerActive?at.commandEnd:at.next)-1);continue}}if(he.outerActive&&ee==="-"){if(Vr(O,Q,D.longPrefix,D.longOptional))return!0;he.shortActive||=!D.excludedShortStarts.includes(bt(O,Q+1)??"")}if(he.hasShortFlag||=he.shortActive&&ee===D.shortFlag,he.hasShortFlag&&Hn(O,Q+1))return!0;if(jr(ee))he.outerActive=!1}return!1}function To(O,D,B,Q,ee){let he=!1;for(let je=0;je<Ht(O);je++){let at=bt(O,je),lt=B(at);if(!he&&!lt){let ct=Ui(O,je,D);if(ct){he=ct.commandEnd>=0&&(!Q||zt(bt(O,ct.commandEnd))),je=Math.max(je,(he?ct.commandEnd:ct.next)-1);continue}}if(he){let ct=ee(je);if(ct===!0)return!0;for(let ut=je;ut<=ct;ut++)if(B(bt(O,ut)))he=!1;je=ct}if(lt)he=!1}return!1}function lS(O){let D=!1;for(let B=0;B<Ht(O);B++){if(el(bt(O,B))){if(D)return!0;D=!1;continue}if(!D){let Q=Ui(O,B,"restore");if(Q){D=Q.commandEnd>=0,B=Math.max(B,(D?Q.commandEnd:Q.next)-1);continue}}if(D&&bt(O,B)==="-"&&bt(O,B+1)==="-"&&(Bt(O,B+2,"staged")||Bt(O,B+2,"help")))D=!1}return D}function Id(O,D){let B=!1;for(let Q=0;Q<Ht(O);Q++){let ee=bt(O,Q),he=D?el(ee):Qt(ee);if(B&&zt(ee)&&bt(O,Q+1)==="-"&&Un(O,Q+2,"delete"))return!0;if(he){B=!1;continue}if(Un(O,Q,"find"))B=!0,Q+=3}return!1}function Ao(O,D,B){let Q=D;while(Q<Ht(O)&&!zt(bt(O,Q))&&!B(bt(O,Q)))Q++;return Q}function kd(O,D,B,Q){if(!Bt(O,D,B))return-1;let ee=D+B.length;for(let he=0;he<Q.length&&bt(O,ee)===Q[he];he++)ee++;return Hn(O,ee)?ee:-1}function Vr(O,D,B,Q){return kd(O,D,B,Q)>=0}function xn(O,D){Po(D,O,2);let B=O.toLowerCase(),Q=B.trimStart(),ee=Q.startsWith("echo ")||Q.startsWith("rg "),he=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let je of he){if(je.skipForEchoRg&&ee)continue;let at=je.caseSensitive?O:B;if(je.regex)bn(D,at);if((je.regex?.test(at)??!1)||je.scan&&$i(at,je.scan,D))return St("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${je.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var cS=/^[A-Za-z_][A-Za-z0-9_]*=/;function Md(O,D,B){let Q=O.words[0];if(!D||!Q||O.words.length!==1||O.dialect!=="posix")return!1;if(!Q.quoted||Q.provenance!=="literal")return!1;let ee=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(Q.text)?.[1];if(!ee)return!1;Po(B,D.source,2);let he={anchored:new RegExp(`^\\$\\{?${ee}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${ee}(?![A-Za-z0-9_])`)};return Dd(D.nodes,Q,he)}function Dd(O,D,B){return O.every((Q)=>{if(Q.kind==="connector")return!0;if(Q.kind==="group"||Q.kind==="function")return Dd(Q.body.nodes,D,B);if(Q.kind==="unknown")return!B.loose.test(Q.source);return uS(Q,D,B)})}function uS(O,D,B){if(O.nested.some((ee)=>B.loose.test(ee.source)))return!1;let Q=O.words.findIndex((ee)=>!cS.test(ee.text));return O.words.every((ee,he)=>ee===D||Od(ee.raw,B.anchored,he!==Q))&&O.redirections.every((ee)=>(!ee.heredoc||ee.heredoc.quotedDelimiter||!B.loose.test(ee.heredoc.body))&&(!ee.target||Od(ee.target.raw,B.anchored,!0)))}function Od(O,D,B){let Q=!1,ee=!1;for(let he=0;he<O.length;he++){let je=O[he];if(je==="\\"&&!Q){he++;continue}if(!ee&&je==="'"){Q=!Q;continue}if(!Q&&je==='"'){ee=!ee;continue}if(Q||je!=="$")continue;if(!D.test(O.slice(he)))continue;if(!ee||!B)return!1}return!0}import{isAbsolute as dS,resolve as Nd}from"node:path";function Io(O,D,B,Q){let ee=dS(O)?Nd(O):D?Nd(D,O):void 0;if(!ee)return;try{return Lt(ee,B,Q)}catch{return ee}}function Ld(O){return!["/dev","/proc","/sys"].some((D)=>O===D||O.startsWith(`${D}/`))}var Kr="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",ko="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",rl=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),fS=new Set(["-p","--print"]),mS=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),pS=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),gS=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),hS=new Map([["python",new Set(["m"])]]),yS=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),bS=new Set(["always","default","never"]),SS=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),CS=/\\\r?\n/g,vS=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Wd(O){return ji(O).code}function Hi(O){return ji(O).sources}function Gd(O){return vS.get(il(O))??[]}function ji(O){let D=il(O[0]??"");if(!rl.has(D))return{code:null,sources:[],optionsOpen:!1};let B=[],Q=[],ee=!0;for(let he=1;he<O.length;he++){let je=O[he];if(je===void 0)break;if(je==="--")return Tn(D,B,Q,ee,O[he+1]===void 0?void 0:he+1,O[he+1]);if(je===""||je==="-"||!je.startsWith("-"))return Tn(D,B,Q,ee,he,je);if(D==="node"&&fS.has(je)){let ft=O[he+1];if(ft===void 0)return Tn(D,B,Q,ee);if(ft.startsWith("-"))continue;B.push({tokenIndex:he+1,value:ft}),Q.push({tokenIndex:he+1,kind:"inline-code",value:ft}),he++;continue}if(xS(D,je)){let ft=O[he+1];if(ft===void 0)return Tn(D,B,Q,ee);if(B.push({tokenIndex:he+1,value:ft}),Q.push({tokenIndex:he+1,kind:"inline-code",value:ft}),D==="python")return Tn(D,B,Q,ee);he++;continue}let at=/^--eval=(.*)$/s.exec(je);if(RS(D)&&at){let ft=at[1]??"";B.push({tokenIndex:he,value:ft}),Q.push({tokenIndex:he,kind:"inline-code",value:ft});continue}if(D==="node"){let ft=ES(je);if(ft){if(ft.attached){if(ee&&=ft.value!=="",ft.value!=="")Q.push({tokenIndex:he,kind:"module-file",value:ft.value});continue}let dt=O[he+1];if(dt===void 0||dt.startsWith("-"))return ee=!1,Tn(D,B,Q,ee);Q.push({tokenIndex:he+1,kind:"module-file",value:dt}),he++;continue}}if(D==="python"&&je.startsWith("--check-hash-based-pycs=")||D==="node"&&(je==="--conditions="||je==="--diagnostic-dir="||je==="--title=")||D==="ruby"&&(je==="--disable="||je==="--enable="))return Tn(D,B,Q,ee);if(yS.get(D)?.has(je)){let ft=O[he+1];if(ft===void 0||ft.startsWith("-")&&!(D==="ruby"&&SS.has(je))||D==="python"&&!bS.has(ft))return Tn(D,B,Q,ee);he++;continue}if(je.startsWith("--"))continue;let lt,ct=!1;for(let ft=1;ft<je.length;ft++){let dt=je[ft];if(dt===void 0)break;if(hS.get(D)?.has(dt)){let mt=je.slice(ft+1),pt=mt||O[he+1];if(pt!==void 0)Q.push({tokenIndex:mt?he:he+1,kind:"module-file",value:pt});return Tn(D,B,Q,ee)}if(mS.get(D)?.has(dt)){lt=je.slice(ft+1)||O[he+1],ct=ft+1===je.length;break}if(D==="node"&&dt==="r"){if(ee&&=je==="-r",je==="-r"){let mt=O[he+1];if(ee&&=mt!==void 0&&!mt.startsWith("-"),ee&&mt!==void 0)Q.push({tokenIndex:he+1,kind:"module-file",value:mt});he++}break}if(D==="ruby"&&dt==="r"){let mt=je.slice(ft+1),pt=mt||O[he+1];if(ee&&=pt!==void 0,pt!==void 0)Q.push({tokenIndex:mt?he:he+1,kind:"module-file",value:pt});if(!mt)he++;break}if(D==="perl"&&(dt==="M"||dt==="m")){let mt=je.slice(ft+1);if(!mt){if(ee=!1,ft+1===je.length)he++;break}Q.push({tokenIndex:he,kind:"module-file",value:mt});break}if(pS.get(D)?.has(dt)){if(ft+1===je.length)he++;break}if(gS.get(D)?.has(dt)&&ft+1<je.length)break}if(lt===void 0)continue;let ut=ct?he+1:he;if(B.push({tokenIndex:ut,value:lt}),Q.push({tokenIndex:ut,kind:"inline-code",value:lt}),D==="python")return Tn(D,B,Q,ee);if(ct)he++}return Tn(D,B,Q,ee,void 0,void 0,!0)}function Tn(O,D,B,Q,ee,he,je=!1){let at=O==="node"?D.slice(-1):D,lt=new Set(at.map((ut)=>ut.tokenIndex)),ct=B.filter((ut)=>ut.kind!=="inline-code"||lt.has(ut.tokenIndex));if(Q&&D.length===0&&ee!==void 0&&he!==void 0)ct.push({tokenIndex:ee,kind:"main-script",value:he});return{code:(O==="node"?at[0]?.value:at.map((ut)=>ut.value).join(`
-`))||null,sources:Q?ct:[],optionsOpen:Q&&je}}function ES(O){for(let D of["--import","--loader","--experimental-loader","--require"]){if(O===D)return{attached:!1,value:""};if(O.startsWith(`${D}=`))return{attached:!0,value:O.slice(D.length+1)}}return}function ol(O,D){return il(O)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(D)}function il(O){let D=Tt(O).toLowerCase();return yi.test(D)?"python":D}function xS(O,D){return rl.get(O)?.has(D)??!1}function RS(O){return rl.get(O)?.has("--eval")??!1}function Oo(O,D,B=!1){let Q=PS(O,D);if(!nl(Q,D))return!1;bn(D,Q);let ee=wS(Q);if(nl(ee,D))return!0;if(bn(D,ee),!Fd.test(ee))return!1;return!B||_S(Q,D)}function _S(O,D){if(/`|%x|\bqx\b/.test(O))return!0;let B=O.split(""),Q=[];for(let je=0;je<O.length;je++){let at=O[je];if(at!=="'"&&at!=='"')continue;let lt=O.startsWith(at.repeat(3),je)?at.repeat(3):at,ct=je+lt.length,ut=ct;while(ut<O.length&&!O.startsWith(lt,ut))ut+=O[ut]==="\\"?2:1;if(ut>=O.length)return!0;Q.push({start:ct,text:O.slice(ct,ut)}),B.fill(" ",je,ut+lt.length),je=ut+lt.length-1}let ee=B.join(""),he=Array.from(ee.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((je)=>Fd.test(je[1]??"")).map((je)=>{let at=je.index+je[0].length;return{start:at,end:sl(ee,at)}});if(he.some((je)=>al(ee,je.start)))return!0;return Q.some((je)=>(/\b(?:system|exec|spawn|popen)\s*$/.test(ee.slice(0,je.start))||he.some((at)=>je.start>=at.start&&je.start<at.end))&&nl(je.text,D))}function sl(O,D){let B=1;for(let Q=D;Q<O.length;Q++){if(O[Q]==="(")B++;if(O[Q]===")")B--;if(B===0)return Q}return O.length}function al(O,D){let B=0;for(let Q=D;Q<O.length;Q++){let ee=O[Q]??"";if("([{".includes(ee))B++;if(")]}".includes(ee)&&B--===0)return!1;if(ee===","&&B===0)return!1;if(/[A-Za-z_$]/.test(ee))return!0}return!1}var Fd=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function wS(O){let D=[],B=0,Q=0;while(Q<O.length){let ee=O[Q];if(ee!=="'"&&ee!=='"'){Q++;continue}let he=O.startsWith(ee.repeat(3),Q)?ee.repeat(3):ee,je=Q+he.length;while(je<O.length&&!O.startsWith(he,je))je+=O[je]==="\\"?2:1;if(je>=O.length)break;D.push(O.slice(B,Q)," "),Q=je+he.length,B=Q}return D.push(O.slice(B)),D.join("")}function nl(O,D){if(Bi(O,"rm",D))return!0;for(let Q of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(bn(D,O),Q.test(O))return!0;if(Bi(O,"dd",D))return!0;for(let Q of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(bn(D,O),Q.test(O))return!0;if(Bi(O,"find",D))return!0;let B=O.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((Q)=>(bn(D,O),B.some((ee)=>$i(ee,Q))))}function PS(O,D){return bn(D,O),O.replace(CS,"")}import{isAbsolute as ff,relative as mf}from"node:path";import{isAbsolute as Vd,parse as WS}from"node:path";import{dirname as AS,isAbsolute as TS,parse as IS,sep as kS}from"node:path";function nr(O,D,B){if(Qn(D))throw Error("Unsupported Windows namespace path");let Q=TS(D)?IS(D).root:"",ee=Q||O;for(let he of MS(Q?D.slice(Q.length):D)){if(he===""||he===".")continue;if(he===".."){ee=AS(ee);continue}let je=OS(ee,he),at=B.entryKind(je),lt=at==="symlink"?B.realpath(je):je;if(at==="missing"||lt===null)throw Error(`Cannot resolve path component: ${je}`);ee=lt}return ee}function OS(O,D){return O.endsWith("/")||O.endsWith("\\")?`${O}${D}`:`${O}${kS}${D}`}function MS(O){let D=process.platform==="win32"?/[\\/]+/:/\/+/;return O.split(D)}var ll=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],DS=new Set(ll),NS=1024,zd=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Bd=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),LS=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Vi(O){return DS.has(O)}function cl(O){return Vi(O)||zd.has(O)||Bd.has(O)||mo(O)}function jn(O,D,B){return B?.has(O)?B.get(O):D.get(O)}function $d(O,D){let B=jn("GIT_CONFIG_COUNT",O,D);if(B===void 0)return{state:"absent"};if(B==="")return{state:"valid",count:0};if(!/^\d+$/.test(B))return{state:"invalid"};let Q=Number(B);return Number.isSafeInteger(Q)&&Q<=NS?{state:"valid",count:Q}:{state:"invalid"}}function Ki(O,D,B){let ee=O.match(LS)?.[1];if(!ee||!cl(ee))return null;let he=O.indexOf("=");return{name:ee,value:`${jn(ee,D,B)??""}${O.slice(he+1)}`}}function Ud(O){return jd(O,Bd)}function Hd(O){return jd(O,zd)}function jd(O,D){if(!O)return!1;for(let B of O.keys())if(D.has(B))return!0;return!1}var qd=/^[A-Za-z_][A-Za-z0-9_]*=/;function Rn(O){if(!qd.test(O))return null;let D=O.indexOf("=");return{name:O.slice(0,D),value:O.slice(D+1)}}function ge(O){let D=new Map,B=0;while(B<O.length){let Q=O[B];if(!Q)break;let ee=Rn(t(Q));if(!ee)break;D.set(ee.name,ee.value),B++}return{words:O.slice(B),envAssignments:D}}function Yd(O){let D=O.toLowerCase();return O.includes("=")||D==="sudo"||D==="env"||D==="command"||D==="builtin"}function Sr(O,D,B,Q){if(!Yd(qr(O)))return{words:O,envAssignments:new Map,cwd:B,rewritten:!1};let ee=new Set(O),he=O,je=new Map,at=new Map(Q??[]),lt=[],ct=B;for(let ft=0;ft<a.wrapperPeelIterations.cap;ft++){let dt=Kd(he),mt=ge(he);for(let[gt,ht]of mt.envAssignments)je.set(gt,ht),at.set(gt,ht);if(he=mt.words,he.length===0)break;while(he.length>0&&qr(he).includes("=")&&!FS(he)){let gt=zS(qr(he),at,D.env)??Ki(qr(he),D.env,at);if(gt)je.set(gt.name,gt.value),at.set(gt.name,gt.value);he=he.slice(1)}if(he.length===0)break;let pt=qr(he).toLowerCase();if(pt!=="sudo"&&pt!=="env"&&pt!=="command"&&pt!=="builtin")break;if(pt==="sudo"){let gt=$S(he,D.paths,ct);if(he=gt.words,gt.cwd!==void 0)ct=gt.cwd}if(pt==="env"){let gt=jS(he,ct,at,D);if(lt.push(...gt.envSplitValues??[]),he=gt.words,gt.cwd!==void 0)ct=gt.cwd;for(let[ht,yt]of gt.envAssignments)je.set(ht,yt),at.set(ht,yt)}if(pt==="command")he=VS(he);if(pt==="builtin")he=he.slice(In(he,1)==="--"?2:1);if(Kd(he)===dt)break}let ut=ge(he);for(let[ft,dt]of ut.envAssignments)je.set(ft,dt),at.set(ft,dt);return{words:ut.words,envAssignments:je,cwd:ct,envSplitValues:lt.length>0?lt:void 0,rewritten:GS(ut.words,ee)}}function GS(O,D){return O.some((B)=>!D.has(B))}function Kd(O){return O.map(t).join(" ")}function qr(O){let D=O[0];return D?t(D):""}function In(O,D){let B=O[D];return B?t(B):void 0}function FS(O){return qd.test(qr(O))}function zS(O,D,B){if(!O.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${D.get("TMPDIR")??B.get("TMPDIR")??""}${O.slice(8)}`}}var BS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function $S(O,D,B){let Q=1,ee=B;while(Q<O.length){let he=In(O,Q);if(!he)break;if(he==="--")return{words:O.slice(Q+1),cwd:ee};if(!he.startsWith("-"))break;if(he==="-D"||he==="--chdir"){let je=In(O,Q+1);ee=je?Mo(ee,je,D):null,Q+=2;continue}if(he.startsWith("--chdir=")){ee=Mo(ee,he.slice(8),D),Q++;continue}if(he.startsWith("-D")&&he.length>2){ee=Mo(ee,he.slice(2),D),Q++;continue}if(he==="-i"||he==="--login"){ee=null,Q++;continue}if(BS.has(he)){Q+=2;continue}Q++}return{words:O.slice(Q),cwd:ee}}var US=new Set(["-i","-0","--null"]),HS=new Set(["-u","--unset","-C","--chdir","-P"]);function jS(O,D,B,Q){let ee=new Map,he=[],je=D,at=1,lt=(ct)=>({words:O.slice(ct),envAssignments:ee,cwd:je,envSplitValues:he.length>0?he:void 0});while(at<O.length){let ct=In(O,at);if(!ct)break;if(ct==="--")return lt(at+1);if(ct==="-i"||ct==="--ignore-environment"||ct==="-"){ee.clear();for(let ft of B.keys())ee.set(ft,"");ee.set("TMPDIR",""),at++;continue}if(US.has(ct)){at++;continue}if(ct==="-u"||ct==="--unset"){let ft=In(O,at+1);if(ft!==void 0)ee.set(ft,"");at+=2;continue}if(ct.startsWith("-u")&&ct.length>2&&!ct.startsWith("-u=")){ee.set(ct.slice(2),""),at++;continue}if(ct.startsWith("--unset=")){ee.set(ct.slice(8),""),at++;continue}let ut=ct==="-S"||ct==="--split-string"?{value:In(O,at+1),consumed:2}:ct.startsWith("-S")&&ct.length>2?{value:ct.slice(2),consumed:1}:ct.startsWith("--split-string=")?{value:ct.slice(15),consumed:1}:null;if(ut){if(ut.value!==void 0)he.push(ut.value);return je=null,lt(at+ut.consumed)}if(HS.has(ct)){if(ct==="-C"||ct==="--chdir"){let ft=In(O,at+1);je=ft?Mo(je,ft,Q.paths):null}at+=2;continue}if(ct.startsWith("-u=")){at++;continue}if(ct.startsWith("-C")&&ct.length>2||ct.startsWith("--chdir=")){let ft=ct.startsWith("--chdir=")?ct.slice(8):ct.startsWith("-C=")?ct.slice(3):ct.slice(2);je=Mo(je,ft,Q.paths),at++;continue}if(ct.startsWith("-P")){at++;continue}if(ct.startsWith("-")){at++;continue}if(!Rn(ct))break;while(at<O.length){let ft=Rn(In(O,at)??"");if(!ft)break;ee.set(ft.name,ft.value),at++}if(In(O,at)==="--")at++;return lt(at)}return lt(at)}function Mo(O,D,B){if(D==="")return null;if(!O&&!Vd(D))return null;let Q=Vd(D)?WS(D).root:B.realpath(O??"/");if(Q===null)return null;try{return nr(Q,D,B)}catch{return null}}function VS(O){if(In(O,1)==="-v")return[...$t(["type"]),...O.slice(2)];let D=1;while(D<O.length){let B=In(O,D);if(!B)break;if(B==="-p"||B==="-v"||B==="-V"){D++;continue}if(B==="--")return O.slice(D+1);if(B.startsWith("-")&&!B.startsWith("--")&&B.length>1){if(!/^[pvV]+$/.test(B.slice(1)))break;D++;continue}break}return O.slice(D)}var KS=/['"\\$`{}#]/;function qi(O,D){if(O.some((Q)=>KS.test(Q)))return null;let B=[...O.flatMap((Q)=>Q.split(/\s+/).filter((ee)=>ee.length>0)),...D];return B.length<=64?B:null}function rr(O,D,B){return Yi(O,D,B).tokens}function qS(O){let D=[],B="",Q=0;while(Q<O.length){let ee=O.charAt(Q);if(ee==='"'||ee==="'"){let he=O.indexOf(ee,Q+1);if(he===-1)return O.split(/\s+/).map((je)=>je.replace(/["']/g,"")).filter((je)=>je.length>0);B+=O.slice(Q+1,he),Q=he+1;continue}if(/\s/.test(ee)){if(B.length>0)D.push(B);B="",Q++;continue}B+=ee,Q++}if(B.length>0)D.push(B);return D}function Cr(O,D,B,Q=0){let ee=Yi(O,D,B),he=(ee.envSplitValues??[]).flatMap(qS);if(he.length===0)return ee.tokens;let je=[...he,...ee.tokens];if(Q>=8)return je;return Cr(je,D,B,Q+1)}function Yi(O,D,B,Q){if(!Yd(O[0]??""))return{tokens:[...O],envAssignments:new Map,cwd:B};let ee=Sr($t(O),D,B,Q);return{tokens:ee.words.map(t),envAssignments:ee.envAssignments,cwd:ee.cwd,envSplitValues:ee.envSplitValues}}var ml=Symbol("adopt-as-operand"),YS=new Set(["env","sudo","command","builtin"]),ZS=new Set(["&&","||","|&","|","&",";"]),XS=new Set(["<<","<<<",">|"]),JS=new Set(["|","|&"]),QS=/[*@#?$!_-]/,eC=/^\w+(?::\w+)*/,tC=Object.freeze([]),Do=Object.freeze({kind:"scope",edge:"enter"}),No=Object.freeze({kind:"scope",edge:"exit"}),nC=Object.freeze([]),rC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Lo=new Set(["bash","sh","zsh","dash","ksh"]),oC=256,ef=new WeakMap;function tf(O,D){let B=D.status==="complete"?new Set(fl(D)):new Set,Q=aC(O,B);if(Si(Q))return Zi("unclosed-quote",Q,D);let ee={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},he=vr(D,{source:Q,suppressed:B,flags:ee,depth:0,functions:new Map,powershell:D.dialect==="powershell"});if(ee.limited)return Zi("structural-limit",Q,D);if(ee.invalid)return Zi("invalid",Q,D);let je=Zi("complete",Q,D,ee.assignmentFallbacks);return ef.set(je,Object.freeze(he)),je}function Ji(O,D,B,Q,ee){let he=ee.word??((ft)=>ft),je={cwd:D,variables:new Map,previous:null},at=[],lt=new Set,ct=null,ut=[];for(let ft of nf(O)){if(ft.kind==="scope"){if(ft.edge==="enter"){ut.push({state:je,segment:[...at],shellWords:new Set(lt),pipeProducer:ct});continue}let dt=ee.segment(at,je,ct,null,lt);if(dt)return dt;let mt=ut.pop();if(mt===void 0)throw Error("scope exit without a matching enter");je=mt.state,at=mt.segment,lt=mt.shellWords,ct=mt.pipeProducer;continue}if(ft.kind==="operator"){if(!ft.boundary)continue;let dt=ee.segment(at,je,ct,ft.operator,lt);if(dt)return dt;je=iC(at,je,B,Q),ct=at.length>0&&JS.has(ft.operator)?at:null,at=[],lt=new Set;continue}if(ft.kind==="redirection"){if(ft.fd!==void 0)lt.add(at.length-1);if(ft.target===void 0)continue;let dt=ee.redirection({operator:ft.operator,role:ft.role,targetOrder:ft.targetOrder,target:ft.target,...ft.body===void 0?{}:{body:ft.body,consumer:ft.consumer}},je);if(dt===ml){lt.add(at.length),at.push(he(ft.target));continue}if(dt)return dt;continue}at.push(he(ft.text))}return ee.segment(at,je,ct,null,lt)}function Qi(O){return nf(O).flatMap((D)=>{if(D.kind==="word")return[{kind:"word",text:D.text}];if(D.kind==="operator")return[{kind:"operator",boundary:D.boundary}];if(D.kind==="redirection")return[{kind:"redirection",target:D.target}];return[]})}function cn(O,D){return O.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(B,Q,ee,he)=>{let je=D.get(Q);if(je===void 0)return B;let at=ee.startsWith(":")?je!=="":!0;if(ee.endsWith("-"))return at?je:cn(he,D);return at?cn(he,D):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(B,Q)=>D.get(Q)??B).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(B,Q)=>D.get(Q)??B)}function Wo(O){return O.length>0&&O.every((D)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(D))}function iC(O,D,B,Q){let ee=Wo(O)?new Map([...D.variables,...sC(O,D.variables)]):D.variables,he=rr([...O],B),je=Tt(he[0]??"").toLowerCase()==="cd"?he[1]:void 0;if(!je)return{...D,variables:ee};if(je==="-"){if(D.previous===null)return{...D,variables:ee};return{cwd:D.previous,variables:ee,previous:D.cwd}}return{cwd:tn(cn(je,ee),D.cwd,B,Q),variables:ee,previous:D.cwd}}function sC(O,D){return O.flatMap((B)=>{let Q=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(B),ee=Q?.[2]?.startsWith("=")?Q[2].slice(1):void 0;return Q?.[1]!==void 0&&ee!==void 0?[[Q[1],cn(ee,D)]]:[]})}function nf(O){return ef.get(O)??tC}function aC(O,D){return[...D].reduce((B,Q)=>B.slice(0,Q.start)+" ".repeat(Q.end-Q.start)+B.slice(Q.end),O)}function Zi(O,D,B,Q=nC){return Object.freeze({status:O,source:D,program:B,assignmentFallbacks:Object.freeze(Q)})}function vr(O,D){return O.nodes.flatMap((B,Q)=>lC(B,O,Q,D)).sort((B,Q)=>B.start-Q.start).flatMap((B)=>[...B.events])}function lC(O,D,B,Q){if(O.kind==="connector")return[{start:O.span.start,events:[kn(mC(O.operator))]}];if(O.kind==="unknown")return[{start:O.span.start,events:[kn(O.source)]}];if(O.kind==="function")return Q.functions.set(O.name,O.body),[];if(O.kind==="group"){let he=O.style!=="subshell",je=Q.source[O.span.end-1]===(he?"}":")"),at=he?Q:{...Q,functions:new Map(Q.functions)};return[{start:O.span.start,events:he?[Xi("{"),...vr(O.body,at),...je?[Xi("}")]:[]]:[Do,kn("("),...vr(O.body,at),...je?[kn(")")]:[],No]}]}let ee=yC(O,Q.functions);if(ee){if(Q.depth>=tr.maxDepth||++Q.flags.expansions>oC)return Q.flags.limited=!0,[];return[{start:O.span.start,events:[...Zd(O,Q),Xi(";"),...vr(ee,{...Q,depth:Q.depth+1}),Xi(";")]},...Xd(O,D,B,Q)]}return[{start:O.span.start,events:Zd(O,Q)},...Xd(O,D,B,Q)]}function Zd(O,D){return[...O.words.map((B)=>({start:B.span.start,events:of(B,O,D,!1)})),...O.redirections.map((B)=>({start:B.span.start,events:cC(B,O,D)}))].sort((B,Q)=>B.start-Q.start).flatMap((B)=>B.events)}function cC(O,D,B){let Q=O.operator==="<<-"?"<<":O.operator,ee=O.target?of(O.target,D,B,!0):[],he=ee[0],je=he?.kind==="word"?he.text:void 0;return[...O.fd===void 0?[]:[pl(String(O.fd))],Object.freeze({kind:"redirection",operator:Q,...O.fd===void 0?{}:{fd:O.fd},role:pC(Q),targetOrder:XS.has(Q)?"legacy-segment":"immediate",...je===void 0?{}:{target:je},...O.heredoc&&B.suppressed.has(O.heredoc.bodySpan)?{body:O.heredoc.body,consumer:af(D)}:{}}),...je===void 0?ee:ee.slice(1)]}function Xd(O,D,B,Q){let ee=O.redirections.filter((he)=>he.operator==="<<"||he.operator==="<<-");return[...ee.flatMap((he)=>{let je=he.heredoc;if(!je)return[];let at=[pl(je.delimiter),.../[\r\n]/.test(Q.source[je.terminatorSpan.end]??"")?[kn(";")]:[]];if(Q.suppressed.has(je.bodySpan))return[{start:je.bodySpan.start,events:at}];return[{start:je.bodySpan.start,events:[...rf(Q.source.slice(je.bodySpan.start,je.bodySpan.end),Q),...at]}]}),...ee.some((he)=>!he.heredoc&&he.target)?uC(D,B,Q):[]]}function uC(O,D,B){let Q=O.nodes.slice(D+1).find((ee)=>ee.kind==="connector");if(!Q||Q.span.end>=O.span.end)return[];return[{start:Q.span.end,events:rf(B.source.slice(Q.span.end,O.span.end),B)}]}function rf(O,D){if(D.depth>=tr.maxDepth)return D.flags.limited=!0,[];let B=h(O,"posix");if(B.status==="limited")return D.flags.limited=!0,[];let Q={invalid:!1,limited:!1,expansions:D.flags.expansions,assignmentFallbacks:D.flags.assignmentFallbacks},ee=vr(B,{source:O,suppressed:new Set,flags:Q,depth:D.depth+1,functions:new Map,powershell:!1});return D.flags.limited||=Q.limited,D.flags.expansions=Q.expansions,ee}function of(O,D,B,Q){let ee=[],he={single:!1,double:!1},je="",at=!1,lt=()=>{let ct=at&&!Q?kn("glob"):je!==""||O.quoted&&ee.length===0?pl(je):void 0;if(ct)ee.push(ct);je="",at=!1};for(let ct of O.parts){if(ct.provenance!=="command-substitution"&&ct.provenance!=="arithmetic"){for(let mt of ul(ct.raw,he,B.flags,B.powershell)){if(typeof mt==="string"){lt(),ee.push(kn(mt));continue}je+=mt.text,at||=mt.glob}continue}let ut=D.nested.find((mt)=>mt.span.start>=ct.span.start&&mt.span.end<=ct.span.end);if(he.double){let mt=B.source.slice(ct.span.start,ct.span.end);je+=ul(mt,{single:!1,double:!0},B.flags,B.powershell).map((gt)=>typeof gt==="string"?gt:gt.text).join("");let pt=ut?vr(ut,B).filter((gt)=>gt.kind==="redirection"&&gt.body!==void 0):[];if(pt.length>0)ee.push(Do,...pt,No);continue}let ft=ut?vr(ut,B):[];if(ct.raw.startsWith("`")){je+="${}",lt(),ee.push(Do,...ft,No);continue}if(ct.raw.startsWith("<(")||ct.raw.startsWith(">(")){lt(),ee.push(ct.raw.startsWith("<(")?kn("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Do,...ft,...ct.raw.endsWith(")")?[kn(")")]:[],No);continue}let dt=ct.raw.startsWith("$((")?2:1;je+="${}",lt(),ee.push(...Array.from({length:dt},()=>kn("(")),...dt===1?[Do]:[],...ft,...ct.raw.endsWith(")".repeat(dt))?Array.from({length:dt},()=>kn(")")):[],...dt===1?[No]:[])}return lt(),ee}function ul(O,D,B,Q){let ee=[],he="",je=!1,at=0;while(at<O.length){let lt=O[at]??"";if(!D.single&&!D.double&&(lt==="("||lt===")")){ee.push({text:he,glob:je},lt),he="",je=!1,at++;continue}if(Q&&lt==="`"&&!D.single){he+=O[at+1]??"",at+=2;continue}if(D.single&&lt==="'"){D.single=!1,at++;continue}if(D.single){he+=lt,at++;continue}if(D.double){if(lt==='"'){D.double=!1,at++;continue}if(!Q&&lt==="\\"){let ct=O[at+1]??"";he+=['"',"\\","$"].includes(ct)?ct:`\\${ct}`,at+=2;continue}if(lt==="$"){let ct=Jd(O,at,D,B,Q);he+=ct.text,at=ct.next;continue}he+=lt,at++;continue}if(lt==="'"||lt==='"'){D.single=lt==="'",D.double=lt==='"',at++;continue}if(!Q&&lt==="\\"){let ct=O[at+1]??"";je||=ct==="*"||ct==="?",he+=ct,at+=2;continue}if(lt==="$"){let ct=Jd(O,at,D,B,Q);he+=ct.text,at=ct.next;continue}je||=lt==="*"||lt==="?",he+=lt,at++}return[...ee,{text:he,glob:je}]}function Jd(O,D,B,Q,ee){let he=O[D+1];if(he==="{"){let at=fC(O,D+2);if(at===-1)return Q.invalid=!0,{text:"",next:O.length};let lt=O.slice(D,at+1);return dC(lt,B,Q,ee),{text:lt,next:at+1}}if(he!==void 0&&QS.test(he))return{text:`\${${he}}`,next:D+2};let je=(ee?eC:/^\w*/).exec(O.slice(D+1))?.[0]??"";return{text:`\${${je}}`,next:D+1+je.length}}function dC(O,D,B,Q){let ee=O.slice(2,-1),he=/^[A-Za-z_][A-Za-z0-9_]*/.exec(ee)?.[0];if(!he)return;let je=ee.slice(he.length),at=[":=","="].find((ct)=>je.startsWith(ct));if(!at)return;let lt=ul(je.slice(at.length),{...D},B,Q);B.assignmentFallbacks.push(...lt.flatMap((ct)=>typeof ct==="string"||!ct.text?[]:[ct.text]))}function fC(O,D){let B=1,Q=D;while(B>0&&Q<O.length){if(O[Q]==="{"&&O[Q-1]==="$")B++;if(O[Q]==="}")B--;Q++}return B===0?Q-1:-1}function mC(O){return/^[\r\n]+$/.test(O)?";":O}function kn(O){return Object.freeze({kind:"operator",operator:O,boundary:ZS.has(O)})}function Xi(O){return Object.freeze({kind:"operator",operator:O,boundary:!0})}function pl(O){return Object.freeze({kind:"word",text:O})}function pC(O){if(O==="<<"||O==="<<<")return"here-data";if(O==="<"||O==="<&")return"file-read";return"file-write"}function Go(O){return rC.has(O)||/^python\d/.test(O)}var gC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function sf(O,D){let B=D[0];if(B===void 0||!B.startsWith("-"))return D;let Q=gC.get(O)?.has(B)??!1;return sf(O,D.slice(Q?2:1))}function dl(O){let D=O[0];if(D===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(D))return dl(O.slice(1));if(!YS.has(D))return[...O];return dl(sf(D,O.slice(1)))}function af(O){let D=Ro(O),B=O.words.findIndex((Q)=>Q.provenance==="literal"&&Q.text===D);return dl(B<0?[]:O.words.slice(B).map((Q)=>Q.text))}function hC(O){let D=af(O)[0];if(D===void 0)return!1;let B=Tt(D).toLowerCase();return Go(B)&&!Lo.has(B)}function fl(O){return O.nodes.flatMap((D,B)=>{if(D.kind==="group"||D.kind==="function")return fl(D.body);if(D.kind!=="command")return[];let Q=D.nested.flatMap((at)=>fl(at)),ee=D.redirections.flatMap((at)=>at.heredoc?.quotedDelimiter?[at.heredoc.bodySpan]:[]);if(hC(D))return[...Q,...ee];let he=O.nodes[B+1];if(he?.kind==="connector"&&(he.operator==="|"||he.operator==="|&")||!SC(D))return Q;return[...Q,...ee]})}function yC(O,D){let B=Ro(O);return B===void 0?void 0:D.get(B)}function or(O,D){return O!==void 0&&O.provenance==="literal"&&!O.quoted&&O.raw===O.text&&O.text===D}function bC(O){if(or(O.words[0],"git"))return or(O.words[1],"commit");if(!or(O.words[0],"gh")||!or(O.words[2],"create"))return!1;return or(O.words[1],"pr")||or(O.words[1],"issue")}function SC(O){return(or(O.words[0],"cat")||or(O.words[0],"tee")||bC(O))&&!O.words.some(Qd)&&!O.redirections.some((B)=>Qd(B.target))}function Qd(O){return O?.parts.some((D)=>D.provenance==="command-substitution"&&D.raw.startsWith(">("))??!1}var lf=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),cf=new Set([...lf,"glob"]),CC=new Set([...cf,"pattern"]);class y extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Fo(O){let D=vC(),B=ne(O.input),Q=[];if((O.route.kind==="command"||O.route.kind==="unknown")&&B)Q.push({usage:"input-candidate",source:B});if(O.route.kind==="command"&&"command"in O&&O.command)Q.push({usage:"declared-command",source:O.command});let ee=Q.reduce((he,je)=>{let at=he.findIndex((ut)=>ut.source===je.source);if(at!==-1){let ut=he[at];if(!ut)return he;return he[at]={...ut,usages:[...ut.usages,je.usage]},he}let lt=O.route.kind==="command"?O.route.shell:process.platform==="win32"?"powershell":"posix",ct=D.getCommandProgram(je.source,lt);return he.push({usages:[je.usage],source:je.source,program:ct,shell:D.getShellSyntax(je.source,ct)}),he},[]);return{invocation:{toolName:O.toolName,route:O.route,context:O.context},commands:ee,paths:EC(O),store:D}}function un(O,D){return O.commands.find((B)=>B.usages.includes(D))}function Vn(O,D){if(!O.includes("$"))return O;return Zs(O,D)}function vC(){let O=new Map,D=new Map,B=new WeakMap,Q=(he,je)=>{let at=`${je}\x00${he}`,lt=D.get(at);if(lt)return lt;let ct=h(he,je);return D.set(at,ct),ct};return{getShellSyntax:(he,je)=>{if(je&&je.source!==he)throw TypeError("Shell syntax source does not match command program source.");let at=je??Q(he,"posix");if(at.status==="limited"){let ut=B.get(at);if(ut)return ut;let ft={status:"structural-limit",source:he,program:at,assignmentFallbacks:[]};return B.set(at,ft),ft}let lt=O.get(he);if(lt)return lt;let ct=tf(he,at);return O.set(he,ct),ct},getCommandProgram:Q}}function EC(O){let D=O.route.kind==="grep"?cf:O.route.kind==="glob"?CC:lf;return[...Kc(O.input,D),...O.route.kind==="patch"?Zc(O.input):[]]}var xC=new Set(["-S","--suffix"]);function Yr(O,D,B,Q,ee){if(O.status==="structural-limit")throw new y;if(O.status!=="complete")return ee.findMalformedTarget(O.source);return Ji(O,D,B,Q,{segment:(he,je)=>ee.findSegmentTarget(he,je),redirection:(he,je)=>he.role==="file-write"&&ee.isRedirectionTarget(cn(he.target,je.variables),je)?he.target:null})}function es(O){let D=[],B=null,Q=!1;for(let ee=0;ee<O.length;ee++){let he=O[ee];if(he===void 0)break;if(!Q&&he==="--"){Q=!0;continue}if(!Q&&(he==="-t"||he==="--target-directory")){B=O[++ee]??null;continue}if(!Q&&he.startsWith("--target-directory=")){B=he.slice(19);continue}if(!Q&&he.startsWith("-t")&&he.length>2){B=he.slice(2);continue}if(!Q&&xC.has(he)){ee++;continue}if(!Q&&(he.startsWith("--suffix=")||he.startsWith("--backup=")))continue;if(!Q&&he.startsWith("-"))continue;D.push(he)}return B?{sources:D,destination:B}:{sources:D.slice(0,-1),destination:D.at(-1)??null}}var x="Git metadata and hooks are protected. Ask the user before modifying them.";function pf(O,D,B,Q){let ee=O.invocation.context.executionCwd;if(!D)return null;if(O.invocation.route.kind==="patch"||O.invocation.route.kind==="path"||O.invocation.route.kind==="unknown"){if(ui(O.invocation.toolName))return null;let at=O.paths.find((lt)=>uf(lt,ee,D,B,Q,D.entries));return at?{target:at}:null}if(O.invocation.route.kind!=="command")return null;let he=un(O,"input-candidate");if(!he)return null;let je=Yr(he.shell,ee,B,Q,{findSegmentTarget:(at,lt)=>PC(at,lt,D,B,Q),isRedirectionTarget:(at,lt)=>uf(at,lt.cwd,D,B,Q,D.markerFiles),findMalformedTarget:()=>null});return je?{target:je}:null}function Er(O,D,B,Q,ee,he,je=!1){if(!B)return!1;let at=ns(tn(O,D,ee,he)),lt=at.replace(/(\/\.?\*+)+$/,"");if(lt!==at&&lt!==""){if(gl(lt,B))return!0;let ct=je||at.slice(lt.length).includes("/."),ut=(ft)=>ct?ts(ft,lt):RC(ft,lt);if(B.markerFiles.some(ut))return!0;return Q&&df(B).some(ut)}if(gl(at,B))return!0;return Q&&df(B).some((ct)=>ts(ct,at))}function RC(O,D){let B=mf(D,O);if(B===""||B.startsWith("..")||ff(B))return!1;return!B.split(/[\\/]/)[0]?.startsWith(".")}function _C(O,D,B,Q,ee){return Er(O,D,B,!0,Q,ee)}function wC(O,D,B,Q,ee){if(!B)return!1;return gl(ns(tn(O,D,Q,ee)),B)}function uf(O,D,B,Q,ee,he){let je=ns(tn(O,D,Q,ee));return he.includes(je)||hf(je,B)}function gf(O,D,B,Q,ee){if(!B)return!1;return B.hooksDirectories.some((he)=>O.some((je)=>ts(he,ns(tn(je,D,Q,ee)))))}function gl(O,D){return D.entries.includes(O)||D.directories.includes(O)||hf(O,D)}function hf(O,D){return D.hooksDirectories.some((B)=>ts(O,B))}function df(O){return[...O.entries,...O.directories,...O.hooksDirectories]}function ts(O,D){let B=mf(D,O);return B===""||!/^\.\.(?:[\\/]|$)/.test(B)&&!ff(B)}function ns(O){return process.platform==="win32"?O.toLowerCase():O}function PC(O,D,B,Q,ee){if(Wo(O))return null;let he=Cr([...O],Q);if(Tt(he[0]??"").toLowerCase()!=="mv")return null;let je=es(he.slice(1)),at=je.sources.find((lt)=>_C(cn(lt,D.variables),D.cwd,B,Q,ee));if(at)return at;return je.destination&&wC(cn(je.destination,D.variables),D.cwd,B,Q,ee)?je.destination:null}import{isAbsolute as as,normalize as NC,parse as LC,posix as Rf,resolve as Rr,sep as Sl}from"node:path";import{isAbsolute as AC,join as yf,normalize as Cf,parse as TC,sep as bf}from"node:path";var IC=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],kC=` 	
-`;function zo(O,D){if(ir(O,D))return!0;if(!O.has("TMPDIR"))return!1;return!hl(O.get("TMPDIR")??"",D)}function xr(O,D){if(O.has("TMPDIR"))return hl(O.get("TMPDIR")??"",D);let B=yl(O,D);if(B===void 0)return!0;return hl(B,D)}function yl(O,D){return Ef(O,D,"TMPDIR")}function hl(O,D){if(!O)return!1;if(MC(O))return!1;return Zr(O,D)}function ir(O,D){let B=Ef(O,D,"IFS");return B!==void 0&&B!==""&&B!==kC}function Zr(O,D){let B=rs(O,D.paths);if(B===null)return!1;return vf(D).some((Q)=>ss(B,Q))}function is(O,D){let B=rs(O,D.paths);if(B===null)return!1;return vf(D).some((Q)=>os(Q)===os(B))}var Sf=new WeakMap;function vf(O){let D=Sf.get(O);if(D)return D;let B=OC(O);return Sf.set(O,B),B}function OC(O){let D=IC.map((Q)=>rs(Q,O.paths)??Cf(Q)),B=rs(O.tmpdir,O.paths);if(!B)return D;if(process.platform==="win32")return[...D,B];if(process.platform==="darwin"&&DC(B))return[...D,B];return D}function MC(O){return/[\s$`*?[]/.test(O)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(O)||/[+@!]\([^)]*\)/.test(O)}function Ef(O,D,B){return O.has(B)?O.get(B):D.env.get(B)}function DC(O){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(O)}function rs(O,D){try{let B=Cf(O);if(!AC(B))return B;let Q=TC(B).root,ee=B.slice(Q.length).split(/[\\/]+/).filter(Boolean),he=Q;for(let je=0;je<ee.length;je++){let at=yf(he,ee[je]??"");if(D.entryKind(at)==="missing")return yf(at,...ee.slice(je+1));let lt=D.realpath(at);if(lt===null)return null;he=lt}return he}catch{return null}}function ss(O,D){let B=os(O),Q=os(D);if(B===Q)return!0;let ee=Q.endsWith(bf)?Q:`${Q}${bf}`;return B.startsWith(ee)}function os(O){return process.platform==="win32"?O.toLowerCase():O}var WC=process.platform==="win32",xf=64,GC=16384;function Bo(O,D,B,Q){if(O.kind==="temp_target")return null;let ee=Q[O.kind];if(O.kind==="dynamic_target"&&!Jt(B,ee.id,D.strict))return null;if(O.kind==="within_anchored_cwd"&&!Jt(B,ee.id,D.paranoid))return null;return St(ee.id,ee.reason)}function $o(O){let D=md(O,xf,xf,GC);return{expandedTargets:D&&"words"in D?D.words:void 0,unsafeBraceExpansion:D!==void 0&&"limited"in D,targetIsLiteral:D===void 0&&O.provenance==="literal"&&(O.quoted||O.raw!==O.text),tmpdirWordSplittingProtected:FC(O)}}function FC(O){let D=O.parts.filter((B)=>B.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(B.raw));return D.length>0&&D.every((B)=>zC(O.raw,B.span.start-O.span.start))}function zC(O,D){let B=null,Q=!1;for(let ee=0;ee<D;ee++){let he=O[ee];if(Q){Q=!1;continue}if(he==="\\"&&B!=="'"){Q=!0;continue}if(B===he){B=null;continue}if(B===null&&(he==="'"||he==='"'))B=he}return B==='"'}function _r(O){let D=O.environment.home,B=O.environment.paths,Q=O.budget??mn();return{anchoredCwd:O.originalCwd??O.cwd??null,resolvedCwd:O.cwd??null,strict:O.strict??!1,paranoid:O.paranoid??!1,trustTmpdirVar:O.allowTmpdirVar??!0,posixShell:O.posixShell??!1,tmpdirWordSplittingUnsafe:O.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:O.trustedTmpdirValue??O.allowTmpdirVar??!0,environment:O.environment,allowRoots:VC(O.allowPaths,D,B,Q),protectedGitMetadata:O.protectedGitMetadata,budget:Q}}function On(O,D,B={}){let Q=B.targetIsLiteral??!1;if(!Q&&D.tmpdirWordSplittingUnsafe&&!B.tmpdirWordSplittingProtected&&qC(O))return{kind:"outside_anchored_cwd"};let ee=!Q&&wf(O,D.posixShell);if(Qn(O))return{kind:"outside_anchored_cwd"};if(Cl(O,Q))return{kind:"root_or_home_target"};if($C(O,D,Q))return{kind:"root_or_home_target"};if(D.resolvedCwd&&Er(O,D.resolvedCwd,D.protectedGitMetadata,!0,D.environment,D.budget,!D.posixShell))return{kind:"git_metadata_target"};if(UC(O,D.trustTmpdirVar,D.posixShell,ee,Q,B.tmpdirWordSplittingProtected??!1,D.trustedTmpdirValue,D.environment))return{kind:"temp_target"};if(ee)return{kind:"dynamic_target"};if(KC(O,D,Q))return{kind:"temp_target"};let he=D.anchoredCwd;if(he){if(!B.skipHomeCwd&&JC(he,D.environment.home,D.environment.paths,D.budget))return{kind:"home_cwd_target"};if(!B.skipCwdSelf&&[D.resolvedCwd??he,he].some((je)=>QC(O,D.resolvedCwd??he,D.environment.paths,D.budget,je)))return{kind:"cwd_self_target"};if(ev(O,he,D.resolvedCwd??he,ee,Q,D.environment.paths,D.budget))return{kind:"within_anchored_cwd"}}if(BC(O,D,ee))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function BC(O,D,B){let Q=O.trim();if(B||!D.resolvedCwd||!D.anchoredCwd||!Q)return!1;if(as(Q)||Q.startsWith("~"))return!1;if(vl(Q))return!1;if(Pf(D.resolvedCwd,D.anchoredCwd,D.environment.paths,D.budget))return!1;return Zr(Rr(D.resolvedCwd,Q),D.environment)}function _f(O,D,B={}){let{containmentTarget:Q,...ee}=B;if(On(O,D,ee).kind!=="temp_target")return!1;let he=O.trim();if(jC(he))return!1;if(is(he,D.environment))return!1;return![D.anchoredCwd,D.resolvedCwd].some((je)=>Pf(Q??he,je,D.environment.paths,D.budget))}function Cl(O,D=!1){let B=O.trim(),Q=Rf.normalize(B),ee=B.replace(/\\/g,"/"),he=Q==="/"?Q:Q.replace(/\/+$/,"");if(he==="/"||he.startsWith("/")&&he.slice(1).split("/").every((je)=>/^\*+$/.test(je)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(ee)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(ee))return!0;if(!D&&(Q==="~"||Q==="~/"||Q==="~/*"))return!0;if(!D&&(Q==="$HOME"||Q==="$HOME/"||Q==="$HOME/*"))return!0;if(!D&&(Q==="${HOME}"||Q==="${HOME}/"||Q==="${HOME}/*"))return!0;return!1}function $C(O,D,B){let Q=O.trim(),ee=B?Q:Q==="*"?".":Q.endsWith("/*")?Q.slice(0,-2):Q;if(!ee)return!1;try{let he=as(ee)?ee:D.resolvedCwd?Rr(D.resolvedCwd,ee):null;if(!he)return!1;let je=dn(Lt(he,D.environment.paths,D.budget));if(je===LC(je).root)return!0;return je===dn(Lt(D.environment.home,D.environment.paths,D.budget))}catch{return!1}}function dn(O){let D=NC(O);if(WC){if(D=D.replace(/\//g,"\\").toLowerCase(),D.length>3&&D.endsWith("\\"))D=D.slice(0,-1);return D}if(D.length>1&&D.endsWith("/"))D=D.slice(0,-1);return D}function UC(O,D,B,Q,ee,he,je,at){let lt=O.trim();if(vl(lt))return!1;if(!Q&&Zr(lt,at))return!0;return(D||he&&je)&&B&&!ee&&HC(lt,B)}function HC(O,D){return["$TMPDIR","${TMPDIR}"].some((B)=>{if(O===B)return!0;if(!O.startsWith(`${B}/`))return!1;return!wf(O.slice(B.length+1),D)})}function jC(O){let D=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(O);if(!D)return!1;return Rf.normalize(`/${D[1]??""}`)==="/"}function vl(O){return O.split(/[\\/]+/).includes("..")}function VC(O,D,B,Q){if(!O?.length)return[];return O.flatMap((ee)=>{let he=vo(ee.trim(),D);if(!as(he))return[];try{let je=Lt(he,B,Q);if(Eo(je,Lt(D,B,Q)))return[];return[dn(je)]}catch{return[]}})}function KC(O,D,B){if(D.allowRoots.length===0)return!1;let Q=O.trim();if(vl(Q))return!1;let ee=B?Q:vo(Q,D.environment.home),he=D.resolvedCwd??D.anchoredCwd,je=as(ee)?ee:he?Rr(he,ee):null;if(!je)return!1;try{let at=dn(Lt(je,D.environment.paths,D.budget));return D.allowRoots.some((lt)=>at===lt||at.startsWith(lt.endsWith(Sl)?lt:`${lt}${Sl}`))}catch{return!1}}function qC(O){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(O)}function wf(O,D=!1){return O.includes("$")||O.includes("`")||YC(O)||D&&ZC(O)}function YC(O){let D=!1;for(let B of O){if(D){D=!1;continue}if(B==="\\"){D=!0;continue}if(B==="*"||B==="?"||B==="[")return!0}return!1}function ZC(O){let D=!1;for(let B=0;B<O.length;B++){let Q=O[B];if(D){D=!1;continue}if(Q==="\\"){D=!0;continue}if(Q==="{"&&XC(O,B)||(Q==="+"||Q==="@"||Q==="!")&&O[B+1]==="(")return!0}return!1}function XC(O,D){let B=O.indexOf("}",D+1);if(B===-1)return!1;let Q=O.slice(D+1,B);return Q.includes(",")||Q.includes("..")}function JC(O,D,B,Q){try{return dn(Lt(O,B,Q))===dn(Lt(D,B,Q))}catch{try{return dn(O)===dn(D)}catch{return!1}}}function QC(O,D,B,Q,ee=D){if(ee===D&&(O==="."||O==="./"||O===".\\"))return!0;try{return dn(Lt(Rr(D,O),B,Q))===dn(Lt(ee,B,Q))}catch{try{return dn(Rr(D,O))===dn(ee)}catch{return!1}}}function ev(O,D,B,Q,ee,he,je){let at=B??D;if(!ee&&(O.startsWith("~")||O.startsWith("$HOME")||O.startsWith("${HOME}")))return!1;if(Q)return!1;if(O.startsWith("/")||/^[A-Za-z]:[\\/]/.test(O))try{return bl(O,D,he,je)}catch{return!1}if(O.startsWith("./")||O.startsWith(".\\")||!O.includes("/")&&!O.includes("\\"))try{return bl(Rr(at,O),D,he,je)}catch{return!1}if(O.startsWith("../"))return!1;try{return bl(Rr(at,O),D,he,je)}catch{return!1}}function bl(O,D,B,Q){try{return Af(Lt(O,B,Q),Lt(D,B,Q))}catch{return!1}}function Pf(O,D,B,Q){if(!D)return!1;try{return Af(Lt(D,B,Q),Lt(O,B,Q))}catch{return!0}}function Af(O,D){let B=dn(O),Q=dn(D);return B.startsWith(`${Q}${Sl}`)||B===Q}var tv=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Tf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",nv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",If="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",kf="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",rv="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",ov="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",iv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:kf},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:x},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:If},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:rv},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Tf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:nv},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Tf}};function Of(O,D,B,Q=_r({...B,allowPaths:B.policy?.destructiveCommandAllowPaths})){return sv(O.words.map((ee)=>({kind:"word",text:ee.text,dynamic:ee.provenance!=="literal"})),D,Q,B.policy)}function sv(O,D,B,Q){let ee=O.filter((lt)=>lt.kind==="word"),he=lv(ee),je=ee[he];if(!je||!tv.has(yv(je.text)))return null;let at=av(ee.slice(he+1));if(at.whatIfProtected)return null;if(Jt(Q,"powershell.remove-item-pipeline-dynamic-target",B.strict)&&D&&(at.targets.length===0||at.recursive))return St("powershell.remove-item-pipeline-dynamic-target",ov);for(let lt of at.targets)if(!Qn(lt.text)&&Cl(xl(lt.text)))return St(at.recursive&&at.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",kf);for(let lt of at.targets)if(B.resolvedCwd&&Er(xl(lt.text),B.resolvedCwd,B.protectedGitMetadata,at.recursive,B.environment,B.budget,!0))return St("powershell.remove-item-git-metadata",x);if(!at.recursive||!at.force)return null;if(Jt(Q,"powershell.remove-item-recursive-force-dynamic-target",B.strict)&&(at.hasDynamicTarget||at.targets.length===0))return St("powershell.remove-item-recursive-force-dynamic-target",If);for(let lt of at.targets){let ct=Bo(On(xl(lt.text),B),B,Q,iv);if(ct)return ct}return null}function av(O){let D=[],B=!1,Q=!1,ee=!1,he=!1,je=!1;for(let at=0;at<O.length;at++){let lt=O[at];if(!lt||lt.kind!=="word")continue;if(cv(lt))continue;if(je){D.push(El(lt)),he=he||lt.dynamic;continue}if(lt.text==="--"){je=!0;continue}let ct=dv(lt.text);if(!ct){D.push(El(lt)),he=he||lt.dynamic;continue}if(fv(ct.name)){let ut=ct.value?uv(ct.value,lt):O[++at];if(ut?.kind==="word"){D.push(El(ut)),he=he||ut.dynamic;continue}he=!0;continue}if(mv(ct.name)){B=!0;continue}if(pv(ct.name)){Q=!0;continue}if(gv(ct.name))ee=hv(ct.value)}return{targets:D,recursive:B,force:Q,whatIfProtected:ee,hasDynamicTarget:he}}function lv(O){let D=O[0];if(D?.kind==="word"&&D.text==="&"||D?.text===".")return O.length>1?1:0;return 0}function El(O){return{text:O.kind==="word"?O.text:"",dynamic:O.kind==="word"&&O.dynamic}}function cv(O){return O.kind==="word"&&O.text===","}function xl(O){let D=O.replace(/\\/g,"/"),B=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(D);return B?`$HOME${D.slice(B[0].length)}`:D}function uv(O,D){return{kind:"word",text:O,dynamic:D.kind==="word"&&(D.dynamic||O.includes("$"))}}function dv(O){if(!O.startsWith("-")||O==="-")return null;let D=O.slice(1),B=D.indexOf(":");if(B===-1)return{name:D.toLowerCase()};return{name:D.slice(0,B).toLowerCase(),value:D.slice(B+1)}}function fv(O){return"path".startsWith(O)||"literalpath".startsWith(O)}function mv(O){return"recurse".startsWith(O)}function pv(O){return O.length>=2&&"force".startsWith(O)}function gv(O){return O==="wi"||"whatif".startsWith(O)}function hv(O){if(O===void 0||O==="")return!0;let D=O.toLowerCase();return D==="$true"||D==="true"}function yv(O){return O.toLowerCase()}var Xr="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",ls="Unsupported heredoc syntax",Uo="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Mf="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var bv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),Sv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),Cv=new Set(["-o","--output","--query","--subscription"]),vv=new Set;function Df(O){if(O==="aws")return bv;if(O==="gcloud")return Sv;if(O==="az")return Cv;return vv}var Ev=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),xv=new Set;function Nf(O){if(O==="git")return gn;if(O==="docker")return Ev;return xv}function _(O,D){if(O.length===0||D.length===0)return null;let B=kt(O[0]??""),Q=an(O);for(let ee of D){if(!wv(B,ee.command))continue;if(ee.match){if(Rv(B,O,ee.match))return Lf(ee);continue}if(!Pv(B,O,ee.subcommand))continue;if(Tv(O,new Set(ee.block_args),Q))return Lf(ee)}return null}function Lf(O){return{id:`custom.${O.name}`,reason:`[${O.name}] ${O.reason}`,intent:O.intent??"manual_only"}}function Rv(O,D,B){let Q=D.slice(1);if(B.exclude_args?.some((ee)=>Q.includes(ee)))return!1;if(B.any_args&&!B.any_args.some((ee)=>Q.includes(ee)))return!1;return _v(Q,B.command_path,Df(O))}function _v(O,D,B){let Q=0,ee=!1;for(let he of O){if(Q>=D.length)return!0;if(ee){ee=!1;continue}if(he.startsWith("-")){ee=!he.includes("=")&&B.has(he);continue}if(he!==D[Q])return!1;Q++}return Q>=D.length}function wv(O,D){return O===kt(D)}function Pv(O,D,B){if(!B)return!0;return Wf(D,1,B,Nf(O))}function Wf(O,D,B,Q){let ee=!1;for(let he=D;he<O.length;he++){let je=O[he];if(!je)continue;if(ee){ee=!1;continue}if(je==="--"){let at=O[he+1];if(at&&!at.startsWith("-"))return at===B;return!1}if(Q.has(je)){ee=!0;continue}if(je.startsWith("-")){if(!je.includes("=")&&Av(O,he,B,Q))return!0;continue}return je===B}return!1}function Av(O,D,B,Q){let ee=O[D+1];if(!ee||ee.startsWith("-"))return!1;return Wf(O,D+2,B,Q)}function Tv(O,D,B){return O.some((Q)=>D.has(Q))||[...B].some((Q)=>D.has(Q))}var Iv=new Set(["-e","--source"]),kv=new Set(["-F","-v","--assign","--field-separator"]),Gf=new Set(["-f","--file"]),Ov=new Set(["print","printf","return"]),Ff=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Mv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function zf(O,D,B){let Q=!1;for(let ee of Dv(O)){let he=Nv(ee,B);if(!he)continue;for(let je of he.commands){let at=D(je);if(at)return at;if(je.includes("{}")||/[$`]/.test(je))Q=!0}Q||=he.dynamic}return Q?St("awk.system-dynamic",Mv):null}function _l(O){let D=[],B=!1,Q=!1,ee=!0,he=!0;for(let je=1;je<O.length;je++){let at=O[je];if(at===void 0)break;if(ee&&at==="--"){ee=!1;continue}if(ee&&Iv.has(at)){B=!0;let lt=O[je+1];if(he&&=lt!==void 0,lt!==void 0)D.push({tokenIndex:je+1,kind:"inline-code",value:lt});je++;continue}if(ee&&at.startsWith("--source=")){B=!0,D.push({tokenIndex:je,kind:"inline-code",value:at.slice(9)});continue}if(ee&&at.startsWith("-e")&&at.length>2){B=!0,D.push({tokenIndex:je,kind:"inline-code",value:at.slice(2)});continue}if(ee&&(kv.has(at)||Gf.has(at))){let lt=O[je+1];if(he&&=lt!==void 0,Gf.has(at)){if(Q=!0,lt!==void 0)D.push({tokenIndex:je+1,kind:"program-file",value:lt})}je++;continue}if(ee&&(at.startsWith("-F")||at.startsWith("-v")&&at.slice(2).includes("=")))continue;if(ee&&at.startsWith("-f")&&at.length>2){Q=!0,D.push({tokenIndex:je,kind:"program-file",value:at.slice(2)});continue}if(ee&&(at.startsWith("--assign=")||at.startsWith("--field-separator=")))continue;if(ee&&at.startsWith("--file=")){Q=!0,D.push({tokenIndex:je,kind:"program-file",value:at.slice(7)});continue}if(ee&&at.startsWith("-")&&at!=="-")continue;if(!B&&!Q)D.push({tokenIndex:je,kind:"main-program",value:at});return{sources:D,optionsOpen:!1}}return{sources:he?D:[],optionsOpen:ee&&he}}function jo(O){return _l(O).sources}function Dv(O){return jo(O).filter((D)=>D.kind!=="program-file").map((D)=>D.value)}function Nv(O,D){bn(D,O);let B=O.includes("system")?wl(O,D):null,Q=Lv(O,D);if(!B&&!Q)return null;return{dynamic:!!B?.dynamic||!!Q?.dynamic,commands:[...B?.commands??[],...Q?.commands??[]]}}function wl(O,D){bn(D,O);let B=[],Q=!1,ee=!1,he=0;while(he<O.length){let je=O[he];if(je==='"'||je==="'"){he=us(O,he,je)?.endIndex??he+1;continue}if(je==="#"){he=Bf(O,he+1);continue}if(je==="/"&&$f(O,he)){he=Uf(O,he+1)??he+1;continue}if(!O.startsWith("system",he)){he++;continue}let at=he;if(he+=6,Ho(O[at-1])||Ho(O[he]))continue;let lt=cs(O,he);if(O[lt]!=="(")continue;lt=cs(O,lt+1);let ct=O[lt];if(ct!=='"'&&ct!=="'"){Q=!0,ee=!0;continue}let ut=us(O,lt,ct);if(!ut){Q=!0,ee=!0;continue}if(lt=cs(O,ut.endIndex),Q=!0,O[lt]!==")"){ee=!0,he=ut.endIndex;continue}B.push(ut.value),he=lt+1}if(!Q)return null;return{dynamic:ee,commands:B}}function Lv(O,D){bn(D,O);let B=[],Q=!1,ee=!1,he=0,je=0,at=null,lt=null,ct=0;while(he<O.length){let ut=O[he];if(!ut)break;if(ut==='"'||ut==="'"){let mt=us(O,he,ut);if(mt&&ct===je)lt={...mt,startIndex:he};ct=mt?.endIndex??he+1,he=mt?.endIndex??he+1;continue}if(ut==="#"){he=Bf(O,he+1),je=he,at=null,lt=null,ct=he;continue}if(ut==="/"&&$f(O,he)){let mt=Uf(O,he+1);ct=mt??he+1,he=mt??he+1;continue}if(`;
-{}`.includes(ut)){he++,je=he,at=null,lt=null,ct=he;continue}if(at===null&&(Rl(O,he,"print")||Rl(O,he,"printf")))at=he;if(ut!=="|"||O[he-1]==="|"||O[he+1]==="|"){if(!/\s/.test(ut))ct=he+1;he++;continue}let ft=O[he+1]==="&"?he+2:he+1,dt=cs(O,ft);if(Rl(O,dt,"getline")){ee=!0;let mt=Fv(je,lt,ct);if(Q||=mt===null,mt!==null)B.push(mt);ct=ft,he=ft;continue}if(Bv(je,at)){ee=!0;let mt=Gv(O,dt);if(!mt){Q=!0,ct=ft,he=ft;continue}if(!Wv(O,mt.endIndex)){Q=!0,ct=mt.endIndex,he=mt.endIndex;continue}B.push(mt.value),ct=mt.endIndex,he=mt.endIndex;continue}ct=ft,he++}if(!ee)return null;return{dynamic:Q,commands:B}}function Ho(O){return!!O&&/[A-Za-z0-9_]/.test(O)}function cs(O,D){let B=D;while(/\s/.test(O[B]??""))B++;return B}function Wv(O,D){let B=D;while(/[\t\f\v\r ]/.test(O[B]??""))B++;let Q=O[B];return!Q||`;
-}#`.includes(Q)}function us(O,D,B){let Q="",ee=!1;for(let he=D+1;he<O.length;he++){let je=O[he];if(!je)break;if(ee){let at=zv(O,he);if(!at)return null;Q+=at.value,he=at.endIndex,ee=!1;continue}if(je==="\\"){ee=!0;continue}if(je===B)return{value:Q,endIndex:he+1};Q+=je}return null}function Gv(O,D){let B=O[D];if(B!=='"'&&B!=="'")return null;return us(O,D,B)}function Fv(O,D,B){if(!D)return null;return D.startIndex>=O&&D.endIndex===B?D.value:null}function zv(O,D){let B=O[D];if(!B)return null;if(B==="x"){let ee=O.slice(D+1,D+3);if(!/^[0-9A-Fa-f]{2}$/.test(ee))return null;return{value:String.fromCharCode(Number.parseInt(ee,16)),endIndex:D+2}}if(/[0-7]/.test(B)){let ee=/^[0-7]{1,3}/.exec(O.slice(D));if(!ee)return null;return{value:String.fromCharCode(Number.parseInt(ee[0],8)),endIndex:D+ee[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[B]??B,endIndex:D}}function Rl(O,D,B){return O.startsWith(B,D)&&!Ho(O[D-1])&&!Ho(O[D+B.length])}function Bv(O,D){return D!==null&&D>=O}function Bf(O,D){let B=O.indexOf(`
-`,D);return B===-1?O.length:B+1}function $f(O,D){let B=$v(O,D);if(B===-1)return!0;if("{([,;!~=".includes(O[B]??""))return!0;let Q=B;while(Ho(O[Q-1]))Q--;return Ov.has(O.slice(Q,B+1))}function $v(O,D){for(let B=D-1;B>=0;B--)if(!/\s/.test(O[B]??""))return B;return-1}function Uf(O,D){let B=!1;for(let Q=D;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(B){B=!1;continue}if(ee==="\\"){B=!0;continue}if(ee==="/")return Q+1}return null}var Uv=new Set(["sudo","env","command","builtin"]);function ds(O,D){let B=O[0];if(!B||!D.transparentWrappers.includes(Tt(B)))return null;let Q=Tt(B),ee=O[1]==="--"?2:1,he=Hv(O,ee,Q,D),je=he[0];if(je===void 0)return null;return{wrapper:Q,tokens:O.slice(je),childIndex:je,alternativeChildIndices:he.slice(1)}}function Hv(O,D,B,Q){let ee=O[1]==="--",he=[];for(let je=D;je<O.length;je++){let at=O[je];if(!at)continue;let lt=Tt(at)!==B&&jv(at,Q);if(lt)he.push(je);if(!lt&&bi.has(kt(at)))break;if(ee)break}return he}function jv(O,D){let B=Tt(O),Q=kt(O);return Q==="git"||B==="busybox"||wr(O)||ha.has(B)||D.transparentWrappers.includes(B)||Kt.has(Q)||O==="$SHELL"||An(Q)||En.has(Q)||D.rules.some((ee)=>ee.command===B)}function wr(O){return Uv.has(O.toLowerCase())}function Pr(O,D){return{embedded:!1,cwd:O.cwd,originalCwd:D.originalCwd,effectiveCwd:O.cwd,envAssignments:O.envAssignments,allowTmpdirVar:D.allowTmpdirVar,worktreeMode:D.worktreeMode,wrappedByTransparent:!1}}function Mn(O,D){let B=D.policy??{rules:[],transparentWrappers:[]};return fs([...O],D.environment,D.cwd,D.cwd,new Map,new Map(D.envAssignments??[]),B,{iterations:0},!1)}function*fs(O,D,B,Q,ee,he,je,at,lt){let ct=Yi(O,D,B,he);for(let[mt,pt]of ct.envAssignments)he.set(mt,pt),ee.set(mt,pt);let{tokens:ut,cwd:ft}=ct;if(ct.envSplitValues){let mt=qi(ct.envSplitValues,ut);if(!mt)throw new s("derivedCommandShape");Pl(at),yield*fs(mt,D,ft,Q,ee,he,je,at,lt);return}if(wr(ut[0]??""))throw new s("wrapperPeelIterations");let dt=ds(ut,je);if(dt){for(let mt of[dt.childIndex,...dt.alternativeChildIndices])Pl(at),yield*fs(mt===dt.childIndex?dt.tokens:ut.slice(mt),D,ft,Q,new Map(ee),new Map(he),je,at,!0);return}if(Kv(ut)){Pl(at),yield*fs(ut.slice(1),D,ft,Q,ee,he,je,at,lt);return}yield Vv(ut,ft,Q,ee,he,lt)}function Vv(O,D,B,Q,ee,he){return{tokens:O,cwd:D===null?void 0:D??B,wrapperCwd:D,wrapperEnvAssignments:Q,envAssignments:ee,head:Tt(O[0]??"").toLowerCase(),wrappedByTransparent:he}}function Pl(O){if(O.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");O.iterations++}function Kv(O){return Tt(O[0]??"").toLowerCase()==="busybox"&&O.length>1}function Al(O,D){let B=[],Q=D;while(Q<O.length){let ee=O[Q];if(ee===void 0||ee===":::")break;B.push(ee),Q++}return{markerIndex:Q<O.length&&O[Q]===":::"?Q:-1,templateTokens:B}}function Dn(O){let D=!1,B=!1;for(let Q of O){if(Q==="--")break;if(Q==="-r"||Q==="-R"||Tl(Q,"recursive")){D=!0;continue}if(Q==="-f"||Tl(Q,"force")){B=!0;continue}if(Q.startsWith("-")&&!Q.startsWith("--")){if(Q.includes("r")||Q.includes("R"))D=!0;if(Q.includes("f"))B=!0}}return D&&B}function Hf(O){let D=O.indexOf("--");return O.slice(1,D===-1?void 0:D).some((B)=>Tl(B,"recursive")||/^-[A-Za-z]+$/.test(B)&&/[rR]/.test(B.slice(1)))}function Tl(O,D){return O.length>2&&O.startsWith("--")&&D.startsWith(O.slice(2))}var qv="find -delete permanently removes files. Use -print first to preview.",Yv="find -exec rm -rf is dangerous. Use explicit file list instead.",Zv=new Set(["-exec","-execdir","-ok","-okdir"]),Xv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((O)=>[O,1]),["-fprintf",2]]);function jf(O,D){let B=O.map(t),Q=Jv(O,B,D);if(Q)return Q;if(ps(B,1)&&!eE(O,B,D)){let je=wt(St("find.delete",qv),D.policy);if(je)return je}let ee=D.budget??mn(),he=0;while(he<B.length){let je=B[he],at=sr(je??"");if(at>0){he+=at+1;continue}if(!Kn(je)){he++;continue}ee.charge("derivedTokens",B.length-he-1);let lt=Vo(B,he);he=lt.nextIndex;let ct=nE(lt.tokens,D.environment);if(ct){let mt=wt(ct,D.policy);if(mt)return mt}let ut=je==="-execdir"||je==="-okdir",ft=D.analyzeTokens?D.analyzeTokens(lt.tokens,ut?null:D.cwd):D.analyzeNested?D.analyzeNested(lt.tokens.join(" "),{effectiveCwd:ut?void 0:D.cwd,envAssignments:D.envAssignments}):null,dt=ft?.id.startsWith("custom.")?ft:wt(ft,D.policy);if(dt)return dt}return null}function Jv(O,D,B){if(!ps(D,1)&&!Il(D,B.environment))return null;let ee=ms(O)??$t(["."]),he=_r({...B,allowPaths:B.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let je of ee){let at=$o(je);for(let lt of at.expandedTargets??[t(je)]){let ct=On(lt,he,{targetIsLiteral:at.expandedTargets!==void 0||at.targetIsLiteral,tmpdirWordSplittingProtected:at.tmpdirWordSplittingProtected});if(ct.kind==="root_or_home_target")return St("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ct.kind==="git_metadata_target")return St("find.delete-git-metadata",x)}}if(Qv(D)&&he.resolvedCwd&&gf(ee.map(t),he.resolvedCwd,he.protectedGitMetadata,he.environment,he.budget))return St("find.delete-git-metadata",x);return null}function Il(O,D){let B=0;while(B<O.length){if(!Kn(O[B])){B++;continue}let Q=Vo(O,B),ee=Cr([...Q.tokens],D),he=Tt(ee[0]??"").toLowerCase();if((he==="rm"||he==="rmdir")&&ee.some((je)=>je.includes("{}")))return!0;B=Q.nextIndex}return!1}function Qv(O){return O.some((D,B)=>{if(!["-name","-iname"].includes(D))return!1;return O[B+1]?.toLowerCase()==="hooks"})}function eE(O,D,B){if(D.includes("-L")||D.includes("-f")||D.includes("-follow"))return!1;let Q=ms(O);if(!Q)return!1;let ee=B.envAssignments??new Map,he=yl(ee,B.environment),je=B.trustedTmpdirValue??xr(ee,B.environment),at=B.allowTmpdirVar??!zo(ee,B.environment),lt=_r({environment:B.environment,protectedGitMetadata:B.protectedGitMetadata,cwd:B.cwd,originalCwd:B.originalCwd,strict:B.strict,allowTmpdirVar:at&&je&&Boolean(he),allowPaths:B.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:B.tmpdirWordSplittingUnsafe??ir(ee,B.environment),trustedTmpdirValue:je,budget:B.budget});return Q.every((ct)=>{let ut=$o(ct);if(ut.unsafeBraceExpansion)return!1;return(ut.expandedTargets??[t(ct)]).every((ft)=>_f(ft,lt,{containmentTarget:tE(ft,he),targetIsLiteral:ut.expandedTargets!==void 0||ut.targetIsLiteral,tmpdirWordSplittingProtected:ut.tmpdirWordSplittingProtected}))})}function tE(O,D){if(!D)return O;return O.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>D)}function ms(O){let D=(ee)=>{let he=O[ee];return he?t(he):void 0},B=1;while(D(B)==="-H"||D(B)==="-P")B++;if(D(B)==="--")B++;let Q=[];while(B<O.length){let ee=D(B),he=O[B];if(!ee||!he||ee.startsWith("-")||["!","(",")"].includes(ee))break;Q.push(he),B++}return Q.length>0?Q:null}function nE(O,D){let B=rr([...O],D);if(B.length===0)return null;let Q=Tt(B[0]??"");if(Q==="busybox"&&B.length>1)B=B.slice(1),Q=Tt(B[0]??"");if(Q==="rm"&&Dn(B))return St("find.exec-rm-recursive-force",Yv);return null}function Vo(O,D){let B=D+1;while(B<O.length&&O[B]!==";"&&!(O[B]==="+"&&O[B-1]==="{}"))B++;return{tokens:O.slice(D+1,B),nextIndex:Math.min(B+1,O.length)}}function ps(O,D){let B=D;while(B<O.length){let Q=O[B];if(!Q){B++;continue}if(Kn(Q)){B=Vo(O,B).nextIndex;continue}let ee=sr(Q);if(ee>0){B+=ee+1;continue}if(Q==="-delete")return!0;B++}return!1}function sr(O){return Xv.get(O)??(/^-newer[A-Za-z]{2}$/.test(O)?1:0)}function Kn(O){return O!==void 0&&Zv.has(O)}import{resolve as Ix}from"node:path";function*kl(O){for(let D of O.nodes)yield*oE(D)}function rE(O){return Object.freeze([...kl(O)])}function st(O){return Object.freeze(rE(O).map((D)=>Object.freeze(D.words.map((B)=>B.text))))}function Ko(O){let D=h(O,"posix");if(D.status!=="complete"||D.nodes.length!==1)return null;let B=D.nodes[0];if(B?.kind!=="command")return null;if(B.redirections.length>0||B.nested.length>0)return null;if(B.words.some((Q)=>Q.provenance==="command-substitution"))return null;return B.words.map((Q)=>Q.text)}function*oE(O){if(O.kind==="command"){yield O;for(let D of O.nested)yield*kl(D);return}if(O.kind==="group")yield*kl(O.body)}var iE=5,Ol="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function en(O){let D=O.indexOf("--");if(D===-1)return{index:-1,before:O,after:[]};return{index:D,before:O.slice(0,D),after:O.slice(D+1)}}function Kf(O,D,B){let Q=gs(O,D,B),ee=sE(Q.entries);if(ee.size===0)return{blockedReason:Q.blockedReason,expanded:!1,tokens:O};let he=O,je=!1;for(let at=0;at<iE;at++){let{subcommand:lt,rest:ct}=Sn(he),ut=lt?.toLowerCase();if(!ut||!ee.has(ut))return{blockedReason:Q.blockedReason,expanded:je,tokens:he};let ft=ee.get(ut),dt=dE(ft);if(dt===null||dt.length===0)return{blockedReason:Ol,expanded:!0,tokens:he};he=["git",...dt,...ct],je=!0}return{blockedReason:Ol,expanded:!0,tokens:he}}function qf(O,D,B){return gs(O,D,B).entries.some((Q)=>Q.key.toLowerCase()==="core.sshcommand")}function Sn(O){if(O.length===0)return{subcommand:null,rest:[]};let D=O[0];if((D?Tt(D).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let Q=1;while(Q<O.length){let ee=O[Q];if(!ee)break;if(ee==="--"){let he=O[Q+1];if(he&&!he.startsWith("-"))return{subcommand:he,rest:O.slice(Q+2)};return{subcommand:null,rest:O.slice(Q+1)}}if(!ee.startsWith("-"))return{subcommand:ee,rest:O.slice(Q+1)};Q+=gn.has(ee)?2:1}return{subcommand:null,rest:[]}}function sE(O){let D=new Map;for(let B of O){let Q=B.key.toLowerCase();if(!Q.startsWith("alias."))continue;let ee=Q.slice(6);if(ee!=="")D.set(ee,B.value)}return D}function gs(O,D,B){if(O.length===0)return{blockedReason:null,entries:[]};let Q=O[0];if((Q?Tt(Q).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let he=lE(D,B);return{blockedReason:he.blockedReason,entries:[...he.entries,...aE(O,D,B)]}}function aE(O,D,B){let Q=[],ee=1;while(ee<O.length){let he=O[ee];if(!he||he==="--"||!he.startsWith("-"))return Q;if(he==="-c"){let je=Ml(O[ee+1]);if(je)Q.push(je);ee+=2;continue}if(he.startsWith("-c")&&he.length>2){let je=Ml(he.slice(2));if(je)Q.push(je);ee++;continue}if(he==="--config-env"){let je=Vf(O[ee+1],D,B);if(je)Q.push(je);ee+=2;continue}if(he.startsWith("--config-env=")){let je=Vf(he.slice(13),D,B);if(je)Q.push(je);ee++;continue}if(gn.has(he)){ee+=2;continue}ee++}return Q}function lE(O,D){let B=cE(O,D),Q=uE(O,D);return{blockedReason:B===null||Q===null?Ol:null,entries:[...B??[],...Q??[]]}}function cE(O,D){let B=jn("GIT_CONFIG_PARAMETERS",O,D);if(B===void 0)return[];let Q=[],ee=Ko(B);if(!ee)return null;for(let he of ee){let je=Ml(he);if(!je)return null;Q.push(je)}return Q}function uE(O,D){let B=$d(O,D);if(B.state==="absent")return[];if(B.state==="invalid")return null;let Q=[];for(let ee=0;ee<B.count;ee++){let he=jn(`GIT_CONFIG_KEY_${ee}`,O,D)?.trim(),je=jn(`GIT_CONFIG_VALUE_${ee}`,O,D);if(!he||je===void 0)return null;Q.push({key:he,value:je})}return Q}function Ml(O){if(!O)return null;let D=O.indexOf("=");return{key:(D===-1?O:O.slice(0,D)).trim(),value:D===-1?void 0:O.slice(D+1)}}function Vf(O,D,B){let Q=O?.indexOf("=")??-1;if(!O||Q===-1)return null;return{key:O.slice(0,Q).trim(),value:jn(O.slice(Q+1),D,B)}}function dE(O){let D=O?.trimStart();if(!D||D.startsWith("!"))return null;return Ko(D)}var fE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",mE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",pE="git checkout --force discards uncommitted changes. Use 'git stash' first.",gE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",hE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",yE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",bE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",SE="git switch --force discards uncommitted changes. Use 'git stash' first.",CE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",vE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",EE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",xE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",RE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",_E="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",wE="git push --force destroys remote history. Use --force-with-lease for safer force push.",PE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",AE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",TE="git branch -D force-deletes without merge check. Use -d for safe delete.",IE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",kE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",OE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",ME="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",DE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",NE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",LE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",WE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),GE=new Set(["--recurse-submodules","--track","-t"]),Dl=new Set(["-b","-B","-U"]),Nl=new Set(["-c","-C"]),FE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function It(O,D){let B=O.split("=",1)[0]??O;return B.length>=4&&D.startsWith(B)&&B.startsWith("--")&&B.slice(2).length>=2}var Jr=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Zf(O,D){let{subcommand:B,rest:Q}=Sn(O);if(!B)return null;switch(B.toLowerCase()){case"checkout":return ar(zE(Q,D));case"switch":return ar($E(Q));case"restore":return ar(HE(Q));case"reset":return VE(Q);case"clean":return ar(qE(Q));case"rm":return ar(YE(Q));case"push":return Ar(ZE(Q));case"branch":return Ar(QE(Q));case"stash":return Ar(ox(Q));case"worktree":return Ar(ix(Q));case"rebase":return ar(ex(Q));case"merge":return ar(tx(Q));case"tag":return Ar(nx(Q));case"reflog":return Ar(rx(Q));default:return null}}function ar(O){return O?{...O,localDiscard:!0}:null}function Ar(O){return O?{...O,localDiscard:!1}:null}function zE(O,D){let{index:B,before:Q}=en(O),ee=an(Q,{shortOptsWithValue:Dl});if(Q.some((at)=>It(at,"--force"))||ee.has("-f"))return St("git.checkout-force",pE);for(let at of O){if(at==="-b"||at==="-B"||at==="--orphan")return null;if(It(at,"--pathspec-from-file"))return St("git.checkout-pathspec-from-file",hE)}if(B!==-1){if(Q.some((lt)=>!lt.startsWith("-")))return St("git.checkout-ref-path",gE);return St("git.checkout-double-dash",fE)}let he=UE(O);if(he.length>=2)return St("git.checkout-ambiguous",yE);let je=he[0];if(je===void 0||ee.has("-d")||ee.has("-t")||O.some((at)=>It(at,"--detach")||It(at,"--track")))return null;if(BE(je)||D(je))return St("git.checkout-double-dash",mE);return null}function BE(O){return O==="."||O===".."||/^\.\.?[/\\]/.test(O)||/^([/\\]|[A-Za-z]:[/\\])/.test(O)||O.endsWith("/")||O.startsWith(":")||/[*?[]/.test(O)}function $E(O){let{before:D}=en(O);if(D.some((Q)=>It(Q,"--discard-changes")))return St("git.switch-discard-changes",bE);let B=an(D,{shortOptsWithValue:Nl});if(D.some((Q)=>It(Q,"--force"))||B.has("-f"))return St("git.switch-force",SE);return null}function UE(O){let D=[],B=0;while(B<O.length){let Q=O[B];if(!Q)break;if(Q==="--")break;if(!Q.startsWith("-")){D.push(Q),B++;continue}if(WE.has(Q)){B+=2;continue}if(GE.has(Q)){let ee=O[B+1],he=Q==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];B+=ee&&!ee.startsWith("-")&&he.includes(ee)?2:1;continue}B++}return D}function HE(O){let D=jE(O);if(D.isTerminal||!D.hasPathspec&&!D.hasPatch||!D.hasWorktree)return null;return D.hasExplicitLocation?St("git.restore-worktree",vE):St("git.restore-unstaged",CE)}function jE(O){let D=!1,B=!1,Q=!0,ee=!1,he=(je)=>{if(!ee)Q=!1,ee=!0;if(je!==void 0)Q=je};for(let je=0;je<O.length;je++){let at=O[je];if(at===void 0)break;if(at==="--"){D||=je+1<O.length;break}if(at==="--pathspec-from-file"){D=!0,je++;continue}if(at.startsWith("--pathspec-from-file=")){D=!0;continue}if(at==="-h"||at==="--help"||at==="--version")return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!0};if(at==="--staged"){he();continue}if(at==="--no-staged"){he();continue}if(at==="--worktree"){he(!0);continue}if(at==="--no-worktree"){he(!1);continue}if(at==="--patch"){B=!0;continue}if(at==="--no-patch"){B=!1;continue}if(FE.has(at)){je++;continue}if(at.startsWith("--"))continue;if(at==="-"){D=!0;continue}if(!at.startsWith("-")){D=!0;continue}for(let lt=1;lt<at.length;lt++){let ct=at.charAt(lt);if(ct==="h")return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!0};if(ct==="S"){he();continue}if(ct==="W"){he(!0);continue}if(ct==="p"){B=!0;continue}if(ct==="s"||ct==="U"){if(lt===at.length-1)je++;break}}}return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!1}}function VE(O){let D=null;for(let B of O){if(It(B,"--hard")){D=St("git.reset-hard",EE);break}if(It(B,"--merge")){D=St("git.reset-merge",xE);break}}if(!D)return null;return KE(O)?Ar(D):ar(D)}function KE(O){for(let D of O){if(D==="--")return!1;if(!D.startsWith("-"))return!0}return!1}function qE(O){for(let B of O)if(B==="-n"||It(B,"--dry-run"))return null;let D=an(O.filter((B)=>B!=="--"));if(O.some((B)=>It(B,"--force"))||D.has("-f"))return St("git.clean-force",RE);return null}function YE(O){let D=!1,B=!1,Q=!1;for(let ee of en(O).before){if(It(ee,"--no-force")){D=!1;continue}if(It(ee,"--force")){D=!0;continue}if(It(ee,"--no-cached")){B=!1;continue}if(It(ee,"--cached")){B=!0;continue}if(It(ee,"--no-dry-run")){Q=!1;continue}if(It(ee,"--dry-run")){Q=!0;continue}let he=an([ee]);D||=he.has("-f"),Q||=he.has("-n")}return D&&!B&&!Q?St("git.rm-force",_E):null}function ZE(O){let{before:D,after:B}=en(O),Q=an(D);if(D.some((je)=>It(je,"--mirror")))return St("git.push-mirror",AE);if(D.some((je)=>It(je,"--force"))||Q.has("-f")||Yf(D,B).some(XE))return St("git.push-force",wE);if(D.some((je)=>It(je,"--delete"))||Q.has("-d")||Yf(D,B).some(JE))return St("git.push-delete",PE);return null}function Yf(O,D){return[...O.filter((B)=>B!==""&&!B.startsWith("-")),...D]}function XE(O){return O.startsWith("+")||O.includes(":+")}function JE(O){return O.length>1&&O.startsWith(":")}function QE(O){let{before:D}=en(O),B=an(D),Q=B.has("-D")||B.has("-d")||D.some((he)=>It(he,"--delete")),ee=B.has("-D")||B.has("-f")||D.some((he)=>It(he,"--force"));if(Q&&ee)return St("git.branch-force-delete",TE);return null}function ex(O){let{before:D}=en(O);return D.some((B)=>It(B,"--abort"))?St("git.rebase-abort",IE):null}function tx(O){let{before:D}=en(O);return D.some((B)=>It(B,"--abort"))?St("git.merge-abort",kE):null}function nx(O){let{before:D}=en(O);return an(D).has("-d")||D.some((Q)=>It(Q,"--delete"))?St("git.tag-delete",OE):null}function rx(O){return O[0]==="delete"?St("git.reflog-delete",ME):null}function ox(O){for(let D of O){if(D==="drop")return St("git.stash-drop",DE);if(D==="clear")return St("git.stash-clear",NE)}return null}function ix(O){let{before:D}=en(O);if(!D.includes("remove"))return null;let Q=an(D);if(D.some((ee)=>It(ee,"--force"))||Q.has("-f"))return St("git.worktree-remove-force",LE);return null}import{dirname as _x,isAbsolute as wx,join as dm,resolve as Px}from"node:path";var Wl="TMPDIR",Gl="IFS",Jf=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Qf=/^[A-Za-z_][A-Za-z0-9_]*$/,em=new Set(["export","typeset","declare","readonly"]),sx=new Set(["builtin","command","time"]),tm=new Set(["do","then","else"]),ax=new Set(["do","then","case"]),Xf=new Set(["done","fi","esac"]),lx=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function nm(O,D){return O.map((B)=>B.provenance==="variable"&&lm(B.text)?qo(B.text,D.shellAssignments):t(B))}function qo(O,D){return O.replace(lx,(B,Q,ee)=>D.get(Q??ee??"")??B)}function rm(O,D){return{env:O,effectiveEnvAssignments:fx(O,D),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function om(O){return{env:O.env,effectiveEnvAssignments:O.effectiveEnvAssignments?new Map(O.effectiveEnvAssignments):void 0,shellAssignments:new Map(O.shellAssignments),bodyDepth:O.bodyDepth,bodyAssignments:new Set(O.bodyAssignments)}}function Fl(O,D){let B=sm(O,D),Q=O[0]??"";if(ax.has(Q))D.bodyDepth+=1;if(Q==="elif"||Xf.has(Q))D.bodyDepth=Math.max(0,D.bodyDepth-1);if(Xf.has(Q)&&D.bodyDepth===0)D.bodyAssignments.forEach((at)=>{D.shellAssignments.delete(at)}),D.bodyAssignments.clear();B.assignments.filter((at)=>at.persists).forEach((at)=>{if(D.shellAssignments.set(at.name,at.value),D.bodyDepth>0)D.bodyAssignments.add(at.name);zl(D,at)});let ee=B.commandIndex;if(ee!==-1&&em.has(O[ee]??""))O.filter((at)=>Qf.test(at)&&Ll(at)).forEach((at)=>{mx(D,at)});let he=ee===-1?-1:am(O,ee);if(he===-1||O[he]!=="unset")return;let je=gx(O,he);if(je===null)return;O.slice(je).forEach((at)=>{if(tm.has(Q)){D.shellAssignments.set(at,"");return}px(D,at)})}function im(O,D){let B=sm(O,D).assignments;if(B.length===0)return D.effectiveEnvAssignments;let Q=new Map(D.effectiveEnvAssignments??[]);return B.forEach((ee)=>{Q.set(ee.name,ee.value)}),Q}function sm(O,D){let B=tm.has(O[0]??"")?1:0,Q=O.findIndex((at,lt)=>lt>=B&&!lm(at)),ee=Q!==-1&&em.has(O[am(O,Q)]??""),he=dx(D);return{assignments:O.flatMap((at,lt)=>{let ct=cx(at,he,D.env);if(!ct)return[];if(Q!==-1&&lt>Q&&!ee&&!Vi(ct.name))return[];return he.set(ct.name,ct.value),[{...ct,persists:Q===-1||ee}]}),commandIndex:Q}}function am(O,D){let B=D;while(sx.has(O[B]??"")){B+=1;while(O[B]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(O[B]??""))return D;B+=1}}return B}function lm(O){return Rn(O)!==null||Jf.test(O)}function cx(O,D,B){return Rn(O)??ux(O,D,B)}function ux(O,D,B){let Q=Ki(O,B,D);if(Q)return Q;let ee=O.match(Jf)?.[1];if(!ee)return null;let he=O.indexOf("=");return{name:ee,value:`${D.has(ee)?D.get(ee):B.get(ee)??""}${O.slice(he+1)}`}}function Ll(O){return O===Wl||O===Gl||cl(O)}function dx(O){return new Map([...O.effectiveEnvAssignments??[],...O.shellAssignments])}function fx(O,D){let B=[Wl,Gl].map((Q)=>{let ee=O.get(Q);return ee===void 0?null:[Q,ee]}).filter((Q)=>Q!==null);if(B.length===0)return D;return new Map([...B,...D??[]])}function zl(O,D){let B=new Map(O.effectiveEnvAssignments??[]);B.set(D.name,D.value),O.effectiveEnvAssignments=B}function mx(O,D){zl(O,{name:D,value:O.shellAssignments.get(D)??O.effectiveEnvAssignments?.get(D)??O.env.get(D)??""})}function px(O,D){if(!Ll(D)&&!Qf.test(D))return;if(O.shellAssignments.set(D,""),Vi(D)&&O.env.has(D)){let Q=new Map(O.env);Q.delete(D),O.env=Q}if(!Ll(D)||D===Wl||D===Gl||mo(D)){zl(O,{name:D,value:""});return}if(!O.effectiveEnvAssignments?.has(D))return;let B=new Map(O.effectiveEnvAssignments);B.delete(D),O.effectiveEnvAssignments=B.size===0?void 0:B}function gx(O,D){let B=D+1;while(B<O.length){let Q=O[B];if(!Q)return null;if(Q==="--")return B+1;if(Q==="-v"){B++;continue}if(Q.startsWith("-"))return null;return B}return B}import{resolve as hx}from"node:path";function hs(O,D){return ll.some((B)=>D?.has(B)||O.has(B))}function Qr(O,D,B){if(!D)return{gitCwd:null,hasExplicitGitContext:!1};let Q=B.realpath(hx(D));if(Q===null||!B.isDirectory(Q))return{gitCwd:null,hasExplicitGitContext:!1};let ee=Q,he=!1,je=1;while(je<O.length){let at=O[je];if(!at)break;if(at==="--")break;if(!at.startsWith("-"))break;if(at==="-C"){let lt=O[je+1];if(!lt)return{gitCwd:null,hasExplicitGitContext:he};let ct=cm(ee,lt,B);if(!ct)return{gitCwd:null,hasExplicitGitContext:he};ee=ct,je+=2;continue}if(at.startsWith("-C")&&at.length>2){let lt=cm(ee,at.slice(2),B);if(!lt)return{gitCwd:null,hasExplicitGitContext:he};ee=lt,je++;continue}if(at==="--git-dir"||at==="--work-tree"){he=!0,je+=2;continue}if(at.startsWith("--git-dir=")||at.startsWith("--work-tree=")){he=!0,je++;continue}je+=gn.has(at)?2:1}return{gitCwd:ee,hasExplicitGitContext:he}}function cm(O,D,B){try{let Q=nr(O,D,B);return B.isDirectory(Q)?Q:null}catch{return null}}function um(O,D,B){if(!D.localDiscard||!B.worktreeMode||hs(B.environment.env,B.envAssignments))return null;let Q=Qr(O,B.cwd,B.environment.paths);if(!Q.gitCwd||Q.hasExplicitGitContext)return null;let ee=B.environment.worktreeFacts(Q.gitCwd);if(!ee)return null;if(Bl(O,B,ee))return null;return{kind:"worktree",originalReason:D.reason,gitCwd:Q.gitCwd}}function Bl(O,D,B){let{subcommand:Q,rest:ee}=Sn(O),he=Q?.toLowerCase();if(D.dynamicArguments||yx(ee)||Ex(O,D.environment.env,D.envAssignments,B)||Cx(ee)||bx(he,ee))return!0;return he==="clean"&&vx(ee)>1}function yx(O){return O.some((D)=>/[$*?[]/.test(D))}function bx(O,D){if(O==="checkout"){let{before:B}=en(D),Q=an(B,{shortOptsWithValue:Dl}),ee=B.some((je)=>It(je,"--force"))||Q.has("-f"),he=Q.has("-B")||B.some((je)=>je==="-B"||je.startsWith("-B"));return ee&&he}if(O==="switch"){let{before:B}=en(D),Q=an(B,{shortOptsWithValue:Nl}),ee=B.some((je)=>It(je,"--force"))||B.some((je)=>It(je,"--discard-changes"))||Q.has("-f"),he=B.some((je)=>je==="-C"||je.startsWith("-C")||Sx(je))||Q.has("-C");return ee&&he}return!1}function Sx(O){let D=O.split("=",1)[0]??O;return D==="--force-create"||D.length>=9&&"--force-create".startsWith(D)}function Cx(O){return O.some((D)=>D.startsWith("--recurse-sub"))}function vx(O){let D=0;for(let B of O){if(B==="--force"){D++;continue}if(B.startsWith("-")&&!B.startsWith("--")){for(let Q of B.slice(1))if(Q==="f")D++}}return D}function Ex(O,D,B,Q){if(jn("GIT_CONFIG_PARAMETERS",D,B)!==void 0)return!0;let ee=gs(O,D,B);if(ee.blockedReason!==null)return!0;let he=ee.entries.map((at)=>({key:at.key.toLowerCase(),value:at.value}));if(he.some((at)=>Rx(at.key)))return!0;let je=he.filter((at)=>at.key==="submodule.recurse").at(-1);if(je)return je.value===void 0||xx(je.value);if(Hd(B))return!0;return Q.recursiveSubmodules}function xx(O){let D=O.toLowerCase();return D!=="false"&&D!=="no"&&D!=="off"&&D!=="0"}function Rx(O){return O==="include.path"||O.startsWith("includeif.")&&O.endsWith(".path")}function fm(O,D,B){let Q=O.map(t),ee=B.environment.paths,he=Qr(Q,B.cwd,ee),je=B.originalCwd?ee.realpath(Px(B.originalCwd)):null;if(D.id.startsWith("git.push-")||je===null||he.gitCwd===null||he.hasExplicitGitContext||hs(B.environment.env,B.envAssignments))return null;let at=D.id==="git.worktree-remove-force"?Tx(O,B.shellAssignments,ee):mm(he.gitCwd,ee);if(at===null||D.id!=="git.worktree-remove-force"&&!Ax(at,Q,D,B)||!Zr(at,B.environment)||is(at,B.environment)||ss(je,at)||ss(at,je))return null;return{kind:"temp-root",originalReason:D.reason,gitCwd:he.gitCwd}}function Ax(O,D,B,Q){let ee=Q.environment.paths,he=dm(O,".git");if(ee.entryKind(he)!=="present")return!1;if(ee.isDirectory(he))return!0;let je=B.localDiscard?Q.environment.worktreeFacts(O):null;return je!==null&&!Bl(D,Q,je)}function Tx(O,D,B){let Q=Sn(O.map(t)).rest,{before:ee,after:he}=en(Q.slice(Q.indexOf("remove")+1)),je=[...ee.filter((ut)=>!ut.startsWith("-")),...he],at=je.length===1?je[0]??"":"",lt=O.find((ut)=>ut.text===at),ct=lt?.provenance==="variable"&&lt.parts.every((ut)=>ut.provenance!=="literal"||!/[$`]/.test(ut.raw))?qo(at,D??new Map):at;if(!wx(ct)||/[\s$`*?[]/.test(ct)||B.entryKind(ct)!=="present"||!B.isDirectory(ct))return null;return B.realpath(ct)}function mm(O,D){if(D.entryKind(dm(O,".git"))!=="missing")return O;let B=_x(O);return B===O?null:mm(B,D)}var kx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Ox=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function ys(O,D){return pm(O,D)}function pm(O,D,B){let Q=O.map(t),ee=Kf(Q,D.environment.env,D.envAssignments),he=ee.blockedReason?wt(St("git.alias-config",ee.blockedReason),D.policy):null;if(he)return he;let je=ee.tokens;if((Ud(D.envAssignments)||qf(Q,D.environment.env,D.envAssignments))&&Mx(je))return St("git.ssh-env",kx);let at=Zf(je,(ct)=>{let ut=Qr(Q,D.cwd,D.environment.paths).gitCwd;return ut!==null&&D.environment.paths.entryKind(Ix(ut,ct))!=="missing"});if(!at)return null;if(ee.expanded||ee.blockedReason)return at;let lt=um(Q,at,D)??fm(O,at,D);if(!lt)return at;return B?.(lt),null}function gm(O,D){let B=null;return{match:pm(O,D,(ee)=>{B=ee}),relaxation:B}}function Mx(O){let{subcommand:D,rest:B}=Sn(O),Q=D?.toLowerCase();if(!Q)return!1;if(Ox.has(Q))return!0;if(Q==="archive")return en(B).before.some((ee)=>It(ee,"--remote"));return Q==="remote"&&Dx(B)}function Dx(O){return O.find((D)=>!Nx(D))?.toLowerCase()==="update"}function Nx(O){return O==="-v"||It(O,"--verbose")||It(O,"--no-verbose")}import{isAbsolute as hR}from"node:path";function hm(O,D,B,Q){let ee=O.slice(0,D),he=O.slice(D+B);return Q.startsWith(ee)&&Q.endsWith(he)?Q.slice(ee.length,Q.length-he.length):null}function bs(O,D,B){let Q=(he)=>`${he.tokenIndex}\x00${he.kind}\x00${he.value}`,ee=new Set(O.map(Q));return Array.from(D).some((he)=>B(he).some((je)=>!ee.has(Q(je))))}var ym="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Lx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Wx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Sm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Gx="rm -rf in home directory is dangerous. Change to a project directory first.",bm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Sm},git_metadata_target:{id:"rm.git-metadata",reason:x},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Wx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Gx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:ym},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Lx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:ym}};function Ss(O,D){let B=_r({...D,allowPaths:D.policy?.destructiveCommandAllowPaths,posixShell:!0}),Q=O.map(t),ee=Dn(Q),he=Hf(Q),je=zx(O);for(let at of je){let lt=$o(at.word);if(ee&&lt.unsafeBraceExpansion){let ct=wt(Bo({kind:"outside_anchored_cwd"},B,D.policy,bm),D.policy);if(ct)return ct;continue}for(let ct of lt.expandedTargets??[at.text]){let ut=pn(ct),ft={targetIsLiteral:lt.expandedTargets!==void 0||lt.targetIsLiteral,tmpdirWordSplittingProtected:lt.tmpdirWordSplittingProtected};if(!he&&B.resolvedCwd&&Er(ut,B.resolvedCwd,B.protectedGitMetadata,he,B.environment,B.budget))return St("rm.git-metadata",x);if(he&&!ee){let dt=On(ut,B,ft);if(dt.kind==="root_or_home_target")return St("rm.recursive-force-root-or-home",Sm);if(dt.kind==="git_metadata_target")return St("rm.git-metadata",x);continue}if(!ee)continue;for(let dt of Fx(ut,B,ft)){let mt=Bo(dt,B,D.policy,bm),pt=wt(mt,D.policy);if(pt)return pt}}}return null}function Fx(O,D,B){let Q=On(O,D,B);if(Q.kind==="cwd_self_target")return[Q,On(O,D,{...B,skipCwdSelf:!0})];if(Q.kind!=="home_cwd_target")return[Q];let ee=On(O,D,{...B,skipHomeCwd:!0});if(ee.kind!=="cwd_self_target")return[Q,ee];return[Q,ee,On(O,D,{...B,skipHomeCwd:!0,skipCwdSelf:!0})]}function zx(O){let D=[],B=!1;for(let Q of O.slice(1)){let ee=t(Q);if(!ee)continue;if(ee==="--"){B=!0;continue}if(B){D.push({text:ee,word:Q});continue}if(!ee.startsWith("-"))D.push({text:ee,word:Q})}return D}var lr={kind:"none"},Tr={kind:"dynamic"},Bx=new Set(["<","<<","<<-","<<<","<&","<>"]),vm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,$x=/^(?:[0-9]+|[@*])$/,Ux=tr.maxWords,Hx=tr.maxInputLength;function Em(O){if(!O||Tt(kt(O.words[0]?.text??""))!=="printf")return;if(O.words.some((ee)=>ee.provenance!=="literal"))return;let D=O.words.slice(O.words[1]?.text==="--"?2:1),B=D[0]?.text;if(B===void 0)return"";let Q=D.slice(1).map((ee)=>ee.text);if(B==="%s")return Q.join("");if(B==="%s\\n"||B===`%s
+`||O===";"||O==="&"||O==="|"}function jr(O){return O==="|"||O===";"}function $i(O,D,B){let Q=tl(O,B);if(D==="rm")return Kb(Q);if(D==="dd")return Yb(Q);return Od(Q,!0)}function Ui(O,D,B){let Q=tl(O,B);if(D==="rm")return Zb(Q);if(D==="reset-hard")return Id(Q,"--ha","rd");if(D==="reset-merge")return Id(Q,"--me","rge");if(D==="clean")return eS(Q);if(D==="checkout")return nS(Q);if(D==="push-force")return rS(Q);if(D==="push-refspec")return oS(Q);if(D==="push-delete")return iS(Q);if(D==="branch")return sS(Q);if(D==="tag")return cS(Q);if(D==="restore")return uS(Q);return Od(Q,!1)}function Kb(O){let D=!1,B=!1,Q=!1,ee=-1;for(let he=0;he<=Ht(O);he++){let je=bt(O,he);if(!D){let lt=bt(O,he+2);if(Un(O,he,"rm")&&zt(lt)&&lt!==`
+`)D=!0,he++;continue}let at=qb(O,he);if(je===`
+`||at!==-1){if(D=!1,B=!1,Q=!1,ee=-1,at!==-1)he=at-1;continue}if(je===";"||je==="&"||je==="|"||he===Ht(O)){if(ee>=0){let lt=Pd(O,ee,he);B||=lt.recursive,Q||=lt.force}if(B&&Q)return!0;D=!1,B=!1,Q=!1,ee=-1;continue}if(zt(je)){if(ee<0)continue;if(Bt(O,ee,"--")&&he-ee===2){D=!1,B=!1,Q=!1,ee=-1;continue}let lt=Pd(O,ee,he);if(B||=lt.recursive,Q||=lt.force,B&&Q)return!0;ee=-1;continue}if(ee<0)ee=he}return!1}function qb(O,D){if(bt(O,D)!=="\\"||bt(O,D-1)==="\\")return-1;if(Bt(O,D,String.raw`\n`))return D+2;if(Bt(O,D,String.raw`\x0a`)||Bt(O,D,String.raw`\x0A`))return D+5;if(Bt(O,D,String.raw`\u000a`)||Bt(O,D,String.raw`\u000A`))return D+7;return Bt(O,D,String.raw`\012`)?D+4:-1}function Pd(O,D,B){if(Ad(O,D,B,"recursive"))return{recursive:!0,force:!1};if(Ad(O,D,B,"force"))return{recursive:!1,force:!0};if(bt(O,D)!=="-"||bt(O,D+1)==="-")return{recursive:!1,force:!1};let Q=!1,ee=!1;for(let he=D+1;he<B;he++){let je=bt(O,he);Q||=je==="r"||je==="R",ee||=je==="f"||je==="F"}return{recursive:Q,force:ee}}function Ad(O,D,B,Q){let ee=B-D-2;if(ee<1||ee>Q.length||!Bt(O,D,"--"))return!1;for(let he=0;he<ee;he++)if(bt(O,D+he+2)!==Q[he])return!1;return!0}function Yb(O){let D=!1;for(let B=0;B<Ht(O);B++){if(Qt(bt(O,B))){D=!1;continue}if(Un(O,B,"dd")){D=!0,B++;continue}if(!D||!Un(O,B,"of")||!Bt(O,B,"of=/dev/"))continue;let Q=B+8;if(Q<Ht(O)&&!zt(bt(O,Q))&&bt(O,Q)!=="'"&&bt(O,Q)!=='"')return!0}return!1}function Zb(O){let D=!1,B=!1,Q=!1;for(let ee=0;ee<=Ht(O);){let he=bt(O,ee);if(ee===Ht(O)||Qt(he)){D=!1,B=!1,Q=!1,ee++;continue}let je=Jb(O,ee);if(je>=0){if(Xb(O,je))return!0;let at=je,lt=!1;while(zt(bt(O,at)))lt||=bt(O,at)===`
+`,at++;if(lt)B=!1,Q=!1;D=!0,ee=at;continue}if(!D){ee++;continue}if(Bt(O,ee,"--")&&(ee===0||zt(bt(O,ee-1)))&&(!bt(O,ee+2)||zt(bt(O,ee+2))||Qt(bt(O,ee+2)))){D=!1,B=!1,Q=!1,ee+=2;continue}if(B||=Bt(O,ee,"--recursive")&&Hn(O,ee+11)||rl(O,ee,"recursive"),Q||=Bt(O,ee,"--force")&&Hn(O,ee+7)||rl(O,ee,"force"),B&&Q)return!0;ee++}return!1}function rl(O,D,B){if(!Bt(O,D,"--"))return!1;let Q=0;while(Q<=B.length){let ee=bt(O,D+Q+2);if(!ee||zt(ee)||Qt(ee))break;if(ee!==B[Q])return!1;Q++}return Q>0&&Hn(O,D+Q+2)}function Xb(O,D){let B=D,Q=!1,ee=!1;while(B<Ht(O)){while(zt(bt(O,B)))B++;let he=B;while(B<Ht(O)&&!zt(bt(O,B)))B++;if(bt(O,he)!=="-"||B-he===2&&Bt(O,he,"--"))return!1;let je=Td(O,he,"recursive"),at=Td(O,he,"force");if(Q&&at||ee&&je)return!0;if(Q||=je,ee||=at,bt(O,he+1)==="-")continue;let lt=Qb(O,he,B);if(lt.combined||Q&&lt.forceAtBoundary||ee&&lt.recursiveAtBoundary)return!0;Q||=lt.recursive,ee||=lt.force}return!1}function Td(O,D,B){return Bt(O,D,`--${B}`)&&Hn(O,D+B.length+2)||rl(O,D,B)}function Jb(O,D){if(D>0&&br(bt(O,D-1)))return-1;let B=D;if(bt(O,B)==="\\")B++;if(bt(O,B)!=="r")return-1;if(B++,bt(O,B)==="\\")B++;if(bt(O,B)!=="m"||!zt(bt(O,B+1)))return-1;return B+1}function Qb(O,D,B){let Q=!1,ee=!1,he=!1,je=!1,at=!1;if(bt(O,D)!=="-")return{recursive:Q,force:ee,recursiveAtBoundary:he,forceAtBoundary:je,combined:at};let lt="";for(let ct=D+1;ct<B;ct++){let ut=bt(O,ct)??"",ft=(ut==="r"||ut==="f")&&Hn(O,ct+1);Q||=ut==="r",ee||=ut==="f",he||=ut==="r"&&ft,je||=ut==="f"&&ft,at||=(lt==="r"&&ut==="f"||lt==="f"&&ut==="r")&&ft,lt=ut}return{recursive:Q,force:ee,recursiveAtBoundary:he,forceAtBoundary:je,combined:at}}function Id(O,D,B){return To(O,"reset",jr,!0,(Q)=>bt(O,Q)==="-"&&Vr(O,Q,D,B)?!0:Q)}function eS(O){return To(O,"clean",jr,!0,(D)=>{if(bt(O,D)!=="-")return D;if(Vr(O,D,"--fo","rce"))return!0;let B=Ao(O,D,jr);for(let Q=D+1;Q<B;Q++)if(bt(O,Q)==="f")return!0;return B-1})}function Hi(O,D,B){if(!Un(O,D,"git"))return null;let Q=D+3;if(!zt(bt(O,Q)))return{commandEnd:-1,next:Q};while(zt(bt(O,Q)))Q++;while(Q<Ht(O)){if(Qt(bt(O,Q)))return{commandEnd:-1,next:Q};let ee=Ao(O,Q,Qt);if(Un(O,Q,B))return{commandEnd:Q+B.length,next:ee};if(bt(O,Q)!=="-")return{commandEnd:-1,next:ee};let he=ee-Q===2&&Bt(O,Q,"--"),je=tS(O,Q,ee);Q=ee;while(zt(bt(O,Q)))Q++;if(he)return{commandEnd:Un(O,Q,B)?Q+B.length:-1,next:Ao(O,Q,Qt)};if(!je)continue;if(Q>=Ht(O)||Qt(bt(O,Q)))return{commandEnd:-1,next:Q};Q=Ao(O,Q,Qt);while(zt(bt(O,Q)))Q++}return{commandEnd:-1,next:Q}}function tS(O,D,B){for(let Q of gn)if(B-D===Q.length&&Bt(O,D,Q))return!0;return!1}function nS(O){return kd(O,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function rS(O){return To(O,"push",jr,!0,(D)=>{if(bt(O,D)!=="-")return D;if(bt(O,D+1)==="f"&&!br(bt(O,D+2))&&!Bt(O,D+2,"-with-lease"))return!0;let B=Md(O,D,"--fo","rce");if(B>=0&&!Bt(O,B,"-with-lease"))return!0;return D})}function oS(O){return To(O,"push",Qt,!1,(D)=>{if(zt(bt(O,D))&&bt(O,D+1)==="+"&&D+2<Ht(O)&&!Qt(bt(O,D+2))&&!zt(bt(O,D+2)))return!0;if(bt(O,D)===":"&&bt(O,D+1)==="+")return!0;return D})}function iS(O){return To(O,"push",Qt,!1,(D)=>{if(bt(O,D)==="-"&&Vr(O,D,"--de","lete"))return!0;if(zt(bt(O,D))&&bt(O,D+1)===":"&&D+2<Ht(O)&&!zt(bt(O,D+2))&&!Qt(bt(O,D+2)))return!0;return D})}function sS(O){let D=!1,B=!1,Q=!1;for(let ee=0;ee<=Ht(O);ee++){if(ee===Ht(O)||Qt(bt(O,ee))){if(B&&Q)return!0;D=!1,B=!1,Q=!1;continue}if(!D){let at=Hi(O,ee,"branch");if(at){D=at.commandEnd>=0,ee=Math.max(ee,(D?at.commandEnd:at.next)-1);continue}}if(!D||bt(O,ee)!=="-")continue;let he=Ao(O,ee,Qt),je=aS(O,ee,he);if(B||=je.deletion,Q||=je.force,B&&Q)return!0;ee=he-1}return!1}function aS(O,D,B){let Q=!1,ee=!1;for(let he=D;he<B;he++){if(bt(O,he)!=="-")continue;if(Vr(O,he,"--de","lete"))Q=!0;if(Vr(O,he,"--fo","rce"))ee=!0;if(bt(O,he+1)==="-")continue;let je=he+1,at=!1,lt=!1,ct=!1;while(je<B&&lS(bt(O,je))){let ut=bt(O,je);at||=ut==="d"||ut==="D",lt||=ut==="f",ct||=ut==="D",je++}if(!Hn(O,je))continue;Q||=at,ee||=lt||ct}return{deletion:Q,force:ee}}function lS(O){if(!O)return!1;let D=O.charCodeAt(0);return D>=65&&D<=90||D>=97&&D<=122}function cS(O){return kd(O,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function kd(O,D){let B=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let Q=0;Q<Ht(O);Q++){let ee=bt(O,Q),he=B[B.length-1];if(!he)return!1;let je=he.escaped;if(he.escaped=!je&&he.quote!=="'"&&ee==="\\",!je&&ee==="'"&&he.quote!=='"')he.quote=he.quote==="'"?"":"'";if(!je&&ee==='"'&&he.quote!=="'")he.quote=he.quote==='"'?"":'"';if(ee==="$"&&bt(O,Q+1)==="("&&(B.length===1||!je&&he.quote!=="'")){B.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),Q++;continue}if(!je&&!he.quote&&B.length>1&&ee==="("){he.depth++;continue}if(!je&&!he.quote&&B.length>1&&ee===")"){if(he.depth--,he.depth===0)B.pop();continue}if(zt(ee))he.shortActive=!1,he.hasShortFlag=!1;if(!he.outerActive){let at=Hi(O,Q,D.command);if(at){he.outerActive=at.commandEnd>=0&&zt(bt(O,at.commandEnd)),he.shortActive=!1,he.hasShortFlag=!1,Q=Math.max(Q,(he.outerActive?at.commandEnd:at.next)-1);continue}}if(he.outerActive&&ee==="-"){if(Vr(O,Q,D.longPrefix,D.longOptional))return!0;he.shortActive||=!D.excludedShortStarts.includes(bt(O,Q+1)??"")}if(he.hasShortFlag||=he.shortActive&&ee===D.shortFlag,he.hasShortFlag&&Hn(O,Q+1))return!0;if(jr(ee))he.outerActive=!1}return!1}function To(O,D,B,Q,ee){let he=!1;for(let je=0;je<Ht(O);je++){let at=bt(O,je),lt=B(at);if(!he&&!lt){let ct=Hi(O,je,D);if(ct){he=ct.commandEnd>=0&&(!Q||zt(bt(O,ct.commandEnd))),je=Math.max(je,(he?ct.commandEnd:ct.next)-1);continue}}if(he){let ct=ee(je);if(ct===!0)return!0;for(let ut=je;ut<=ct;ut++)if(B(bt(O,ut)))he=!1;je=ct}if(lt)he=!1}return!1}function uS(O){let D=!1;for(let B=0;B<Ht(O);B++){if(nl(bt(O,B))){if(D)return!0;D=!1;continue}if(!D){let Q=Hi(O,B,"restore");if(Q){D=Q.commandEnd>=0,B=Math.max(B,(D?Q.commandEnd:Q.next)-1);continue}}if(D&&bt(O,B)==="-"&&bt(O,B+1)==="-"&&(Bt(O,B+2,"staged")||Bt(O,B+2,"help")))D=!1}return D}function Od(O,D){let B=!1;for(let Q=0;Q<Ht(O);Q++){let ee=bt(O,Q),he=D?nl(ee):Qt(ee);if(B&&zt(ee)&&bt(O,Q+1)==="-"&&Un(O,Q+2,"delete"))return!0;if(he){B=!1;continue}if(Un(O,Q,"find"))B=!0,Q+=3}return!1}function Ao(O,D,B){let Q=D;while(Q<Ht(O)&&!zt(bt(O,Q))&&!B(bt(O,Q)))Q++;return Q}function Md(O,D,B,Q){if(!Bt(O,D,B))return-1;let ee=D+B.length;for(let he=0;he<Q.length&&bt(O,ee)===Q[he];he++)ee++;return Hn(O,ee)?ee:-1}function Vr(O,D,B,Q){return Md(O,D,B,Q)>=0}function xn(O,D){Po(D,O,2);let B=O.toLowerCase(),Q=B.trimStart(),ee=Q.startsWith("echo ")||Q.startsWith("rg "),he=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let je of he){if(je.skipForEchoRg&&ee)continue;let at=je.caseSensitive?O:B;if(je.regex)bn(D,at);if((je.regex?.test(at)??!1)||je.scan&&Ui(at,je.scan,D))return St("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${je.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var dS=/^[A-Za-z_][A-Za-z0-9_]*=/;function Nd(O,D,B){let Q=O.words[0];if(!D||!Q||O.words.length!==1||O.dialect!=="posix")return!1;if(!Q.quoted||Q.provenance!=="literal")return!1;let ee=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(Q.text)?.[1];if(!ee)return!1;Po(B,D.source,2);let he={anchored:new RegExp(`^\\$\\{?${ee}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${ee}(?![A-Za-z0-9_])`)};return Ld(D.nodes,Q,he)}function Ld(O,D,B){return O.every((Q)=>{if(Q.kind==="connector")return!0;if(Q.kind==="group"||Q.kind==="function")return Ld(Q.body.nodes,D,B);if(Q.kind==="unknown")return!B.loose.test(Q.source);return fS(Q,D,B)})}function fS(O,D,B){if(O.nested.some((ee)=>B.loose.test(ee.source)))return!1;let Q=O.words.findIndex((ee)=>!dS.test(ee.text));return O.words.every((ee,he)=>ee===D||Dd(ee.raw,B.anchored,he!==Q))&&O.redirections.every((ee)=>(!ee.heredoc||ee.heredoc.quotedDelimiter||!B.loose.test(ee.heredoc.body))&&(!ee.target||Dd(ee.target.raw,B.anchored,!0)))}function Dd(O,D,B){let Q=!1,ee=!1;for(let he=0;he<O.length;he++){let je=O[he];if(je==="\\"&&!Q){he++;continue}if(!ee&&je==="'"){Q=!Q;continue}if(!Q&&je==='"'){ee=!ee;continue}if(Q||je!=="$")continue;if(!D.test(O.slice(he)))continue;if(!ee||!B)return!1}return!0}import{isAbsolute as mS,resolve as Wd}from"node:path";function Io(O,D,B,Q){let ee=mS(O)?Wd(O):D?Wd(D,O):void 0;if(!ee)return;try{return Wt(ee,B,Q)}catch{return ee}}function Gd(O){return!["/dev","/proc","/sys"].some((D)=>O===D||O.startsWith(`${D}/`))}var Kr="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",ko="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",il=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),pS=new Set(["-p","--print"]),gS=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),hS=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),yS=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),bS=new Map([["python",new Set(["m"])]]),SS=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),CS=new Set(["always","default","never"]),vS=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),ES=/\\\r?\n/g,xS=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Fd(O){return Vi(O).code}function ji(O){return Vi(O).sources}function zd(O){return xS.get(al(O))??[]}function Vi(O){let D=al(O[0]??"");if(!il.has(D))return{code:null,sources:[],optionsOpen:!1};let B=[],Q=[],ee=!0;for(let he=1;he<O.length;he++){let je=O[he];if(je===void 0)break;if(je==="--")return Tn(D,B,Q,ee,O[he+1]===void 0?void 0:he+1,O[he+1]);if(je===""||je==="-"||!je.startsWith("-"))return Tn(D,B,Q,ee,he,je);if(D==="node"&&pS.has(je)){let ft=O[he+1];if(ft===void 0)return Tn(D,B,Q,ee);if(ft.startsWith("-"))continue;B.push({tokenIndex:he+1,value:ft}),Q.push({tokenIndex:he+1,kind:"inline-code",value:ft}),he++;continue}if(_S(D,je)){let ft=O[he+1];if(ft===void 0)return Tn(D,B,Q,ee);if(B.push({tokenIndex:he+1,value:ft}),Q.push({tokenIndex:he+1,kind:"inline-code",value:ft}),D==="python")return Tn(D,B,Q,ee);he++;continue}let at=/^--eval=(.*)$/s.exec(je);if(wS(D)&&at){let ft=at[1]??"";B.push({tokenIndex:he,value:ft}),Q.push({tokenIndex:he,kind:"inline-code",value:ft});continue}if(D==="node"){let ft=RS(je);if(ft){if(ft.attached){if(ee&&=ft.value!=="",ft.value!=="")Q.push({tokenIndex:he,kind:"module-file",value:ft.value});continue}let dt=O[he+1];if(dt===void 0||dt.startsWith("-"))return ee=!1,Tn(D,B,Q,ee);Q.push({tokenIndex:he+1,kind:"module-file",value:dt}),he++;continue}}if(D==="python"&&je.startsWith("--check-hash-based-pycs=")||D==="node"&&(je==="--conditions="||je==="--diagnostic-dir="||je==="--title=")||D==="ruby"&&(je==="--disable="||je==="--enable="))return Tn(D,B,Q,ee);if(SS.get(D)?.has(je)){let ft=O[he+1];if(ft===void 0||ft.startsWith("-")&&!(D==="ruby"&&vS.has(je))||D==="python"&&!CS.has(ft))return Tn(D,B,Q,ee);he++;continue}if(je.startsWith("--"))continue;let lt,ct=!1;for(let ft=1;ft<je.length;ft++){let dt=je[ft];if(dt===void 0)break;if(bS.get(D)?.has(dt)){let mt=je.slice(ft+1),pt=mt||O[he+1];if(pt!==void 0)Q.push({tokenIndex:mt?he:he+1,kind:"module-file",value:pt});return Tn(D,B,Q,ee)}if(gS.get(D)?.has(dt)){lt=je.slice(ft+1)||O[he+1],ct=ft+1===je.length;break}if(D==="node"&&dt==="r"){if(ee&&=je==="-r",je==="-r"){let mt=O[he+1];if(ee&&=mt!==void 0&&!mt.startsWith("-"),ee&&mt!==void 0)Q.push({tokenIndex:he+1,kind:"module-file",value:mt});he++}break}if(D==="ruby"&&dt==="r"){let mt=je.slice(ft+1),pt=mt||O[he+1];if(ee&&=pt!==void 0,pt!==void 0)Q.push({tokenIndex:mt?he:he+1,kind:"module-file",value:pt});if(!mt)he++;break}if(D==="perl"&&(dt==="M"||dt==="m")){let mt=je.slice(ft+1);if(!mt){if(ee=!1,ft+1===je.length)he++;break}Q.push({tokenIndex:he,kind:"module-file",value:mt});break}if(hS.get(D)?.has(dt)){if(ft+1===je.length)he++;break}if(yS.get(D)?.has(dt)&&ft+1<je.length)break}if(lt===void 0)continue;let ut=ct?he+1:he;if(B.push({tokenIndex:ut,value:lt}),Q.push({tokenIndex:ut,kind:"inline-code",value:lt}),D==="python")return Tn(D,B,Q,ee);if(ct)he++}return Tn(D,B,Q,ee,void 0,void 0,!0)}function Tn(O,D,B,Q,ee,he,je=!1){let at=O==="node"?D.slice(-1):D,lt=new Set(at.map((ut)=>ut.tokenIndex)),ct=B.filter((ut)=>ut.kind!=="inline-code"||lt.has(ut.tokenIndex));if(Q&&D.length===0&&ee!==void 0&&he!==void 0)ct.push({tokenIndex:ee,kind:"main-script",value:he});return{code:(O==="node"?at[0]?.value:at.map((ut)=>ut.value).join(`
+`))||null,sources:Q?ct:[],optionsOpen:Q&&je}}function RS(O){for(let D of["--import","--loader","--experimental-loader","--require"]){if(O===D)return{attached:!1,value:""};if(O.startsWith(`${D}=`))return{attached:!0,value:O.slice(D.length+1)}}return}function sl(O,D){return al(O)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(D)}function al(O){let D=Tt(O).toLowerCase();return yi.test(D)?"python":D}function _S(O,D){return il.get(O)?.has(D)??!1}function wS(O){return il.get(O)?.has("--eval")??!1}function Oo(O,D,B=!1){let Q=TS(O,D);if(!ol(Q,D))return!1;bn(D,Q);let ee=AS(Q);if(ol(ee,D))return!0;if(bn(D,ee),!Bd.test(ee))return!1;return!B||PS(Q,D)}function PS(O,D){if(/`|%x|\bqx\b/.test(O))return!0;let B=O.split(""),Q=[];for(let je=0;je<O.length;je++){let at=O[je];if(at!=="'"&&at!=='"')continue;let lt=O.startsWith(at.repeat(3),je)?at.repeat(3):at,ct=je+lt.length,ut=ct;while(ut<O.length&&!O.startsWith(lt,ut))ut+=O[ut]==="\\"?2:1;if(ut>=O.length)return!0;Q.push({start:ct,text:O.slice(ct,ut)}),B.fill(" ",je,ut+lt.length),je=ut+lt.length-1}let ee=B.join(""),he=Array.from(ee.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((je)=>Bd.test(je[1]??"")).map((je)=>{let at=je.index+je[0].length;return{start:at,end:ll(ee,at)}});if(he.some((je)=>cl(ee,je.start)))return!0;return Q.some((je)=>(/\b(?:system|exec|spawn|popen)\s*$/.test(ee.slice(0,je.start))||he.some((at)=>je.start>=at.start&&je.start<at.end))&&ol(je.text,D))}function ll(O,D){let B=1;for(let Q=D;Q<O.length;Q++){if(O[Q]==="(")B++;if(O[Q]===")")B--;if(B===0)return Q}return O.length}function cl(O,D){let B=0;for(let Q=D;Q<O.length;Q++){let ee=O[Q]??"";if("([{".includes(ee))B++;if(")]}".includes(ee)&&B--===0)return!1;if(ee===","&&B===0)return!1;if(/[A-Za-z_$]/.test(ee))return!0}return!1}var Bd=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function AS(O){let D=[],B=0,Q=0;while(Q<O.length){let ee=O[Q];if(ee!=="'"&&ee!=='"'){Q++;continue}let he=O.startsWith(ee.repeat(3),Q)?ee.repeat(3):ee,je=Q+he.length;while(je<O.length&&!O.startsWith(he,je))je+=O[je]==="\\"?2:1;if(je>=O.length)break;D.push(O.slice(B,Q)," "),Q=je+he.length,B=Q}return D.push(O.slice(B)),D.join("")}function ol(O,D){if($i(O,"rm",D))return!0;for(let Q of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(bn(D,O),Q.test(O))return!0;if($i(O,"dd",D))return!0;for(let Q of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(bn(D,O),Q.test(O))return!0;if($i(O,"find",D))return!0;let B=O.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((Q)=>(bn(D,O),B.some((ee)=>Ui(ee,Q))))}function TS(O,D){return bn(D,O),O.replace(ES,"")}import{isAbsolute as pf,relative as gf}from"node:path";import{isAbsolute as qd,parse as FS}from"node:path";import{dirname as IS,isAbsolute as kS,parse as OS,sep as MS}from"node:path";function nr(O,D,B){if(Qn(D))throw Error("Unsupported Windows namespace path");let Q=kS(D)?OS(D).root:"",ee=Q||O;for(let he of NS(Q?D.slice(Q.length):D)){if(he===""||he===".")continue;if(he===".."){ee=IS(ee);continue}let je=DS(ee,he),at=B.entryKind(je),lt=at==="symlink"?B.realpath(je):je;if(at==="missing"||lt===null)throw Error(`Cannot resolve path component: ${je}`);ee=lt}return ee}function DS(O,D){return O.endsWith("/")||O.endsWith("\\")?`${O}${D}`:`${O}${MS}${D}`}function NS(O){let D=process.platform==="win32"?/[\\/]+/:/\/+/;return O.split(D)}var ul=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],LS=new Set(ul),WS=1024,$d=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Ud=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),GS=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Ki(O){return LS.has(O)}function dl(O){return Ki(O)||$d.has(O)||Ud.has(O)||mo(O)}function jn(O,D,B){return B?.has(O)?B.get(O):D.get(O)}function Hd(O,D){let B=jn("GIT_CONFIG_COUNT",O,D);if(B===void 0)return{state:"absent"};if(B==="")return{state:"valid",count:0};if(!/^\d+$/.test(B))return{state:"invalid"};let Q=Number(B);return Number.isSafeInteger(Q)&&Q<=WS?{state:"valid",count:Q}:{state:"invalid"}}function qi(O,D,B){let ee=O.match(GS)?.[1];if(!ee||!dl(ee))return null;let he=O.indexOf("=");return{name:ee,value:`${jn(ee,D,B)??""}${O.slice(he+1)}`}}function jd(O){return Kd(O,Ud)}function Vd(O){return Kd(O,$d)}function Kd(O,D){if(!O)return!1;for(let B of O.keys())if(D.has(B))return!0;return!1}var Zd=/^[A-Za-z_][A-Za-z0-9_]*=/;function Rn(O){if(!Zd.test(O))return null;let D=O.indexOf("=");return{name:O.slice(0,D),value:O.slice(D+1)}}function ge(O){let D=new Map,B=0;while(B<O.length){let Q=O[B];if(!Q)break;let ee=Rn(t(Q));if(!ee)break;D.set(ee.name,ee.value),B++}return{words:O.slice(B),envAssignments:D}}function Xd(O){let D=O.toLowerCase();return O.includes("=")||D==="sudo"||D==="env"||D==="command"||D==="builtin"}function Sr(O,D,B,Q){if(!Xd(qr(O)))return{words:O,envAssignments:new Map,cwd:B,rewritten:!1};let ee=new Set(O),he=O,je=new Map,at=new Map(Q??[]),lt=[],ct=B;for(let ft=0;ft<a.wrapperPeelIterations.cap;ft++){let dt=Yd(he),mt=ge(he);for(let[gt,ht]of mt.envAssignments)je.set(gt,ht),at.set(gt,ht);if(he=mt.words,he.length===0)break;while(he.length>0&&qr(he).includes("=")&&!BS(he)){let gt=$S(qr(he),at,D.env)??qi(qr(he),D.env,at);if(gt)je.set(gt.name,gt.value),at.set(gt.name,gt.value);he=he.slice(1)}if(he.length===0)break;let pt=qr(he).toLowerCase();if(pt!=="sudo"&&pt!=="env"&&pt!=="command"&&pt!=="builtin")break;if(pt==="sudo"){let gt=HS(he,D.paths,ct);if(he=gt.words,gt.cwd!==void 0)ct=gt.cwd}if(pt==="env"){let gt=KS(he,ct,at,D);if(lt.push(...gt.envSplitValues??[]),he=gt.words,gt.cwd!==void 0)ct=gt.cwd;for(let[ht,yt]of gt.envAssignments)je.set(ht,yt),at.set(ht,yt)}if(pt==="command")he=qS(he);if(pt==="builtin")he=he.slice(In(he,1)==="--"?2:1);if(Yd(he)===dt)break}let ut=ge(he);for(let[ft,dt]of ut.envAssignments)je.set(ft,dt),at.set(ft,dt);return{words:ut.words,envAssignments:je,cwd:ct,envSplitValues:lt.length>0?lt:void 0,rewritten:zS(ut.words,ee)}}function zS(O,D){return O.some((B)=>!D.has(B))}function Yd(O){return O.map(t).join(" ")}function qr(O){let D=O[0];return D?t(D):""}function In(O,D){let B=O[D];return B?t(B):void 0}function BS(O){return Zd.test(qr(O))}function $S(O,D,B){if(!O.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${D.get("TMPDIR")??B.get("TMPDIR")??""}${O.slice(8)}`}}var US=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function HS(O,D,B){let Q=1,ee=B;while(Q<O.length){let he=In(O,Q);if(!he)break;if(he==="--")return{words:O.slice(Q+1),cwd:ee};if(!he.startsWith("-"))break;if(he==="-D"||he==="--chdir"){let je=In(O,Q+1);ee=je?Mo(ee,je,D):null,Q+=2;continue}if(he.startsWith("--chdir=")){ee=Mo(ee,he.slice(8),D),Q++;continue}if(he.startsWith("-D")&&he.length>2){ee=Mo(ee,he.slice(2),D),Q++;continue}if(he==="-i"||he==="--login"){ee=null,Q++;continue}if(US.has(he)){Q+=2;continue}Q++}return{words:O.slice(Q),cwd:ee}}var jS=new Set(["-i","-0","--null"]),VS=new Set(["-u","--unset","-C","--chdir","-P"]);function KS(O,D,B,Q){let ee=new Map,he=[],je=D,at=1,lt=(ct)=>({words:O.slice(ct),envAssignments:ee,cwd:je,envSplitValues:he.length>0?he:void 0});while(at<O.length){let ct=In(O,at);if(!ct)break;if(ct==="--")return lt(at+1);if(ct==="-i"||ct==="--ignore-environment"||ct==="-"){ee.clear();for(let ft of B.keys())ee.set(ft,"");ee.set("TMPDIR",""),at++;continue}if(jS.has(ct)){at++;continue}if(ct==="-u"||ct==="--unset"){let ft=In(O,at+1);if(ft!==void 0)ee.set(ft,"");at+=2;continue}if(ct.startsWith("-u")&&ct.length>2&&!ct.startsWith("-u=")){ee.set(ct.slice(2),""),at++;continue}if(ct.startsWith("--unset=")){ee.set(ct.slice(8),""),at++;continue}let ut=ct==="-S"||ct==="--split-string"?{value:In(O,at+1),consumed:2}:ct.startsWith("-S")&&ct.length>2?{value:ct.slice(2),consumed:1}:ct.startsWith("--split-string=")?{value:ct.slice(15),consumed:1}:null;if(ut){if(ut.value!==void 0)he.push(ut.value);return je=null,lt(at+ut.consumed)}if(VS.has(ct)){if(ct==="-C"||ct==="--chdir"){let ft=In(O,at+1);je=ft?Mo(je,ft,Q.paths):null}at+=2;continue}if(ct.startsWith("-u=")){at++;continue}if(ct.startsWith("-C")&&ct.length>2||ct.startsWith("--chdir=")){let ft=ct.startsWith("--chdir=")?ct.slice(8):ct.startsWith("-C=")?ct.slice(3):ct.slice(2);je=Mo(je,ft,Q.paths),at++;continue}if(ct.startsWith("-P")){at++;continue}if(ct.startsWith("-")){at++;continue}if(!Rn(ct))break;while(at<O.length){let ft=Rn(In(O,at)??"");if(!ft)break;ee.set(ft.name,ft.value),at++}if(In(O,at)==="--")at++;return lt(at)}return lt(at)}function Mo(O,D,B){if(D==="")return null;if(!O&&!qd(D))return null;let Q=qd(D)?FS(D).root:B.realpath(O??"/");if(Q===null)return null;try{return nr(Q,D,B)}catch{return null}}function qS(O){if(In(O,1)==="-v")return[...$t(["type"]),...O.slice(2)];let D=1;while(D<O.length){let B=In(O,D);if(!B)break;if(B==="-p"||B==="-v"||B==="-V"){D++;continue}if(B==="--")return O.slice(D+1);if(B.startsWith("-")&&!B.startsWith("--")&&B.length>1){if(!/^[pvV]+$/.test(B.slice(1)))break;D++;continue}break}return O.slice(D)}var YS=/['"\\$`{}#]/;function Yi(O,D){if(O.some((Q)=>YS.test(Q)))return null;let B=[...O.flatMap((Q)=>Q.split(/\s+/).filter((ee)=>ee.length>0)),...D];return B.length<=64?B:null}function rr(O,D,B){return Zi(O,D,B).tokens}function ZS(O){let D=[],B="",Q=0;while(Q<O.length){let ee=O.charAt(Q);if(ee==='"'||ee==="'"){let he=O.indexOf(ee,Q+1);if(he===-1)return O.split(/\s+/).map((je)=>je.replace(/["']/g,"")).filter((je)=>je.length>0);B+=O.slice(Q+1,he),Q=he+1;continue}if(/\s/.test(ee)){if(B.length>0)D.push(B);B="",Q++;continue}B+=ee,Q++}if(B.length>0)D.push(B);return D}function Cr(O,D,B,Q=0){let ee=Zi(O,D,B),he=(ee.envSplitValues??[]).flatMap(ZS);if(he.length===0)return ee.tokens;let je=[...he,...ee.tokens];if(Q>=8)return je;return Cr(je,D,B,Q+1)}function Zi(O,D,B,Q){if(!Xd(O[0]??""))return{tokens:[...O],envAssignments:new Map,cwd:B};let ee=Sr($t(O),D,B,Q);return{tokens:ee.words.map(t),envAssignments:ee.envAssignments,cwd:ee.cwd,envSplitValues:ee.envSplitValues}}var gl=Symbol("adopt-as-operand"),XS=new Set(["env","sudo","command","builtin"]),JS=new Set(["&&","||","|&","|","&",";"]),QS=new Set(["<<","<<<",">|"]),eC=new Set(["|","|&"]),tC=/[*@#?$!_-]/,nC=/^\w+(?::\w+)*/,rC=Object.freeze([]),Do=Object.freeze({kind:"scope",edge:"enter"}),No=Object.freeze({kind:"scope",edge:"exit"}),oC=Object.freeze([]),iC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Lo=new Set(["bash","sh","zsh","dash","ksh"]),sC=256,nf=new WeakMap;function rf(O,D){let B=D.status==="complete"?new Set(pl(D)):new Set,Q=cC(O,B);if(Si(Q))return Xi("unclosed-quote",Q,D);let ee={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},he=vr(D,{source:Q,suppressed:B,flags:ee,depth:0,functions:new Map,powershell:D.dialect==="powershell"});if(ee.limited)return Xi("structural-limit",Q,D);if(ee.invalid)return Xi("invalid",Q,D);let je=Xi("complete",Q,D,ee.assignmentFallbacks);return nf.set(je,Object.freeze(he)),je}function Qi(O,D,B,Q,ee){let he=ee.word??((ft)=>ft),je={cwd:D,variables:new Map,previous:null},at=[],lt=new Set,ct=null,ut=[];for(let ft of of(O)){if(ft.kind==="scope"){if(ft.edge==="enter"){ut.push({state:je,segment:[...at],shellWords:new Set(lt),pipeProducer:ct});continue}let dt=ee.segment(at,je,ct,null,lt);if(dt)return dt;let mt=ut.pop();if(mt===void 0)throw Error("scope exit without a matching enter");je=mt.state,at=mt.segment,lt=mt.shellWords,ct=mt.pipeProducer;continue}if(ft.kind==="operator"){if(!ft.boundary)continue;let dt=ee.segment(at,je,ct,ft.operator,lt);if(dt)return dt;je=aC(at,je,B,Q),ct=at.length>0&&eC.has(ft.operator)?at:null,at=[],lt=new Set;continue}if(ft.kind==="redirection"){if(ft.fd!==void 0)lt.add(at.length-1);if(ft.target===void 0)continue;let dt=ee.redirection({operator:ft.operator,role:ft.role,targetOrder:ft.targetOrder,target:ft.target,...ft.body===void 0?{}:{body:ft.body,consumer:ft.consumer}},je);if(dt===gl){lt.add(at.length),at.push(he(ft.target));continue}if(dt)return dt;continue}at.push(he(ft.text))}return ee.segment(at,je,ct,null,lt)}function es(O){return of(O).flatMap((D)=>{if(D.kind==="word")return[{kind:"word",text:D.text}];if(D.kind==="operator")return[{kind:"operator",boundary:D.boundary}];if(D.kind==="redirection")return[{kind:"redirection",target:D.target}];return[]})}function cn(O,D){return O.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(B,Q,ee,he)=>{let je=D.get(Q);if(je===void 0)return B;let at=ee.startsWith(":")?je!=="":!0;if(ee.endsWith("-"))return at?je:cn(he,D);return at?cn(he,D):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(B,Q)=>D.get(Q)??B).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(B,Q)=>D.get(Q)??B)}function Wo(O){return O.length>0&&O.every((D)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(D))}function aC(O,D,B,Q){let ee=Wo(O)?new Map([...D.variables,...lC(O,D.variables)]):D.variables,he=rr([...O],B),je=Tt(he[0]??"").toLowerCase()==="cd"?he[1]:void 0;if(!je)return{...D,variables:ee};if(je==="-"){if(D.previous===null)return{...D,variables:ee};return{cwd:D.previous,variables:ee,previous:D.cwd}}return{cwd:tn(cn(je,ee),D.cwd,B,Q),variables:ee,previous:D.cwd}}function lC(O,D){return O.flatMap((B)=>{let Q=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(B),ee=Q?.[2]?.startsWith("=")?Q[2].slice(1):void 0;return Q?.[1]!==void 0&&ee!==void 0?[[Q[1],cn(ee,D)]]:[]})}function of(O){return nf.get(O)??rC}function cC(O,D){return[...D].reduce((B,Q)=>B.slice(0,Q.start)+" ".repeat(Q.end-Q.start)+B.slice(Q.end),O)}function Xi(O,D,B,Q=oC){return Object.freeze({status:O,source:D,program:B,assignmentFallbacks:Object.freeze(Q)})}function vr(O,D){return O.nodes.flatMap((B,Q)=>uC(B,O,Q,D)).sort((B,Q)=>B.start-Q.start).flatMap((B)=>[...B.events])}function uC(O,D,B,Q){if(O.kind==="connector")return[{start:O.span.start,events:[kn(gC(O.operator))]}];if(O.kind==="unknown")return[{start:O.span.start,events:[kn(O.source)]}];if(O.kind==="function")return Q.functions.set(O.name,O.body),[];if(O.kind==="group"){let he=O.style!=="subshell",je=Q.source[O.span.end-1]===(he?"}":")"),at=he?Q:{...Q,functions:new Map(Q.functions)};return[{start:O.span.start,events:he?[Ji("{"),...vr(O.body,at),...je?[Ji("}")]:[]]:[Do,kn("("),...vr(O.body,at),...je?[kn(")")]:[],No]}]}let ee=SC(O,Q.functions);if(ee){if(Q.depth>=tr.maxDepth||++Q.flags.expansions>sC)return Q.flags.limited=!0,[];return[{start:O.span.start,events:[...Jd(O,Q),Ji(";"),...vr(ee,{...Q,depth:Q.depth+1}),Ji(";")]},...Qd(O,D,B,Q)]}return[{start:O.span.start,events:Jd(O,Q)},...Qd(O,D,B,Q)]}function Jd(O,D){return[...O.words.map((B)=>({start:B.span.start,events:af(B,O,D,!1)})),...O.redirections.map((B)=>({start:B.span.start,events:dC(B,O,D)}))].sort((B,Q)=>B.start-Q.start).flatMap((B)=>B.events)}function dC(O,D,B){let Q=O.operator==="<<-"?"<<":O.operator,ee=O.target?af(O.target,D,B,!0):[],he=ee[0],je=he?.kind==="word"?he.text:void 0;return[...O.fd===void 0?[]:[hl(String(O.fd))],Object.freeze({kind:"redirection",operator:Q,...O.fd===void 0?{}:{fd:O.fd},role:hC(Q),targetOrder:QS.has(Q)?"legacy-segment":"immediate",...je===void 0?{}:{target:je},...O.heredoc&&B.suppressed.has(O.heredoc.bodySpan)?{body:O.heredoc.body,consumer:cf(D)}:{}}),...je===void 0?ee:ee.slice(1)]}function Qd(O,D,B,Q){let ee=O.redirections.filter((he)=>he.operator==="<<"||he.operator==="<<-");return[...ee.flatMap((he)=>{let je=he.heredoc;if(!je)return[];let at=[hl(je.delimiter),.../[\r\n]/.test(Q.source[je.terminatorSpan.end]??"")?[kn(";")]:[]];if(Q.suppressed.has(je.bodySpan))return[{start:je.bodySpan.start,events:at}];return[{start:je.bodySpan.start,events:[...sf(Q.source.slice(je.bodySpan.start,je.bodySpan.end),Q),...at]}]}),...ee.some((he)=>!he.heredoc&&he.target)?fC(D,B,Q):[]]}function fC(O,D,B){let Q=O.nodes.slice(D+1).find((ee)=>ee.kind==="connector");if(!Q||Q.span.end>=O.span.end)return[];return[{start:Q.span.end,events:sf(B.source.slice(Q.span.end,O.span.end),B)}]}function sf(O,D){if(D.depth>=tr.maxDepth)return D.flags.limited=!0,[];let B=h(O,"posix");if(B.status==="limited")return D.flags.limited=!0,[];let Q={invalid:!1,limited:!1,expansions:D.flags.expansions,assignmentFallbacks:D.flags.assignmentFallbacks},ee=vr(B,{source:O,suppressed:new Set,flags:Q,depth:D.depth+1,functions:new Map,powershell:!1});return D.flags.limited||=Q.limited,D.flags.expansions=Q.expansions,ee}function af(O,D,B,Q){let ee=[],he={single:!1,double:!1},je="",at=!1,lt=()=>{let ct=at&&!Q?kn("glob"):je!==""||O.quoted&&ee.length===0?hl(je):void 0;if(ct)ee.push(ct);je="",at=!1};for(let ct of O.parts){if(ct.provenance!=="command-substitution"&&ct.provenance!=="arithmetic"){for(let mt of fl(ct.raw,he,B.flags,B.powershell)){if(typeof mt==="string"){lt(),ee.push(kn(mt));continue}je+=mt.text,at||=mt.glob}continue}let ut=D.nested.find((mt)=>mt.span.start>=ct.span.start&&mt.span.end<=ct.span.end);if(he.double){let mt=B.source.slice(ct.span.start,ct.span.end);je+=fl(mt,{single:!1,double:!0},B.flags,B.powershell).map((gt)=>typeof gt==="string"?gt:gt.text).join("");let pt=ut?vr(ut,B).filter((gt)=>gt.kind==="redirection"&&gt.body!==void 0):[];if(pt.length>0)ee.push(Do,...pt,No);continue}let ft=ut?vr(ut,B):[];if(ct.raw.startsWith("`")){je+="${}",lt(),ee.push(Do,...ft,No);continue}if(ct.raw.startsWith("<(")||ct.raw.startsWith(">(")){lt(),ee.push(ct.raw.startsWith("<(")?kn("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Do,...ft,...ct.raw.endsWith(")")?[kn(")")]:[],No);continue}let dt=ct.raw.startsWith("$((")?2:1;je+="${}",lt(),ee.push(...Array.from({length:dt},()=>kn("(")),...dt===1?[Do]:[],...ft,...ct.raw.endsWith(")".repeat(dt))?Array.from({length:dt},()=>kn(")")):[],...dt===1?[No]:[])}return lt(),ee}function fl(O,D,B,Q){let ee=[],he="",je=!1,at=0;while(at<O.length){let lt=O[at]??"";if(!D.single&&!D.double&&(lt==="("||lt===")")){ee.push({text:he,glob:je},lt),he="",je=!1,at++;continue}if(Q&&lt==="`"&&!D.single){he+=O[at+1]??"",at+=2;continue}if(D.single&&lt==="'"){D.single=!1,at++;continue}if(D.single){he+=lt,at++;continue}if(D.double){if(lt==='"'){D.double=!1,at++;continue}if(!Q&&lt==="\\"){let ct=O[at+1]??"";he+=['"',"\\","$"].includes(ct)?ct:`\\${ct}`,at+=2;continue}if(lt==="$"){let ct=ef(O,at,D,B,Q);he+=ct.text,at=ct.next;continue}he+=lt,at++;continue}if(lt==="'"||lt==='"'){D.single=lt==="'",D.double=lt==='"',at++;continue}if(!Q&&lt==="\\"){let ct=O[at+1]??"";je||=ct==="*"||ct==="?",he+=ct,at+=2;continue}if(lt==="$"){let ct=ef(O,at,D,B,Q);he+=ct.text,at=ct.next;continue}je||=lt==="*"||lt==="?",he+=lt,at++}return[...ee,{text:he,glob:je}]}function ef(O,D,B,Q,ee){let he=O[D+1];if(he==="{"){let at=pC(O,D+2);if(at===-1)return Q.invalid=!0,{text:"",next:O.length};let lt=O.slice(D,at+1);return mC(lt,B,Q,ee),{text:lt,next:at+1}}if(he!==void 0&&tC.test(he))return{text:`\${${he}}`,next:D+2};let je=(ee?nC:/^\w*/).exec(O.slice(D+1))?.[0]??"";return{text:`\${${je}}`,next:D+1+je.length}}function mC(O,D,B,Q){let ee=O.slice(2,-1),he=/^[A-Za-z_][A-Za-z0-9_]*/.exec(ee)?.[0];if(!he)return;let je=ee.slice(he.length),at=[":=","="].find((ct)=>je.startsWith(ct));if(!at)return;let lt=fl(je.slice(at.length),{...D},B,Q);B.assignmentFallbacks.push(...lt.flatMap((ct)=>typeof ct==="string"||!ct.text?[]:[ct.text]))}function pC(O,D){let B=1,Q=D;while(B>0&&Q<O.length){if(O[Q]==="{"&&O[Q-1]==="$")B++;if(O[Q]==="}")B--;Q++}return B===0?Q-1:-1}function gC(O){return/^[\r\n]+$/.test(O)?";":O}function kn(O){return Object.freeze({kind:"operator",operator:O,boundary:JS.has(O)})}function Ji(O){return Object.freeze({kind:"operator",operator:O,boundary:!0})}function hl(O){return Object.freeze({kind:"word",text:O})}function hC(O){if(O==="<<"||O==="<<<")return"here-data";if(O==="<"||O==="<&")return"file-read";return"file-write"}function Go(O){return iC.has(O)||/^python\d/.test(O)}var yC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function lf(O,D){let B=D[0];if(B===void 0||!B.startsWith("-"))return D;let Q=yC.get(O)?.has(B)??!1;return lf(O,D.slice(Q?2:1))}function ml(O){let D=O[0];if(D===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(D))return ml(O.slice(1));if(!XS.has(D))return[...O];return ml(lf(D,O.slice(1)))}function cf(O){let D=Ro(O),B=O.words.findIndex((Q)=>Q.provenance==="literal"&&Q.text===D);return ml(B<0?[]:O.words.slice(B).map((Q)=>Q.text))}function bC(O){let D=cf(O)[0];if(D===void 0)return!1;let B=Tt(D).toLowerCase();return Go(B)&&!Lo.has(B)}function pl(O){return O.nodes.flatMap((D,B)=>{if(D.kind==="group"||D.kind==="function")return pl(D.body);if(D.kind!=="command")return[];let Q=D.nested.flatMap((at)=>pl(at)),ee=D.redirections.flatMap((at)=>at.heredoc?.quotedDelimiter?[at.heredoc.bodySpan]:[]);if(bC(D))return[...Q,...ee];let he=O.nodes[B+1];if(he?.kind==="connector"&&(he.operator==="|"||he.operator==="|&")||!vC(D))return Q;return[...Q,...ee]})}function SC(O,D){let B=Ro(O);return B===void 0?void 0:D.get(B)}function or(O,D){return O!==void 0&&O.provenance==="literal"&&!O.quoted&&O.raw===O.text&&O.text===D}function CC(O){if(or(O.words[0],"git"))return or(O.words[1],"commit");if(!or(O.words[0],"gh")||!or(O.words[2],"create"))return!1;return or(O.words[1],"pr")||or(O.words[1],"issue")}function vC(O){return(or(O.words[0],"cat")||or(O.words[0],"tee")||CC(O))&&!O.words.some(tf)&&!O.redirections.some((B)=>tf(B.target))}function tf(O){return O?.parts.some((D)=>D.provenance==="command-substitution"&&D.raw.startsWith(">("))??!1}var uf=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),df=new Set([...uf,"glob"]),EC=new Set([...df,"pattern"]);class y extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Fo(O){let D=xC(),B=ne(O.input),Q=[];if((O.route.kind==="command"||O.route.kind==="unknown")&&B)Q.push({usage:"input-candidate",source:B});if(O.route.kind==="command"&&"command"in O&&O.command)Q.push({usage:"declared-command",source:O.command});let ee=Q.reduce((he,je)=>{let at=he.findIndex((ut)=>ut.source===je.source);if(at!==-1){let ut=he[at];if(!ut)return he;return he[at]={...ut,usages:[...ut.usages,je.usage]},he}let lt=O.route.kind==="command"?O.route.shell:process.platform==="win32"?"powershell":"posix",ct=D.getCommandProgram(je.source,lt);return he.push({usages:[je.usage],source:je.source,program:ct,shell:D.getShellSyntax(je.source,ct)}),he},[]);return{invocation:{toolName:O.toolName,route:O.route,context:O.context},commands:ee,paths:RC(O),store:D}}function un(O,D){return O.commands.find((B)=>B.usages.includes(D))}function Vn(O,D){if(!O.includes("$"))return O;return Xs(O,D)}function xC(){let O=new Map,D=new Map,B=new WeakMap,Q=(he,je)=>{let at=`${je}\x00${he}`,lt=D.get(at);if(lt)return lt;let ct=h(he,je);return D.set(at,ct),ct};return{getShellSyntax:(he,je)=>{if(je&&je.source!==he)throw TypeError("Shell syntax source does not match command program source.");let at=je??Q(he,"posix");if(at.status==="limited"){let ut=B.get(at);if(ut)return ut;let ft={status:"structural-limit",source:he,program:at,assignmentFallbacks:[]};return B.set(at,ft),ft}let lt=O.get(he);if(lt)return lt;let ct=rf(he,at);return O.set(he,ct),ct},getCommandProgram:Q}}function RC(O){let D=O.route.kind==="grep"?df:O.route.kind==="glob"?EC:uf;return[...Yc(O.input,D),...O.route.kind==="patch"?Jc(O.input):[]]}var _C=new Set(["-S","--suffix"]);function Yr(O,D,B,Q,ee){if(O.status==="structural-limit")throw new y;if(O.status!=="complete")return ee.findMalformedTarget(O.source);return Qi(O,D,B,Q,{segment:(he,je)=>ee.findSegmentTarget(he,je),redirection:(he,je)=>he.role==="file-write"&&ee.isRedirectionTarget(cn(he.target,je.variables),je)?he.target:null})}function ts(O){let D=[],B=null,Q=!1;for(let ee=0;ee<O.length;ee++){let he=O[ee];if(he===void 0)break;if(!Q&&he==="--"){Q=!0;continue}if(!Q&&(he==="-t"||he==="--target-directory")){B=O[++ee]??null;continue}if(!Q&&he.startsWith("--target-directory=")){B=he.slice(19);continue}if(!Q&&he.startsWith("-t")&&he.length>2){B=he.slice(2);continue}if(!Q&&_C.has(he)){ee++;continue}if(!Q&&(he.startsWith("--suffix=")||he.startsWith("--backup=")))continue;if(!Q&&he.startsWith("-"))continue;D.push(he)}return B?{sources:D,destination:B}:{sources:D.slice(0,-1),destination:D.at(-1)??null}}var x="Git metadata and hooks are protected. Ask the user before modifying them.";function hf(O,D,B,Q){let ee=O.invocation.context.executionCwd;if(!D)return null;if(O.invocation.route.kind==="patch"||O.invocation.route.kind==="path"||O.invocation.route.kind==="unknown"){if(ui(O.invocation.toolName))return null;let at=O.paths.find((lt)=>ff(lt,ee,D,B,Q,D.entries));return at?{target:at}:null}if(O.invocation.route.kind!=="command")return null;let he=un(O,"input-candidate");if(!he)return null;let je=Yr(he.shell,ee,B,Q,{findSegmentTarget:(at,lt)=>TC(at,lt,D,B,Q),isRedirectionTarget:(at,lt)=>ff(at,lt.cwd,D,B,Q,D.markerFiles),findMalformedTarget:()=>null});return je?{target:je}:null}function Er(O,D,B,Q,ee,he,je=!1){if(!B)return!1;let at=rs(tn(O,D,ee,he)),lt=at.replace(/(\/\.?\*+)+$/,"");if(lt!==at&&lt!==""){if(yl(lt,B))return!0;let ct=je||at.slice(lt.length).includes("/."),ut=(ft)=>ct?ns(ft,lt):wC(ft,lt);if(B.markerFiles.some(ut))return!0;return Q&&mf(B).some(ut)}if(yl(at,B))return!0;return Q&&mf(B).some((ct)=>ns(ct,at))}function wC(O,D){let B=gf(D,O);if(B===""||B.startsWith("..")||pf(B))return!1;return!B.split(/[\\/]/)[0]?.startsWith(".")}function PC(O,D,B,Q,ee){return Er(O,D,B,!0,Q,ee)}function AC(O,D,B,Q,ee){if(!B)return!1;return yl(rs(tn(O,D,Q,ee)),B)}function ff(O,D,B,Q,ee,he){let je=rs(tn(O,D,Q,ee));return he.includes(je)||bf(je,B)}function yf(O,D,B,Q,ee){if(!B)return!1;return B.hooksDirectories.some((he)=>O.some((je)=>ns(he,rs(tn(je,D,Q,ee)))))}function yl(O,D){return D.entries.includes(O)||D.directories.includes(O)||bf(O,D)}function bf(O,D){return D.hooksDirectories.some((B)=>ns(O,B))}function mf(O){return[...O.entries,...O.directories,...O.hooksDirectories]}function ns(O,D){let B=gf(D,O);return B===""||!/^\.\.(?:[\\/]|$)/.test(B)&&!pf(B)}function rs(O){return process.platform==="win32"?O.toLowerCase():O}function TC(O,D,B,Q,ee){if(Wo(O))return null;let he=Cr([...O],Q);if(Tt(he[0]??"").toLowerCase()!=="mv")return null;let je=ts(he.slice(1)),at=je.sources.find((lt)=>PC(cn(lt,D.variables),D.cwd,B,Q,ee));if(at)return at;return je.destination&&AC(cn(je.destination,D.variables),D.cwd,B,Q,ee)?je.destination:null}import{isAbsolute as ls,normalize as WC,parse as GC,posix as wf,resolve as Rr,sep as vl}from"node:path";import{isAbsolute as IC,join as Sf,normalize as Ef,parse as kC,sep as Cf}from"node:path";var OC=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],MC=` 	
+`;function zo(O,D){if(ir(O,D))return!0;if(!O.has("TMPDIR"))return!1;return!bl(O.get("TMPDIR")??"",D)}function xr(O,D){if(O.has("TMPDIR"))return bl(O.get("TMPDIR")??"",D);let B=Sl(O,D);if(B===void 0)return!0;return bl(B,D)}function Sl(O,D){return Rf(O,D,"TMPDIR")}function bl(O,D){if(!O)return!1;if(NC(O))return!1;return Zr(O,D)}function ir(O,D){let B=Rf(O,D,"IFS");return B!==void 0&&B!==""&&B!==MC}function Zr(O,D){let B=os(O,D.paths);if(B===null)return!1;return xf(D).some((Q)=>as(B,Q))}function ss(O,D){let B=os(O,D.paths);if(B===null)return!1;return xf(D).some((Q)=>is(Q)===is(B))}var vf=new WeakMap;function xf(O){let D=vf.get(O);if(D)return D;let B=DC(O);return vf.set(O,B),B}function DC(O){let D=OC.map((Q)=>os(Q,O.paths)??Ef(Q)),B=os(O.tmpdir,O.paths);if(!B)return D;if(process.platform==="win32")return[...D,B];if(process.platform==="darwin"&&LC(B))return[...D,B];return D}function NC(O){return/[\s$`*?[]/.test(O)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(O)||/[+@!]\([^)]*\)/.test(O)}function Rf(O,D,B){return O.has(B)?O.get(B):D.env.get(B)}function LC(O){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(O)}function os(O,D){try{let B=Ef(O);if(!IC(B))return B;let Q=kC(B).root,ee=B.slice(Q.length).split(/[\\/]+/).filter(Boolean),he=Q;for(let je=0;je<ee.length;je++){let at=Sf(he,ee[je]??"");if(D.entryKind(at)==="missing")return Sf(at,...ee.slice(je+1));let lt=D.realpath(at);if(lt===null)return null;he=lt}return he}catch{return null}}function as(O,D){let B=is(O),Q=is(D);if(B===Q)return!0;let ee=Q.endsWith(Cf)?Q:`${Q}${Cf}`;return B.startsWith(ee)}function is(O){return process.platform==="win32"?O.toLowerCase():O}var FC=process.platform==="win32",_f=64,zC=16384;function Bo(O,D,B,Q){if(O.kind==="temp_target")return null;let ee=Q[O.kind];if(O.kind==="dynamic_target"&&!Jt(B,ee.id,D.strict))return null;if(O.kind==="within_anchored_cwd"&&!Jt(B,ee.id,D.paranoid))return null;return St(ee.id,ee.reason)}function $o(O){let D=gd(O,_f,_f,zC);return{expandedTargets:D&&"words"in D?D.words:void 0,unsafeBraceExpansion:D!==void 0&&"limited"in D,targetIsLiteral:D===void 0&&O.provenance==="literal"&&(O.quoted||O.raw!==O.text),tmpdirWordSplittingProtected:BC(O)}}function BC(O){let D=O.parts.filter((B)=>B.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(B.raw));return D.length>0&&D.every((B)=>$C(O.raw,B.span.start-O.span.start))}function $C(O,D){let B=null,Q=!1;for(let ee=0;ee<D;ee++){let he=O[ee];if(Q){Q=!1;continue}if(he==="\\"&&B!=="'"){Q=!0;continue}if(B===he){B=null;continue}if(B===null&&(he==="'"||he==='"'))B=he}return B==='"'}function _r(O){let D=O.environment.home,B=O.environment.paths,Q=O.budget??mn();return{anchoredCwd:O.originalCwd??O.cwd??null,resolvedCwd:O.cwd??null,strict:O.strict??!1,paranoid:O.paranoid??!1,trustTmpdirVar:O.allowTmpdirVar??!0,posixShell:O.posixShell??!1,tmpdirWordSplittingUnsafe:O.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:O.trustedTmpdirValue??O.allowTmpdirVar??!0,environment:O.environment,allowRoots:qC(O.allowPaths,D,B,Q),protectedGitMetadata:O.protectedGitMetadata,budget:Q}}function On(O,D,B={}){let Q=B.targetIsLiteral??!1;if(!Q&&D.tmpdirWordSplittingUnsafe&&!B.tmpdirWordSplittingProtected&&ZC(O))return{kind:"outside_anchored_cwd"};let ee=!Q&&Af(O,D.posixShell);if(Qn(O))return{kind:"outside_anchored_cwd"};if(El(O,Q))return{kind:"root_or_home_target"};if(HC(O,D,Q))return{kind:"root_or_home_target"};if(D.resolvedCwd&&Er(O,D.resolvedCwd,D.protectedGitMetadata,!0,D.environment,D.budget,!D.posixShell))return{kind:"git_metadata_target"};if(jC(O,D.trustTmpdirVar,D.posixShell,ee,Q,B.tmpdirWordSplittingProtected??!1,D.trustedTmpdirValue,D.environment))return{kind:"temp_target"};if(ee)return{kind:"dynamic_target"};if(YC(O,D,Q))return{kind:"temp_target"};let he=D.anchoredCwd;if(he){if(!B.skipHomeCwd&&ev(he,D.environment.home,D.environment.paths,D.budget))return{kind:"home_cwd_target"};if(!B.skipCwdSelf&&[D.resolvedCwd??he,he].some((je)=>tv(O,D.resolvedCwd??he,D.environment.paths,D.budget,je)))return{kind:"cwd_self_target"};if(nv(O,he,D.resolvedCwd??he,ee,Q,D.environment.paths,D.budget))return{kind:"within_anchored_cwd"}}if(UC(O,D,ee))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function UC(O,D,B){let Q=O.trim();if(B||!D.resolvedCwd||!D.anchoredCwd||!Q)return!1;if(ls(Q)||Q.startsWith("~"))return!1;if(xl(Q))return!1;if(Tf(D.resolvedCwd,D.anchoredCwd,D.environment.paths,D.budget))return!1;return Zr(Rr(D.resolvedCwd,Q),D.environment)}function Pf(O,D,B={}){let{containmentTarget:Q,...ee}=B;if(On(O,D,ee).kind!=="temp_target")return!1;let he=O.trim();if(KC(he))return!1;if(ss(he,D.environment))return!1;return![D.anchoredCwd,D.resolvedCwd].some((je)=>Tf(Q??he,je,D.environment.paths,D.budget))}function El(O,D=!1){let B=O.trim(),Q=wf.normalize(B),ee=B.replace(/\\/g,"/"),he=Q==="/"?Q:Q.replace(/\/+$/,"");if(he==="/"||he.startsWith("/")&&he.slice(1).split("/").every((je)=>/^\*+$/.test(je)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(ee)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(ee))return!0;if(!D&&(Q==="~"||Q==="~/"||Q==="~/*"))return!0;if(!D&&(Q==="$HOME"||Q==="$HOME/"||Q==="$HOME/*"))return!0;if(!D&&(Q==="${HOME}"||Q==="${HOME}/"||Q==="${HOME}/*"))return!0;return!1}function HC(O,D,B){let Q=O.trim(),ee=B?Q:Q==="*"?".":Q.endsWith("/*")?Q.slice(0,-2):Q;if(!ee)return!1;try{let he=ls(ee)?ee:D.resolvedCwd?Rr(D.resolvedCwd,ee):null;if(!he)return!1;let je=dn(Wt(he,D.environment.paths,D.budget));if(je===GC(je).root)return!0;return je===dn(Wt(D.environment.home,D.environment.paths,D.budget))}catch{return!1}}function dn(O){let D=WC(O);if(FC){if(D=D.replace(/\//g,"\\").toLowerCase(),D.length>3&&D.endsWith("\\"))D=D.slice(0,-1);return D}if(D.length>1&&D.endsWith("/"))D=D.slice(0,-1);return D}function jC(O,D,B,Q,ee,he,je,at){let lt=O.trim();if(xl(lt))return!1;if(!Q&&Zr(lt,at))return!0;return(D||he&&je)&&B&&!ee&&VC(lt,B)}function VC(O,D){return["$TMPDIR","${TMPDIR}"].some((B)=>{if(O===B)return!0;if(!O.startsWith(`${B}/`))return!1;return!Af(O.slice(B.length+1),D)})}function KC(O){let D=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(O);if(!D)return!1;return wf.normalize(`/${D[1]??""}`)==="/"}function xl(O){return O.split(/[\\/]+/).includes("..")}function qC(O,D,B,Q){if(!O?.length)return[];return O.flatMap((ee)=>{let he=vo(ee.trim(),D);if(!ls(he))return[];try{let je=Wt(he,B,Q);if(Eo(je,Wt(D,B,Q)))return[];return[dn(je)]}catch{return[]}})}function YC(O,D,B){if(D.allowRoots.length===0)return!1;let Q=O.trim();if(xl(Q))return!1;let ee=B?Q:vo(Q,D.environment.home),he=D.resolvedCwd??D.anchoredCwd,je=ls(ee)?ee:he?Rr(he,ee):null;if(!je)return!1;try{let at=dn(Wt(je,D.environment.paths,D.budget));return D.allowRoots.some((lt)=>at===lt||at.startsWith(lt.endsWith(vl)?lt:`${lt}${vl}`))}catch{return!1}}function ZC(O){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(O)}function Af(O,D=!1){return O.includes("$")||O.includes("`")||XC(O)||D&&JC(O)}function XC(O){let D=!1;for(let B of O){if(D){D=!1;continue}if(B==="\\"){D=!0;continue}if(B==="*"||B==="?"||B==="[")return!0}return!1}function JC(O){let D=!1;for(let B=0;B<O.length;B++){let Q=O[B];if(D){D=!1;continue}if(Q==="\\"){D=!0;continue}if(Q==="{"&&QC(O,B)||(Q==="+"||Q==="@"||Q==="!")&&O[B+1]==="(")return!0}return!1}function QC(O,D){let B=O.indexOf("}",D+1);if(B===-1)return!1;let Q=O.slice(D+1,B);return Q.includes(",")||Q.includes("..")}function ev(O,D,B,Q){try{return dn(Wt(O,B,Q))===dn(Wt(D,B,Q))}catch{try{return dn(O)===dn(D)}catch{return!1}}}function tv(O,D,B,Q,ee=D){if(ee===D&&(O==="."||O==="./"||O===".\\"))return!0;try{return dn(Wt(Rr(D,O),B,Q))===dn(Wt(ee,B,Q))}catch{try{return dn(Rr(D,O))===dn(ee)}catch{return!1}}}function nv(O,D,B,Q,ee,he,je){let at=B??D;if(!ee&&(O.startsWith("~")||O.startsWith("$HOME")||O.startsWith("${HOME}")))return!1;if(Q)return!1;if(O.startsWith("/")||/^[A-Za-z]:[\\/]/.test(O))try{return Cl(O,D,he,je)}catch{return!1}if(O.startsWith("./")||O.startsWith(".\\")||!O.includes("/")&&!O.includes("\\"))try{return Cl(Rr(at,O),D,he,je)}catch{return!1}if(O.startsWith("../"))return!1;try{return Cl(Rr(at,O),D,he,je)}catch{return!1}}function Cl(O,D,B,Q){try{return If(Wt(O,B,Q),Wt(D,B,Q))}catch{return!1}}function Tf(O,D,B,Q){if(!D)return!1;try{return If(Wt(D,B,Q),Wt(O,B,Q))}catch{return!0}}function If(O,D){let B=dn(O),Q=dn(D);return B.startsWith(`${Q}${vl}`)||B===Q}var rv=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),kf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ov="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Of="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Mf="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",iv="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",sv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",av={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Mf},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:x},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Of},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:iv},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:kf},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:ov},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:kf}};function Df(O,D,B,Q=_r({...B,allowPaths:B.policy?.destructiveCommandAllowPaths})){return lv(O.words.map((ee)=>({kind:"word",text:ee.text,dynamic:ee.provenance!=="literal"})),D,Q,B.policy)}function lv(O,D,B,Q){let ee=O.filter((lt)=>lt.kind==="word"),he=uv(ee),je=ee[he];if(!je||!rv.has(Sv(je.text)))return null;let at=cv(ee.slice(he+1));if(at.whatIfProtected)return null;if(Jt(Q,"powershell.remove-item-pipeline-dynamic-target",B.strict)&&D&&(at.targets.length===0||at.recursive))return St("powershell.remove-item-pipeline-dynamic-target",sv);for(let lt of at.targets)if(!Qn(lt.text)&&El(_l(lt.text)))return St(at.recursive&&at.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Mf);for(let lt of at.targets)if(B.resolvedCwd&&Er(_l(lt.text),B.resolvedCwd,B.protectedGitMetadata,at.recursive,B.environment,B.budget,!0))return St("powershell.remove-item-git-metadata",x);if(!at.recursive||!at.force)return null;if(Jt(Q,"powershell.remove-item-recursive-force-dynamic-target",B.strict)&&(at.hasDynamicTarget||at.targets.length===0))return St("powershell.remove-item-recursive-force-dynamic-target",Of);for(let lt of at.targets){let ct=Bo(On(_l(lt.text),B),B,Q,av);if(ct)return ct}return null}function cv(O){let D=[],B=!1,Q=!1,ee=!1,he=!1,je=!1;for(let at=0;at<O.length;at++){let lt=O[at];if(!lt||lt.kind!=="word")continue;if(dv(lt))continue;if(je){D.push(Rl(lt)),he=he||lt.dynamic;continue}if(lt.text==="--"){je=!0;continue}let ct=mv(lt.text);if(!ct){D.push(Rl(lt)),he=he||lt.dynamic;continue}if(pv(ct.name)){let ut=ct.value?fv(ct.value,lt):O[++at];if(ut?.kind==="word"){D.push(Rl(ut)),he=he||ut.dynamic;continue}he=!0;continue}if(gv(ct.name)){B=!0;continue}if(hv(ct.name)){Q=!0;continue}if(yv(ct.name))ee=bv(ct.value)}return{targets:D,recursive:B,force:Q,whatIfProtected:ee,hasDynamicTarget:he}}function uv(O){let D=O[0];if(D?.kind==="word"&&D.text==="&"||D?.text===".")return O.length>1?1:0;return 0}function Rl(O){return{text:O.kind==="word"?O.text:"",dynamic:O.kind==="word"&&O.dynamic}}function dv(O){return O.kind==="word"&&O.text===","}function _l(O){let D=O.replace(/\\/g,"/"),B=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(D);return B?`$HOME${D.slice(B[0].length)}`:D}function fv(O,D){return{kind:"word",text:O,dynamic:D.kind==="word"&&(D.dynamic||O.includes("$"))}}function mv(O){if(!O.startsWith("-")||O==="-")return null;let D=O.slice(1),B=D.indexOf(":");if(B===-1)return{name:D.toLowerCase()};return{name:D.slice(0,B).toLowerCase(),value:D.slice(B+1)}}function pv(O){return"path".startsWith(O)||"literalpath".startsWith(O)}function gv(O){return"recurse".startsWith(O)}function hv(O){return O.length>=2&&"force".startsWith(O)}function yv(O){return O==="wi"||"whatif".startsWith(O)}function bv(O){if(O===void 0||O==="")return!0;let D=O.toLowerCase();return D==="$true"||D==="true"}function Sv(O){return O.toLowerCase()}var Xr="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",cs="Unsupported heredoc syntax",Uo="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Nf="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var Cv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),vv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),Ev=new Set(["-o","--output","--query","--subscription"]),xv=new Set;function Lf(O){if(O==="aws")return Cv;if(O==="gcloud")return vv;if(O==="az")return Ev;return xv}var Rv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),_v=new Set;function Wf(O){if(O==="git")return gn;if(O==="docker")return Rv;return _v}function _(O,D){if(O.length===0||D.length===0)return null;let B=kt(O[0]??""),Q=an(O);for(let ee of D){if(!Av(B,ee.command))continue;if(ee.match){if(wv(B,O,ee.match))return Gf(ee);continue}if(!Tv(B,O,ee.subcommand))continue;if(kv(O,new Set(ee.block_args),Q))return Gf(ee)}return null}function Gf(O){return{id:`custom.${O.name}`,reason:`[${O.name}] ${O.reason}`,intent:O.intent??"manual_only"}}function wv(O,D,B){let Q=D.slice(1);if(B.exclude_args?.some((ee)=>Q.includes(ee)))return!1;if(B.any_args&&!B.any_args.some((ee)=>Q.includes(ee)))return!1;return Pv(Q,B.command_path,Lf(O))}function Pv(O,D,B){let Q=0,ee=!1;for(let he of O){if(Q>=D.length)return!0;if(ee){ee=!1;continue}if(he.startsWith("-")){ee=!he.includes("=")&&B.has(he);continue}if(he!==D[Q])return!1;Q++}return Q>=D.length}function Av(O,D){return O===kt(D)}function Tv(O,D,B){if(!B)return!0;return Ff(D,1,B,Wf(O))}function Ff(O,D,B,Q){let ee=!1;for(let he=D;he<O.length;he++){let je=O[he];if(!je)continue;if(ee){ee=!1;continue}if(je==="--"){let at=O[he+1];if(at&&!at.startsWith("-"))return at===B;return!1}if(Q.has(je)){ee=!0;continue}if(je.startsWith("-")){if(!je.includes("=")&&Iv(O,he,B,Q))return!0;continue}return je===B}return!1}function Iv(O,D,B,Q){let ee=O[D+1];if(!ee||ee.startsWith("-"))return!1;return Ff(O,D+2,B,Q)}function kv(O,D,B){return O.some((Q)=>D.has(Q))||[...B].some((Q)=>D.has(Q))}var Ov=new Set(["-e","--source"]),Mv=new Set(["-F","-v","--assign","--field-separator"]),zf=new Set(["-f","--file"]),Dv=new Set(["print","printf","return"]),Bf=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Nv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function $f(O,D,B){let Q=!1;for(let ee of Lv(O)){let he=Wv(ee,B);if(!he)continue;for(let je of he.commands){let at=D(je);if(at)return at;if(je.includes("{}")||/[$`]/.test(je))Q=!0}Q||=he.dynamic}return Q?St("awk.system-dynamic",Nv):null}function Pl(O){let D=[],B=!1,Q=!1,ee=!0,he=!0;for(let je=1;je<O.length;je++){let at=O[je];if(at===void 0)break;if(ee&&at==="--"){ee=!1;continue}if(ee&&Ov.has(at)){B=!0;let lt=O[je+1];if(he&&=lt!==void 0,lt!==void 0)D.push({tokenIndex:je+1,kind:"inline-code",value:lt});je++;continue}if(ee&&at.startsWith("--source=")){B=!0,D.push({tokenIndex:je,kind:"inline-code",value:at.slice(9)});continue}if(ee&&at.startsWith("-e")&&at.length>2){B=!0,D.push({tokenIndex:je,kind:"inline-code",value:at.slice(2)});continue}if(ee&&(Mv.has(at)||zf.has(at))){let lt=O[je+1];if(he&&=lt!==void 0,zf.has(at)){if(Q=!0,lt!==void 0)D.push({tokenIndex:je+1,kind:"program-file",value:lt})}je++;continue}if(ee&&(at.startsWith("-F")||at.startsWith("-v")&&at.slice(2).includes("=")))continue;if(ee&&at.startsWith("-f")&&at.length>2){Q=!0,D.push({tokenIndex:je,kind:"program-file",value:at.slice(2)});continue}if(ee&&(at.startsWith("--assign=")||at.startsWith("--field-separator=")))continue;if(ee&&at.startsWith("--file=")){Q=!0,D.push({tokenIndex:je,kind:"program-file",value:at.slice(7)});continue}if(ee&&at.startsWith("-")&&at!=="-")continue;if(!B&&!Q)D.push({tokenIndex:je,kind:"main-program",value:at});return{sources:D,optionsOpen:!1}}return{sources:he?D:[],optionsOpen:ee&&he}}function jo(O){return Pl(O).sources}function Lv(O){return jo(O).filter((D)=>D.kind!=="program-file").map((D)=>D.value)}function Wv(O,D){bn(D,O);let B=O.includes("system")?Al(O,D):null,Q=Gv(O,D);if(!B&&!Q)return null;return{dynamic:!!B?.dynamic||!!Q?.dynamic,commands:[...B?.commands??[],...Q?.commands??[]]}}function Al(O,D){bn(D,O);let B=[],Q=!1,ee=!1,he=0;while(he<O.length){let je=O[he];if(je==='"'||je==="'"){he=ds(O,he,je)?.endIndex??he+1;continue}if(je==="#"){he=Uf(O,he+1);continue}if(je==="/"&&Hf(O,he)){he=jf(O,he+1)??he+1;continue}if(!O.startsWith("system",he)){he++;continue}let at=he;if(he+=6,Ho(O[at-1])||Ho(O[he]))continue;let lt=us(O,he);if(O[lt]!=="(")continue;lt=us(O,lt+1);let ct=O[lt];if(ct!=='"'&&ct!=="'"){Q=!0,ee=!0;continue}let ut=ds(O,lt,ct);if(!ut){Q=!0,ee=!0;continue}if(lt=us(O,ut.endIndex),Q=!0,O[lt]!==")"){ee=!0,he=ut.endIndex;continue}B.push(ut.value),he=lt+1}if(!Q)return null;return{dynamic:ee,commands:B}}function Gv(O,D){bn(D,O);let B=[],Q=!1,ee=!1,he=0,je=0,at=null,lt=null,ct=0;while(he<O.length){let ut=O[he];if(!ut)break;if(ut==='"'||ut==="'"){let mt=ds(O,he,ut);if(mt&&ct===je)lt={...mt,startIndex:he};ct=mt?.endIndex??he+1,he=mt?.endIndex??he+1;continue}if(ut==="#"){he=Uf(O,he+1),je=he,at=null,lt=null,ct=he;continue}if(ut==="/"&&Hf(O,he)){let mt=jf(O,he+1);ct=mt??he+1,he=mt??he+1;continue}if(`;
+{}`.includes(ut)){he++,je=he,at=null,lt=null,ct=he;continue}if(at===null&&(wl(O,he,"print")||wl(O,he,"printf")))at=he;if(ut!=="|"||O[he-1]==="|"||O[he+1]==="|"){if(!/\s/.test(ut))ct=he+1;he++;continue}let ft=O[he+1]==="&"?he+2:he+1,dt=us(O,ft);if(wl(O,dt,"getline")){ee=!0;let mt=Bv(je,lt,ct);if(Q||=mt===null,mt!==null)B.push(mt);ct=ft,he=ft;continue}if(Uv(je,at)){ee=!0;let mt=zv(O,dt);if(!mt){Q=!0,ct=ft,he=ft;continue}if(!Fv(O,mt.endIndex)){Q=!0,ct=mt.endIndex,he=mt.endIndex;continue}B.push(mt.value),ct=mt.endIndex,he=mt.endIndex;continue}ct=ft,he++}if(!ee)return null;return{dynamic:Q,commands:B}}function Ho(O){return!!O&&/[A-Za-z0-9_]/.test(O)}function us(O,D){let B=D;while(/\s/.test(O[B]??""))B++;return B}function Fv(O,D){let B=D;while(/[\t\f\v\r ]/.test(O[B]??""))B++;let Q=O[B];return!Q||`;
+}#`.includes(Q)}function ds(O,D,B){let Q="",ee=!1;for(let he=D+1;he<O.length;he++){let je=O[he];if(!je)break;if(ee){let at=$v(O,he);if(!at)return null;Q+=at.value,he=at.endIndex,ee=!1;continue}if(je==="\\"){ee=!0;continue}if(je===B)return{value:Q,endIndex:he+1};Q+=je}return null}function zv(O,D){let B=O[D];if(B!=='"'&&B!=="'")return null;return ds(O,D,B)}function Bv(O,D,B){if(!D)return null;return D.startIndex>=O&&D.endIndex===B?D.value:null}function $v(O,D){let B=O[D];if(!B)return null;if(B==="x"){let ee=O.slice(D+1,D+3);if(!/^[0-9A-Fa-f]{2}$/.test(ee))return null;return{value:String.fromCharCode(Number.parseInt(ee,16)),endIndex:D+2}}if(/[0-7]/.test(B)){let ee=/^[0-7]{1,3}/.exec(O.slice(D));if(!ee)return null;return{value:String.fromCharCode(Number.parseInt(ee[0],8)),endIndex:D+ee[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[B]??B,endIndex:D}}function wl(O,D,B){return O.startsWith(B,D)&&!Ho(O[D-1])&&!Ho(O[D+B.length])}function Uv(O,D){return D!==null&&D>=O}function Uf(O,D){let B=O.indexOf(`
+`,D);return B===-1?O.length:B+1}function Hf(O,D){let B=Hv(O,D);if(B===-1)return!0;if("{([,;!~=".includes(O[B]??""))return!0;let Q=B;while(Ho(O[Q-1]))Q--;return Dv.has(O.slice(Q,B+1))}function Hv(O,D){for(let B=D-1;B>=0;B--)if(!/\s/.test(O[B]??""))return B;return-1}function jf(O,D){let B=!1;for(let Q=D;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(B){B=!1;continue}if(ee==="\\"){B=!0;continue}if(ee==="/")return Q+1}return null}var jv=new Set(["sudo","env","command","builtin"]);function fs(O,D){let B=O[0];if(!B||!D.transparentWrappers.includes(Tt(B)))return null;let Q=Tt(B),ee=O[1]==="--"?2:1,he=Vv(O,ee,Q,D),je=he[0];if(je===void 0)return null;return{wrapper:Q,tokens:O.slice(je),childIndex:je,alternativeChildIndices:he.slice(1)}}function Vv(O,D,B,Q){let ee=O[1]==="--",he=[];for(let je=D;je<O.length;je++){let at=O[je];if(!at)continue;let lt=Tt(at)!==B&&Kv(at,Q);if(lt)he.push(je);if(!lt&&bi.has(kt(at)))break;if(ee)break}return he}function Kv(O,D){let B=Tt(O),Q=kt(O);return Q==="git"||B==="busybox"||wr(O)||ya.has(B)||D.transparentWrappers.includes(B)||Kt.has(Q)||O==="$SHELL"||An(Q)||En.has(Q)||D.rules.some((ee)=>ee.command===B)}function wr(O){return jv.has(O.toLowerCase())}function Pr(O,D){return{embedded:!1,cwd:O.cwd,originalCwd:D.originalCwd,effectiveCwd:O.cwd,envAssignments:O.envAssignments,allowTmpdirVar:D.allowTmpdirVar,worktreeMode:D.worktreeMode,wrappedByTransparent:!1}}function Mn(O,D){let B=D.policy??{rules:[],transparentWrappers:[]};return ms([...O],D.environment,D.cwd,D.cwd,new Map,new Map(D.envAssignments??[]),B,{iterations:0},!1)}function*ms(O,D,B,Q,ee,he,je,at,lt){let ct=Zi(O,D,B,he);for(let[mt,pt]of ct.envAssignments)he.set(mt,pt),ee.set(mt,pt);let{tokens:ut,cwd:ft}=ct;if(ct.envSplitValues){let mt=Yi(ct.envSplitValues,ut);if(!mt)throw new s("derivedCommandShape");Tl(at),yield*ms(mt,D,ft,Q,ee,he,je,at,lt);return}if(wr(ut[0]??""))throw new s("wrapperPeelIterations");let dt=fs(ut,je);if(dt){for(let mt of[dt.childIndex,...dt.alternativeChildIndices])Tl(at),yield*ms(mt===dt.childIndex?dt.tokens:ut.slice(mt),D,ft,Q,new Map(ee),new Map(he),je,at,!0);return}if(Yv(ut)){Tl(at),yield*ms(ut.slice(1),D,ft,Q,ee,he,je,at,lt);return}yield qv(ut,ft,Q,ee,he,lt)}function qv(O,D,B,Q,ee,he){return{tokens:O,cwd:D===null?void 0:D??B,wrapperCwd:D,wrapperEnvAssignments:Q,envAssignments:ee,head:Tt(O[0]??"").toLowerCase(),wrappedByTransparent:he}}function Tl(O){if(O.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");O.iterations++}function Yv(O){return Tt(O[0]??"").toLowerCase()==="busybox"&&O.length>1}function Il(O,D){let B=[],Q=D;while(Q<O.length){let ee=O[Q];if(ee===void 0||ee===":::")break;B.push(ee),Q++}return{markerIndex:Q<O.length&&O[Q]===":::"?Q:-1,templateTokens:B}}function Dn(O){let D=!1,B=!1;for(let Q of O){if(Q==="--")break;if(Q==="-r"||Q==="-R"||kl(Q,"recursive")){D=!0;continue}if(Q==="-f"||kl(Q,"force")){B=!0;continue}if(Q.startsWith("-")&&!Q.startsWith("--")){if(Q.includes("r")||Q.includes("R"))D=!0;if(Q.includes("f"))B=!0}}return D&&B}function Vf(O){let D=O.indexOf("--");return O.slice(1,D===-1?void 0:D).some((B)=>kl(B,"recursive")||/^-[A-Za-z]+$/.test(B)&&/[rR]/.test(B.slice(1)))}function kl(O,D){return O.length>2&&O.startsWith("--")&&D.startsWith(O.slice(2))}var Zv="find -delete permanently removes files. Use -print first to preview.",Xv="find -exec rm -rf is dangerous. Use explicit file list instead.",Jv=new Set(["-exec","-execdir","-ok","-okdir"]),Qv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((O)=>[O,1]),["-fprintf",2]]);function Kf(O,D){let B=O.map(t),Q=eE(O,B,D);if(Q)return Q;if(gs(B,1)&&!nE(O,B,D)){let je=wt(St("find.delete",Zv),D.policy);if(je)return je}let ee=D.budget??mn(),he=0;while(he<B.length){let je=B[he],at=sr(je??"");if(at>0){he+=at+1;continue}if(!Kn(je)){he++;continue}ee.charge("derivedTokens",B.length-he-1);let lt=Vo(B,he);he=lt.nextIndex;let ct=oE(lt.tokens,D.environment);if(ct){let mt=wt(ct,D.policy);if(mt)return mt}let ut=je==="-execdir"||je==="-okdir",ft=D.analyzeTokens?D.analyzeTokens(lt.tokens,ut?null:D.cwd):D.analyzeNested?D.analyzeNested(lt.tokens.join(" "),{effectiveCwd:ut?void 0:D.cwd,envAssignments:D.envAssignments}):null,dt=ft?.id.startsWith("custom.")?ft:wt(ft,D.policy);if(dt)return dt}return null}function eE(O,D,B){if(!gs(D,1)&&!Ol(D,B.environment))return null;let ee=ps(O)??$t(["."]),he=_r({...B,allowPaths:B.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let je of ee){let at=$o(je);for(let lt of at.expandedTargets??[t(je)]){let ct=On(lt,he,{targetIsLiteral:at.expandedTargets!==void 0||at.targetIsLiteral,tmpdirWordSplittingProtected:at.tmpdirWordSplittingProtected});if(ct.kind==="root_or_home_target")return St("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ct.kind==="git_metadata_target")return St("find.delete-git-metadata",x)}}if(tE(D)&&he.resolvedCwd&&yf(ee.map(t),he.resolvedCwd,he.protectedGitMetadata,he.environment,he.budget))return St("find.delete-git-metadata",x);return null}function Ol(O,D){let B=0;while(B<O.length){if(!Kn(O[B])){B++;continue}let Q=Vo(O,B),ee=Cr([...Q.tokens],D),he=Tt(ee[0]??"").toLowerCase();if((he==="rm"||he==="rmdir")&&ee.some((je)=>je.includes("{}")))return!0;B=Q.nextIndex}return!1}function tE(O){return O.some((D,B)=>{if(!["-name","-iname"].includes(D))return!1;return O[B+1]?.toLowerCase()==="hooks"})}function nE(O,D,B){if(D.includes("-L")||D.includes("-f")||D.includes("-follow"))return!1;let Q=ps(O);if(!Q)return!1;let ee=B.envAssignments??new Map,he=Sl(ee,B.environment),je=B.trustedTmpdirValue??xr(ee,B.environment),at=B.allowTmpdirVar??!zo(ee,B.environment),lt=_r({environment:B.environment,protectedGitMetadata:B.protectedGitMetadata,cwd:B.cwd,originalCwd:B.originalCwd,strict:B.strict,allowTmpdirVar:at&&je&&Boolean(he),allowPaths:B.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:B.tmpdirWordSplittingUnsafe??ir(ee,B.environment),trustedTmpdirValue:je,budget:B.budget});return Q.every((ct)=>{let ut=$o(ct);if(ut.unsafeBraceExpansion)return!1;return(ut.expandedTargets??[t(ct)]).every((ft)=>Pf(ft,lt,{containmentTarget:rE(ft,he),targetIsLiteral:ut.expandedTargets!==void 0||ut.targetIsLiteral,tmpdirWordSplittingProtected:ut.tmpdirWordSplittingProtected}))})}function rE(O,D){if(!D)return O;return O.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>D)}function ps(O){let D=(ee)=>{let he=O[ee];return he?t(he):void 0},B=1;while(D(B)==="-H"||D(B)==="-P")B++;if(D(B)==="--")B++;let Q=[];while(B<O.length){let ee=D(B),he=O[B];if(!ee||!he||ee.startsWith("-")||["!","(",")"].includes(ee))break;Q.push(he),B++}return Q.length>0?Q:null}function oE(O,D){let B=rr([...O],D);if(B.length===0)return null;let Q=Tt(B[0]??"");if(Q==="busybox"&&B.length>1)B=B.slice(1),Q=Tt(B[0]??"");if(Q==="rm"&&Dn(B))return St("find.exec-rm-recursive-force",Xv);return null}function Vo(O,D){let B=D+1;while(B<O.length&&O[B]!==";"&&!(O[B]==="+"&&O[B-1]==="{}"))B++;return{tokens:O.slice(D+1,B),nextIndex:Math.min(B+1,O.length)}}function gs(O,D){let B=D;while(B<O.length){let Q=O[B];if(!Q){B++;continue}if(Kn(Q)){B=Vo(O,B).nextIndex;continue}let ee=sr(Q);if(ee>0){B+=ee+1;continue}if(Q==="-delete")return!0;B++}return!1}function sr(O){return Qv.get(O)??(/^-newer[A-Za-z]{2}$/.test(O)?1:0)}function Kn(O){return O!==void 0&&Jv.has(O)}import{resolve as Ox}from"node:path";function*Ml(O){for(let D of O.nodes)yield*sE(D)}function iE(O){return Object.freeze([...Ml(O)])}function st(O){return Object.freeze(iE(O).map((D)=>Object.freeze(D.words.map((B)=>B.text))))}function Ko(O){let D=h(O,"posix");if(D.status!=="complete"||D.nodes.length!==1)return null;let B=D.nodes[0];if(B?.kind!=="command")return null;if(B.redirections.length>0||B.nested.length>0)return null;if(B.words.some((Q)=>Q.provenance==="command-substitution"))return null;return B.words.map((Q)=>Q.text)}function*sE(O){if(O.kind==="command"){yield O;for(let D of O.nested)yield*Ml(D);return}if(O.kind==="group")yield*Ml(O.body)}var aE=5,Dl="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function en(O){let D=O.indexOf("--");if(D===-1)return{index:-1,before:O,after:[]};return{index:D,before:O.slice(0,D),after:O.slice(D+1)}}function Yf(O,D,B){let Q=hs(O,D,B),ee=lE(Q.entries);if(ee.size===0)return{blockedReason:Q.blockedReason,expanded:!1,tokens:O};let he=O,je=!1;for(let at=0;at<aE;at++){let{subcommand:lt,rest:ct}=Sn(he),ut=lt?.toLowerCase();if(!ut||!ee.has(ut))return{blockedReason:Q.blockedReason,expanded:je,tokens:he};let ft=ee.get(ut),dt=mE(ft);if(dt===null||dt.length===0)return{blockedReason:Dl,expanded:!0,tokens:he};he=["git",...dt,...ct],je=!0}return{blockedReason:Dl,expanded:!0,tokens:he}}function Zf(O,D,B){return hs(O,D,B).entries.some((Q)=>Q.key.toLowerCase()==="core.sshcommand")}function Sn(O){if(O.length===0)return{subcommand:null,rest:[]};let D=O[0];if((D?Tt(D).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let Q=1;while(Q<O.length){let ee=O[Q];if(!ee)break;if(ee==="--"){let he=O[Q+1];if(he&&!he.startsWith("-"))return{subcommand:he,rest:O.slice(Q+2)};return{subcommand:null,rest:O.slice(Q+1)}}if(!ee.startsWith("-"))return{subcommand:ee,rest:O.slice(Q+1)};Q+=gn.has(ee)?2:1}return{subcommand:null,rest:[]}}function lE(O){let D=new Map;for(let B of O){let Q=B.key.toLowerCase();if(!Q.startsWith("alias."))continue;let ee=Q.slice(6);if(ee!=="")D.set(ee,B.value)}return D}function hs(O,D,B){if(O.length===0)return{blockedReason:null,entries:[]};let Q=O[0];if((Q?Tt(Q).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let he=uE(D,B);return{blockedReason:he.blockedReason,entries:[...he.entries,...cE(O,D,B)]}}function cE(O,D,B){let Q=[],ee=1;while(ee<O.length){let he=O[ee];if(!he||he==="--"||!he.startsWith("-"))return Q;if(he==="-c"){let je=Nl(O[ee+1]);if(je)Q.push(je);ee+=2;continue}if(he.startsWith("-c")&&he.length>2){let je=Nl(he.slice(2));if(je)Q.push(je);ee++;continue}if(he==="--config-env"){let je=qf(O[ee+1],D,B);if(je)Q.push(je);ee+=2;continue}if(he.startsWith("--config-env=")){let je=qf(he.slice(13),D,B);if(je)Q.push(je);ee++;continue}if(gn.has(he)){ee+=2;continue}ee++}return Q}function uE(O,D){let B=dE(O,D),Q=fE(O,D);return{blockedReason:B===null||Q===null?Dl:null,entries:[...B??[],...Q??[]]}}function dE(O,D){let B=jn("GIT_CONFIG_PARAMETERS",O,D);if(B===void 0)return[];let Q=[],ee=Ko(B);if(!ee)return null;for(let he of ee){let je=Nl(he);if(!je)return null;Q.push(je)}return Q}function fE(O,D){let B=Hd(O,D);if(B.state==="absent")return[];if(B.state==="invalid")return null;let Q=[];for(let ee=0;ee<B.count;ee++){let he=jn(`GIT_CONFIG_KEY_${ee}`,O,D)?.trim(),je=jn(`GIT_CONFIG_VALUE_${ee}`,O,D);if(!he||je===void 0)return null;Q.push({key:he,value:je})}return Q}function Nl(O){if(!O)return null;let D=O.indexOf("=");return{key:(D===-1?O:O.slice(0,D)).trim(),value:D===-1?void 0:O.slice(D+1)}}function qf(O,D,B){let Q=O?.indexOf("=")??-1;if(!O||Q===-1)return null;return{key:O.slice(0,Q).trim(),value:jn(O.slice(Q+1),D,B)}}function mE(O){let D=O?.trimStart();if(!D||D.startsWith("!"))return null;return Ko(D)}var pE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",gE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",hE="git checkout --force discards uncommitted changes. Use 'git stash' first.",yE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",bE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",SE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",CE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",vE="git switch --force discards uncommitted changes. Use 'git stash' first.",EE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",xE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",RE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",_E="git reset --merge can lose uncommitted changes. Use 'git stash' first.",wE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",PE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",AE="git push --force destroys remote history. Use --force-with-lease for safer force push.",TE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",IE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",kE="git branch -D force-deletes without merge check. Use -d for safe delete.",OE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",ME="git merge --abort discards merge conflict resolutions. Use 'git status' first.",DE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",NE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",LE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",WE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",GE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",FE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),zE=new Set(["--recurse-submodules","--track","-t"]),Ll=new Set(["-b","-B","-U"]),Wl=new Set(["-c","-C"]),BE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function It(O,D){let B=O.split("=",1)[0]??O;return B.length>=4&&D.startsWith(B)&&B.startsWith("--")&&B.slice(2).length>=2}var Jr=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Jf(O,D){let{subcommand:B,rest:Q}=Sn(O);if(!B)return null;switch(B.toLowerCase()){case"checkout":return ar($E(Q,D));case"switch":return ar(HE(Q));case"restore":return ar(VE(Q));case"reset":return qE(Q);case"clean":return ar(ZE(Q));case"rm":return ar(XE(Q));case"push":return Ar(JE(Q));case"branch":return Ar(tx(Q));case"stash":return Ar(sx(Q));case"worktree":return Ar(ax(Q));case"rebase":return ar(nx(Q));case"merge":return ar(rx(Q));case"tag":return Ar(ox(Q));case"reflog":return Ar(ix(Q));default:return null}}function ar(O){return O?{...O,localDiscard:!0}:null}function Ar(O){return O?{...O,localDiscard:!1}:null}function $E(O,D){let{index:B,before:Q}=en(O),ee=an(Q,{shortOptsWithValue:Ll});if(Q.some((at)=>It(at,"--force"))||ee.has("-f"))return St("git.checkout-force",hE);for(let at of O){if(at==="-b"||at==="-B"||at==="--orphan")return null;if(It(at,"--pathspec-from-file"))return St("git.checkout-pathspec-from-file",bE)}if(B!==-1){if(Q.some((lt)=>!lt.startsWith("-")))return St("git.checkout-ref-path",yE);return St("git.checkout-double-dash",pE)}let he=jE(O);if(he.length>=2)return St("git.checkout-ambiguous",SE);let je=he[0];if(je===void 0||ee.has("-d")||ee.has("-t")||O.some((at)=>It(at,"--detach")||It(at,"--track")))return null;if(UE(je)||D(je))return St("git.checkout-double-dash",gE);return null}function UE(O){return O==="."||O===".."||/^\.\.?[/\\]/.test(O)||/^([/\\]|[A-Za-z]:[/\\])/.test(O)||O.endsWith("/")||O.startsWith(":")||/[*?[]/.test(O)}function HE(O){let{before:D}=en(O);if(D.some((Q)=>It(Q,"--discard-changes")))return St("git.switch-discard-changes",CE);let B=an(D,{shortOptsWithValue:Wl});if(D.some((Q)=>It(Q,"--force"))||B.has("-f"))return St("git.switch-force",vE);return null}function jE(O){let D=[],B=0;while(B<O.length){let Q=O[B];if(!Q)break;if(Q==="--")break;if(!Q.startsWith("-")){D.push(Q),B++;continue}if(FE.has(Q)){B+=2;continue}if(zE.has(Q)){let ee=O[B+1],he=Q==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];B+=ee&&!ee.startsWith("-")&&he.includes(ee)?2:1;continue}B++}return D}function VE(O){let D=KE(O);if(D.isTerminal||!D.hasPathspec&&!D.hasPatch||!D.hasWorktree)return null;return D.hasExplicitLocation?St("git.restore-worktree",xE):St("git.restore-unstaged",EE)}function KE(O){let D=!1,B=!1,Q=!0,ee=!1,he=(je)=>{if(!ee)Q=!1,ee=!0;if(je!==void 0)Q=je};for(let je=0;je<O.length;je++){let at=O[je];if(at===void 0)break;if(at==="--"){D||=je+1<O.length;break}if(at==="--pathspec-from-file"){D=!0,je++;continue}if(at.startsWith("--pathspec-from-file=")){D=!0;continue}if(at==="-h"||at==="--help"||at==="--version")return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!0};if(at==="--staged"){he();continue}if(at==="--no-staged"){he();continue}if(at==="--worktree"){he(!0);continue}if(at==="--no-worktree"){he(!1);continue}if(at==="--patch"){B=!0;continue}if(at==="--no-patch"){B=!1;continue}if(BE.has(at)){je++;continue}if(at.startsWith("--"))continue;if(at==="-"){D=!0;continue}if(!at.startsWith("-")){D=!0;continue}for(let lt=1;lt<at.length;lt++){let ct=at.charAt(lt);if(ct==="h")return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!0};if(ct==="S"){he();continue}if(ct==="W"){he(!0);continue}if(ct==="p"){B=!0;continue}if(ct==="s"||ct==="U"){if(lt===at.length-1)je++;break}}}return{hasPathspec:D,hasPatch:B,hasWorktree:Q,hasExplicitLocation:ee,isTerminal:!1}}function qE(O){let D=null;for(let B of O){if(It(B,"--hard")){D=St("git.reset-hard",RE);break}if(It(B,"--merge")){D=St("git.reset-merge",_E);break}}if(!D)return null;return YE(O)?Ar(D):ar(D)}function YE(O){for(let D of O){if(D==="--")return!1;if(!D.startsWith("-"))return!0}return!1}function ZE(O){for(let B of O)if(B==="-n"||It(B,"--dry-run"))return null;let D=an(O.filter((B)=>B!=="--"));if(O.some((B)=>It(B,"--force"))||D.has("-f"))return St("git.clean-force",wE);return null}function XE(O){let D=!1,B=!1,Q=!1;for(let ee of en(O).before){if(It(ee,"--no-force")){D=!1;continue}if(It(ee,"--force")){D=!0;continue}if(It(ee,"--no-cached")){B=!1;continue}if(It(ee,"--cached")){B=!0;continue}if(It(ee,"--no-dry-run")){Q=!1;continue}if(It(ee,"--dry-run")){Q=!0;continue}let he=an([ee]);D||=he.has("-f"),Q||=he.has("-n")}return D&&!B&&!Q?St("git.rm-force",PE):null}function JE(O){let{before:D,after:B}=en(O),Q=an(D);if(D.some((je)=>It(je,"--mirror")))return St("git.push-mirror",IE);if(D.some((je)=>It(je,"--force"))||Q.has("-f")||Xf(D,B).some(QE))return St("git.push-force",AE);if(D.some((je)=>It(je,"--delete"))||Q.has("-d")||Xf(D,B).some(ex))return St("git.push-delete",TE);return null}function Xf(O,D){return[...O.filter((B)=>B!==""&&!B.startsWith("-")),...D]}function QE(O){return O.startsWith("+")||O.includes(":+")}function ex(O){return O.length>1&&O.startsWith(":")}function tx(O){let{before:D}=en(O),B=an(D),Q=B.has("-D")||B.has("-d")||D.some((he)=>It(he,"--delete")),ee=B.has("-D")||B.has("-f")||D.some((he)=>It(he,"--force"));if(Q&&ee)return St("git.branch-force-delete",kE);return null}function nx(O){let{before:D}=en(O);return D.some((B)=>It(B,"--abort"))?St("git.rebase-abort",OE):null}function rx(O){let{before:D}=en(O);return D.some((B)=>It(B,"--abort"))?St("git.merge-abort",ME):null}function ox(O){let{before:D}=en(O);return an(D).has("-d")||D.some((Q)=>It(Q,"--delete"))?St("git.tag-delete",DE):null}function ix(O){return O[0]==="delete"?St("git.reflog-delete",NE):null}function sx(O){for(let D of O){if(D==="drop")return St("git.stash-drop",LE);if(D==="clear")return St("git.stash-clear",WE)}return null}function ax(O){let{before:D}=en(O);if(!D.includes("remove"))return null;let Q=an(D);if(D.some((ee)=>It(ee,"--force"))||Q.has("-f"))return St("git.worktree-remove-force",GE);return null}import{dirname as Px,isAbsolute as Ax,join as mm,resolve as Tx}from"node:path";var Fl="TMPDIR",zl="IFS",em=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,tm=/^[A-Za-z_][A-Za-z0-9_]*$/,nm=new Set(["export","typeset","declare","readonly"]),lx=new Set(["builtin","command","time"]),rm=new Set(["do","then","else"]),cx=new Set(["do","then","case"]),Qf=new Set(["done","fi","esac"]),ux=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function om(O,D){return O.map((B)=>B.provenance==="variable"&&um(B.text)?qo(B.text,D.shellAssignments):t(B))}function qo(O,D){return O.replace(ux,(B,Q,ee)=>D.get(Q??ee??"")??B)}function im(O,D){return{env:O,effectiveEnvAssignments:px(O,D),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function sm(O){return{env:O.env,effectiveEnvAssignments:O.effectiveEnvAssignments?new Map(O.effectiveEnvAssignments):void 0,shellAssignments:new Map(O.shellAssignments),bodyDepth:O.bodyDepth,bodyAssignments:new Set(O.bodyAssignments)}}function Bl(O,D){let B=lm(O,D),Q=O[0]??"";if(cx.has(Q))D.bodyDepth+=1;if(Q==="elif"||Qf.has(Q))D.bodyDepth=Math.max(0,D.bodyDepth-1);if(Qf.has(Q)&&D.bodyDepth===0)D.bodyAssignments.forEach((at)=>{D.shellAssignments.delete(at)}),D.bodyAssignments.clear();B.assignments.filter((at)=>at.persists).forEach((at)=>{if(D.shellAssignments.set(at.name,at.value),D.bodyDepth>0)D.bodyAssignments.add(at.name);$l(D,at)});let ee=B.commandIndex;if(ee!==-1&&nm.has(O[ee]??""))O.filter((at)=>tm.test(at)&&Gl(at)).forEach((at)=>{gx(D,at)});let he=ee===-1?-1:cm(O,ee);if(he===-1||O[he]!=="unset")return;let je=yx(O,he);if(je===null)return;O.slice(je).forEach((at)=>{if(rm.has(Q)){D.shellAssignments.set(at,"");return}hx(D,at)})}function am(O,D){let B=lm(O,D).assignments;if(B.length===0)return D.effectiveEnvAssignments;let Q=new Map(D.effectiveEnvAssignments??[]);return B.forEach((ee)=>{Q.set(ee.name,ee.value)}),Q}function lm(O,D){let B=rm.has(O[0]??"")?1:0,Q=O.findIndex((at,lt)=>lt>=B&&!um(at)),ee=Q!==-1&&nm.has(O[cm(O,Q)]??""),he=mx(D);return{assignments:O.flatMap((at,lt)=>{let ct=dx(at,he,D.env);if(!ct)return[];if(Q!==-1&&lt>Q&&!ee&&!Ki(ct.name))return[];return he.set(ct.name,ct.value),[{...ct,persists:Q===-1||ee}]}),commandIndex:Q}}function cm(O,D){let B=D;while(lx.has(O[B]??"")){B+=1;while(O[B]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(O[B]??""))return D;B+=1}}return B}function um(O){return Rn(O)!==null||em.test(O)}function dx(O,D,B){return Rn(O)??fx(O,D,B)}function fx(O,D,B){let Q=qi(O,B,D);if(Q)return Q;let ee=O.match(em)?.[1];if(!ee)return null;let he=O.indexOf("=");return{name:ee,value:`${D.has(ee)?D.get(ee):B.get(ee)??""}${O.slice(he+1)}`}}function Gl(O){return O===Fl||O===zl||dl(O)}function mx(O){return new Map([...O.effectiveEnvAssignments??[],...O.shellAssignments])}function px(O,D){let B=[Fl,zl].map((Q)=>{let ee=O.get(Q);return ee===void 0?null:[Q,ee]}).filter((Q)=>Q!==null);if(B.length===0)return D;return new Map([...B,...D??[]])}function $l(O,D){let B=new Map(O.effectiveEnvAssignments??[]);B.set(D.name,D.value),O.effectiveEnvAssignments=B}function gx(O,D){$l(O,{name:D,value:O.shellAssignments.get(D)??O.effectiveEnvAssignments?.get(D)??O.env.get(D)??""})}function hx(O,D){if(!Gl(D)&&!tm.test(D))return;if(O.shellAssignments.set(D,""),Ki(D)&&O.env.has(D)){let Q=new Map(O.env);Q.delete(D),O.env=Q}if(!Gl(D)||D===Fl||D===zl||mo(D)){$l(O,{name:D,value:""});return}if(!O.effectiveEnvAssignments?.has(D))return;let B=new Map(O.effectiveEnvAssignments);B.delete(D),O.effectiveEnvAssignments=B.size===0?void 0:B}function yx(O,D){let B=D+1;while(B<O.length){let Q=O[B];if(!Q)return null;if(Q==="--")return B+1;if(Q==="-v"){B++;continue}if(Q.startsWith("-"))return null;return B}return B}import{resolve as bx}from"node:path";function ys(O,D){return ul.some((B)=>D?.has(B)||O.has(B))}function Qr(O,D,B){if(!D)return{gitCwd:null,hasExplicitGitContext:!1};let Q=B.realpath(bx(D));if(Q===null||!B.isDirectory(Q))return{gitCwd:null,hasExplicitGitContext:!1};let ee=Q,he=!1,je=1;while(je<O.length){let at=O[je];if(!at)break;if(at==="--")break;if(!at.startsWith("-"))break;if(at==="-C"){let lt=O[je+1];if(!lt)return{gitCwd:null,hasExplicitGitContext:he};let ct=dm(ee,lt,B);if(!ct)return{gitCwd:null,hasExplicitGitContext:he};ee=ct,je+=2;continue}if(at.startsWith("-C")&&at.length>2){let lt=dm(ee,at.slice(2),B);if(!lt)return{gitCwd:null,hasExplicitGitContext:he};ee=lt,je++;continue}if(at==="--git-dir"||at==="--work-tree"){he=!0,je+=2;continue}if(at.startsWith("--git-dir=")||at.startsWith("--work-tree=")){he=!0,je++;continue}je+=gn.has(at)?2:1}return{gitCwd:ee,hasExplicitGitContext:he}}function dm(O,D,B){try{let Q=nr(O,D,B);return B.isDirectory(Q)?Q:null}catch{return null}}function fm(O,D,B){if(!D.localDiscard||!B.worktreeMode||ys(B.environment.env,B.envAssignments))return null;let Q=Qr(O,B.cwd,B.environment.paths);if(!Q.gitCwd||Q.hasExplicitGitContext)return null;let ee=B.environment.worktreeFacts(Q.gitCwd);if(!ee)return null;if(Ul(O,B,ee))return null;return{kind:"worktree",originalReason:D.reason,gitCwd:Q.gitCwd}}function Ul(O,D,B){let{subcommand:Q,rest:ee}=Sn(O),he=Q?.toLowerCase();if(D.dynamicArguments||Sx(ee)||Rx(O,D.environment.env,D.envAssignments,B)||Ex(ee)||Cx(he,ee))return!0;return he==="clean"&&xx(ee)>1}function Sx(O){return O.some((D)=>/[$*?[]/.test(D))}function Cx(O,D){if(O==="checkout"){let{before:B}=en(D),Q=an(B,{shortOptsWithValue:Ll}),ee=B.some((je)=>It(je,"--force"))||Q.has("-f"),he=Q.has("-B")||B.some((je)=>je==="-B"||je.startsWith("-B"));return ee&&he}if(O==="switch"){let{before:B}=en(D),Q=an(B,{shortOptsWithValue:Wl}),ee=B.some((je)=>It(je,"--force"))||B.some((je)=>It(je,"--discard-changes"))||Q.has("-f"),he=B.some((je)=>je==="-C"||je.startsWith("-C")||vx(je))||Q.has("-C");return ee&&he}return!1}function vx(O){let D=O.split("=",1)[0]??O;return D==="--force-create"||D.length>=9&&"--force-create".startsWith(D)}function Ex(O){return O.some((D)=>D.startsWith("--recurse-sub"))}function xx(O){let D=0;for(let B of O){if(B==="--force"){D++;continue}if(B.startsWith("-")&&!B.startsWith("--")){for(let Q of B.slice(1))if(Q==="f")D++}}return D}function Rx(O,D,B,Q){if(jn("GIT_CONFIG_PARAMETERS",D,B)!==void 0)return!0;let ee=hs(O,D,B);if(ee.blockedReason!==null)return!0;let he=ee.entries.map((at)=>({key:at.key.toLowerCase(),value:at.value}));if(he.some((at)=>wx(at.key)))return!0;let je=he.filter((at)=>at.key==="submodule.recurse").at(-1);if(je)return je.value===void 0||_x(je.value);if(Vd(B))return!0;return Q.recursiveSubmodules}function _x(O){let D=O.toLowerCase();return D!=="false"&&D!=="no"&&D!=="off"&&D!=="0"}function wx(O){return O==="include.path"||O.startsWith("includeif.")&&O.endsWith(".path")}function pm(O,D,B){let Q=O.map(t),ee=B.environment.paths,he=Qr(Q,B.cwd,ee),je=B.originalCwd?ee.realpath(Tx(B.originalCwd)):null;if(D.id.startsWith("git.push-")||je===null||he.gitCwd===null||he.hasExplicitGitContext||ys(B.environment.env,B.envAssignments))return null;let at=D.id==="git.worktree-remove-force"?kx(O,B.shellAssignments,ee):gm(he.gitCwd,ee);if(at===null||D.id!=="git.worktree-remove-force"&&!Ix(at,Q,D,B)||!Zr(at,B.environment)||ss(at,B.environment)||as(je,at)||as(at,je))return null;return{kind:"temp-root",originalReason:D.reason,gitCwd:he.gitCwd}}function Ix(O,D,B,Q){let ee=Q.environment.paths,he=mm(O,".git");if(ee.entryKind(he)!=="present")return!1;if(ee.isDirectory(he))return!0;let je=B.localDiscard?Q.environment.worktreeFacts(O):null;return je!==null&&!Ul(D,Q,je)}function kx(O,D,B){let Q=Sn(O.map(t)).rest,{before:ee,after:he}=en(Q.slice(Q.indexOf("remove")+1)),je=[...ee.filter((ut)=>!ut.startsWith("-")),...he],at=je.length===1?je[0]??"":"",lt=O.find((ut)=>ut.text===at),ct=lt?.provenance==="variable"&&lt.parts.every((ut)=>ut.provenance!=="literal"||!/[$`]/.test(ut.raw))?qo(at,D??new Map):at;if(!Ax(ct)||/[\s$`*?[]/.test(ct)||B.entryKind(ct)!=="present"||!B.isDirectory(ct))return null;return B.realpath(ct)}function gm(O,D){if(D.entryKind(mm(O,".git"))!=="missing")return O;let B=Px(O);return B===O?null:gm(B,D)}var Mx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Dx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function bs(O,D){return hm(O,D)}function hm(O,D,B){let Q=O.map(t),ee=Yf(Q,D.environment.env,D.envAssignments),he=ee.blockedReason?wt(St("git.alias-config",ee.blockedReason),D.policy):null;if(he)return he;let je=ee.tokens;if((jd(D.envAssignments)||Zf(Q,D.environment.env,D.envAssignments))&&Nx(je))return St("git.ssh-env",Mx);let at=Jf(je,(ct)=>{let ut=Qr(Q,D.cwd,D.environment.paths).gitCwd;return ut!==null&&D.environment.paths.entryKind(Ox(ut,ct))!=="missing"});if(!at)return null;if(ee.expanded||ee.blockedReason)return at;let lt=fm(Q,at,D)??pm(O,at,D);if(!lt)return at;return B?.(lt),null}function ym(O,D){let B=null;return{match:hm(O,D,(ee)=>{B=ee}),relaxation:B}}function Nx(O){let{subcommand:D,rest:B}=Sn(O),Q=D?.toLowerCase();if(!Q)return!1;if(Dx.has(Q))return!0;if(Q==="archive")return en(B).before.some((ee)=>It(ee,"--remote"));return Q==="remote"&&Lx(B)}function Lx(O){return O.find((D)=>!Wx(D))?.toLowerCase()==="update"}function Wx(O){return O==="-v"||It(O,"--verbose")||It(O,"--no-verbose")}import{isAbsolute as bR}from"node:path";function bm(O,D,B,Q){let ee=O.slice(0,D),he=O.slice(D+B);return Q.startsWith(ee)&&Q.endsWith(he)?Q.slice(ee.length,Q.length-he.length):null}function Ss(O,D,B){let Q=(he)=>`${he.tokenIndex}\x00${he.kind}\x00${he.value}`,ee=new Set(O.map(Q));return Array.from(D).some((he)=>B(he).some((je)=>!ee.has(Q(je))))}var Sm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Gx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Fx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",vm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",zx="rm -rf in home directory is dangerous. Change to a project directory first.",Cm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:vm},git_metadata_target:{id:"rm.git-metadata",reason:x},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Fx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:zx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Sm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Gx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Sm}};function Cs(O,D){let B=_r({...D,allowPaths:D.policy?.destructiveCommandAllowPaths,posixShell:!0}),Q=O.map(t),ee=Dn(Q),he=Vf(Q),je=$x(O);for(let at of je){let lt=$o(at.word);if(ee&&lt.unsafeBraceExpansion){let ct=wt(Bo({kind:"outside_anchored_cwd"},B,D.policy,Cm),D.policy);if(ct)return ct;continue}for(let ct of lt.expandedTargets??[at.text]){let ut=pn(ct),ft={targetIsLiteral:lt.expandedTargets!==void 0||lt.targetIsLiteral,tmpdirWordSplittingProtected:lt.tmpdirWordSplittingProtected};if(!he&&B.resolvedCwd&&Er(ut,B.resolvedCwd,B.protectedGitMetadata,he,B.environment,B.budget))return St("rm.git-metadata",x);if(he&&!ee){let dt=On(ut,B,ft);if(dt.kind==="root_or_home_target")return St("rm.recursive-force-root-or-home",vm);if(dt.kind==="git_metadata_target")return St("rm.git-metadata",x);continue}if(!ee)continue;for(let dt of Bx(ut,B,ft)){let mt=Bo(dt,B,D.policy,Cm),pt=wt(mt,D.policy);if(pt)return pt}}}return null}function Bx(O,D,B){let Q=On(O,D,B);if(Q.kind==="cwd_self_target")return[Q,On(O,D,{...B,skipCwdSelf:!0})];if(Q.kind!=="home_cwd_target")return[Q];let ee=On(O,D,{...B,skipHomeCwd:!0});if(ee.kind!=="cwd_self_target")return[Q,ee];return[Q,ee,On(O,D,{...B,skipHomeCwd:!0,skipCwdSelf:!0})]}function $x(O){let D=[],B=!1;for(let Q of O.slice(1)){let ee=t(Q);if(!ee)continue;if(ee==="--"){B=!0;continue}if(B){D.push({text:ee,word:Q});continue}if(!ee.startsWith("-"))D.push({text:ee,word:Q})}return D}var lr={kind:"none"},Tr={kind:"dynamic"},Ux=new Set(["<","<<","<<-","<<<","<&","<>"]),xm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Hx=/^(?:[0-9]+|[@*])$/,jx=tr.maxWords,Vx=tr.maxInputLength;function Rm(O){if(!O||Tt(kt(O.words[0]?.text??""))!=="printf")return;if(O.words.some((ee)=>ee.provenance!=="literal"))return;let D=O.words.slice(O.words[1]?.text==="--"?2:1),B=D[0]?.text;if(B===void 0)return"";let Q=D.slice(1).map((ee)=>ee.text);if(B==="%s")return Q.join("");if(B==="%s\\n"||B===`%s
 `)return`${Q.join(`
 `)}
 `;if(B.includes("%")||/\\(?![\\nrt])/.test(B))return;return B.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Cs(O){let D=Yo(O[1])==="--"?2:1;if(O.length<=D)return lr;let B=O.slice(D);if(!B.every(Es))return Tr;return{kind:"literal",source:B.map(t).join(" ")}}function xm(O){let D=Yo(O[1])==="--"?2:1,B=O[D],Q=Yo(B);if(B===void 0||O.length<=D+1||Q==="-"||Q===""||Q==="-l"||Q==="-p")return lr;if(!Es(B))return Tr;return{kind:"literal",source:Q}}function vs(O,D){let B=Vx(O);if(B===-1)return lr;let Q=Kx(D);if(!Q)return lr;let ee=[],he=Q.command?.length??0;for(let je of Q.references){let at=Yx(je,O,B,Q.ifs);if(!at)return Tr;if(he+=at.reduce((lt,ct)=>lt+ct.length+3,0),ee.length+at.length>Ux||he>Hx)return Tr;ee.push(...at)}if(Q.command==="eval")return{kind:"literal",source:ee.join(" ")};if(ee.length===0||/\s/.test(ee[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[Q.command,Q.command&&Q.optionTerminator?"--":null,...ee.map(Xx)].filter((je)=>je!==null).join(" ")}}function Rm(O,D,B,Q){if(!hn(O.map(t)).readsStdinAsCommands)return lr;let ee=D.filter((he)=>(he.fd===void 0||he.fd===0)&&Bx.has(he.operator)).at(-1);if(ee){if(ee.operator==="<<"||ee.operator==="<<-")return lr;if(ee.operator!=="<<<"||ee.target?.provenance!=="literal")return Tr;return{kind:"literal",source:ee.target.text}}if(!B)return lr;return Q===void 0?Tr:{kind:"literal",source:Q}}function qn(O){let D=hn(O.map(t)).scriptIndex;if(D===null)return lr;let B=O[D],Q=Yo(B);return zi(B,Q)?{kind:"literal",source:Q}:Tr}var jx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function jl(O){if(O.words.length!==2||O.redirections.length!==0||O.nested.length!==1)return!1;let D=O.words[0],B=O.words[1];if(!D||D.provenance!=="literal"||D.quoted||D.raw!==D.text||!B)return!1;if(!(D.text==="eval"&&B.quoted&&B.parts.length===3&&B.parts[0]?.raw==='"'&&B.parts[1]?.provenance==="command-substitution"&&B.parts[1].raw.startsWith("$(")&&B.parts[2]?.raw==='"'||D.text==="eval"&&!B.quoted&&B.parts.length===1&&B.parts[0]?.provenance==="command-substitution"&&B.parts[0].raw.startsWith("$(")||(D.text==="source"||D.text===".")&&!B.quoted&&B.parts.length===1&&B.parts[0]?.provenance==="command-substitution"&&B.parts[0].raw.startsWith("<(")))return!1;let ee=O.nested[0];if(ee?.status!=="complete"||ee.nodes.length!==1)return!1;let he=ee.nodes[0];if(he?.kind!=="command"||he.redirections.length!==0||he.nested.length!==0||he.words.some((lt)=>lt.provenance!=="literal"||lt.parts.some((ct)=>ct.provenance!=="literal")))return!1;let je=he.words[0]?.text;if(je===void 0||Rn(je)!==null)return!1;let at=Tt(kt(je));return!jx.has(at)&&!Kt.has(at)&&!wr(at)}function Vx(O){return hn(O.map(t)).commandIndex??-1}function Kx(O){let D=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(O.trim()),B=D?.[4]??O.trim(),Q=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(B),ee=(Q?.[3]??B).split(/\s+/).map(qx);if(ee.length===0||ee.some((he)=>he===null))return null;return{command:Q?.[1]??null,optionTerminator:Q?.[2]!==void 0,references:ee.filter((he)=>!!he),ifs:D?D[1]??D[2]??D[3]??"":` 	
-`}}function qx(O){let D=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(O),B=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(O),Q=D??B;if(!Q)return null;let ee=Q[1]??Q[2];return{parameter:ee==="@"||ee==="*"?ee:Number(ee),quoted:D!==null}}function Yx(O,D,B,Q){let ee=D.slice(B+2);if(O.parameter==="@")return O.quoted?$l(ee):Zx(ee,Q);if(O.parameter==="*"){let at=$l(ee);if(!at)return;let lt=at.join(Q[0]??"");return O.quoted?[lt]:Ul(lt,Q)}let he=D[B+1+O.parameter];if(he&&!Es(he))return;let je=Yo(he);return O.quoted?[je]:Ul(je,Q)}function $l(O){return O.every(Es)?O.map(t):void 0}function Zx(O,D){let B=$l(O);if(!B)return;let Q=B.map((ee)=>Ul(ee,D));return Q.some((ee)=>ee===void 0)?void 0:Q.flatMap((ee)=>ee??[])}function Ul(O,D){if(["*","?","[","]"].some((B)=>O.includes(B)))return;if(D==="")return O===""?[]:[O];if(D===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function vs(O){let D=Yo(O[1])==="--"?2:1;if(O.length<=D)return lr;let B=O.slice(D);if(!B.every(xs))return Tr;return{kind:"literal",source:B.map(t).join(" ")}}function _m(O){let D=Yo(O[1])==="--"?2:1,B=O[D],Q=Yo(B);if(B===void 0||O.length<=D+1||Q==="-"||Q===""||Q==="-l"||Q==="-p")return lr;if(!xs(B))return Tr;return{kind:"literal",source:Q}}function Es(O,D){let B=qx(O);if(B===-1)return lr;let Q=Yx(D);if(!Q)return lr;let ee=[],he=Q.command?.length??0;for(let je of Q.references){let at=Xx(je,O,B,Q.ifs);if(!at)return Tr;if(he+=at.reduce((lt,ct)=>lt+ct.length+3,0),ee.length+at.length>jx||he>Vx)return Tr;ee.push(...at)}if(Q.command==="eval")return{kind:"literal",source:ee.join(" ")};if(ee.length===0||/\s/.test(ee[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[Q.command,Q.command&&Q.optionTerminator?"--":null,...ee.map(Qx)].filter((je)=>je!==null).join(" ")}}function wm(O,D,B,Q){if(!hn(O.map(t)).readsStdinAsCommands)return lr;let ee=D.filter((he)=>(he.fd===void 0||he.fd===0)&&Ux.has(he.operator)).at(-1);if(ee){if(ee.operator==="<<"||ee.operator==="<<-")return lr;if(ee.operator!=="<<<"||ee.target?.provenance!=="literal")return Tr;return{kind:"literal",source:ee.target.text}}if(!B)return lr;return Q===void 0?Tr:{kind:"literal",source:Q}}function qn(O){let D=hn(O.map(t)).scriptIndex;if(D===null)return lr;let B=O[D],Q=Yo(B);return Bi(B,Q)?{kind:"literal",source:Q}:Tr}var Kx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Kl(O){if(O.words.length!==2||O.redirections.length!==0||O.nested.length!==1)return!1;let D=O.words[0],B=O.words[1];if(!D||D.provenance!=="literal"||D.quoted||D.raw!==D.text||!B)return!1;if(!(D.text==="eval"&&B.quoted&&B.parts.length===3&&B.parts[0]?.raw==='"'&&B.parts[1]?.provenance==="command-substitution"&&B.parts[1].raw.startsWith("$(")&&B.parts[2]?.raw==='"'||D.text==="eval"&&!B.quoted&&B.parts.length===1&&B.parts[0]?.provenance==="command-substitution"&&B.parts[0].raw.startsWith("$(")||(D.text==="source"||D.text===".")&&!B.quoted&&B.parts.length===1&&B.parts[0]?.provenance==="command-substitution"&&B.parts[0].raw.startsWith("<(")))return!1;let ee=O.nested[0];if(ee?.status!=="complete"||ee.nodes.length!==1)return!1;let he=ee.nodes[0];if(he?.kind!=="command"||he.redirections.length!==0||he.nested.length!==0||he.words.some((lt)=>lt.provenance!=="literal"||lt.parts.some((ct)=>ct.provenance!=="literal")))return!1;let je=he.words[0]?.text;if(je===void 0||Rn(je)!==null)return!1;let at=Tt(kt(je));return!Kx.has(at)&&!Kt.has(at)&&!wr(at)}function qx(O){return hn(O.map(t)).commandIndex??-1}function Yx(O){let D=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(O.trim()),B=D?.[4]??O.trim(),Q=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(B),ee=(Q?.[3]??B).split(/\s+/).map(Zx);if(ee.length===0||ee.some((he)=>he===null))return null;return{command:Q?.[1]??null,optionTerminator:Q?.[2]!==void 0,references:ee.filter((he)=>!!he),ifs:D?D[1]??D[2]??D[3]??"":` 	
+`}}function Zx(O){let D=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(O),B=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(O),Q=D??B;if(!Q)return null;let ee=Q[1]??Q[2];return{parameter:ee==="@"||ee==="*"?ee:Number(ee),quoted:D!==null}}function Xx(O,D,B,Q){let ee=D.slice(B+2);if(O.parameter==="@")return O.quoted?Hl(ee):Jx(ee,Q);if(O.parameter==="*"){let at=Hl(ee);if(!at)return;let lt=at.join(Q[0]??"");return O.quoted?[lt]:jl(lt,Q)}let he=D[B+1+O.parameter];if(he&&!xs(he))return;let je=Yo(he);return O.quoted?[je]:jl(je,Q)}function Hl(O){return O.every(xs)?O.map(t):void 0}function Jx(O,D){let B=Hl(O);if(!B)return;let Q=B.map((ee)=>jl(ee,D));return Q.some((ee)=>ee===void 0)?void 0:Q.flatMap((ee)=>ee??[])}function jl(O,D){if(["*","?","[","]"].some((B)=>O.includes(B)))return;if(D==="")return O===""?[]:[O];if(D===` 	
 `)return O.trim().split(/\s+/).filter(Boolean);if(D.length!==1)return;return D===" "||D==="\t"||D===`
-`?O.trim().split(/\s+/).filter(Boolean):O.split(D).filter(Boolean)}function Es(O){if(!O)return!0;return O.provenance==="unknown"?!/[$`]/.test(t(O)):O.provenance==="literal"}function Yo(O){return O?t(O):""}function Xx(O){return`'${O.replaceAll("'",`'"'"'`)}'`}function Vl(O,D){return Hl(h(O,"posix"),D)}function Xo(O){return Vl(O,new Set(Array.from(O.matchAll(vm)).flatMap((D)=>{let B=D[1]??D[2];return B===void 0?[]:[B]})))}function Hl(O,D){if(O.status==="invalid"||O.status==="limited")return!1;let B=new Set(D);for(let Q of O.nodes){if(Q.kind==="group"){if(Hl(Q.body,B))return!0;continue}if(Q.kind!=="command")continue;if(Q.nested.some((ee)=>Hl(ee,B))||_m(Q.words,B))return!0;nR(Q,B)}return!1}function _m(O,D){let B=O.findIndex((je)=>Rn(je.text)===null);if(B===-1)return!1;let Q=O[B];if(!Q)return!1;if(Zo(Q,D))return!0;let ee=kt(Q.text);if(ee==="source"||ee==="."){let je=O[B+1]?.text==="--"?B+2:B+1;return Cm(O[je],D)}if(Kt.has(ee)){let je=O.slice(B),at=hn(je.map((ct)=>ct.text)),lt=at.commandIndex??at.scriptIndex;return!at.syntaxCheck&&lt!==null&&Cm(je[lt],D)}let he=Jx(O,B,D);if(he===null)return!1;if(he===-1)return!0;return _m(O.slice(he),D)}function Jx(O,D,B){let Q=kt(O[D]?.text??"");if(Q==="command")return Qx(O,D+1);if(Q==="exec")return eR(O,D+1);if(Q==="env")return tR(O,D+1,B);return null}function Qx(O,D){for(let B=D;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return O[B+1]?B+1:null;if(/^-[p]*[vV][pvV]*$/.test(Q))return null;if(/^-p+$/.test(Q))continue;return B}return null}function eR(O,D){for(let B=D;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return O[B+1]?B+1:null;if(Q==="-a"){B++;continue}if(/^-a.+/.test(Q)||/^-[cl]+$/.test(Q))continue;return B}return null}function tR(O,D,B){for(let Q=D;Q<O.length;Q++){let ee=O[Q],he=ee?.text??"";if(he==="--")return O[Q+1]?Q+1:null;if(he==="-S"||he==="--split-string")return Zo(O[Q+1],B)?-1:Q+2;if(he.startsWith("-S")||he.startsWith("--split-string="))return Zo(ee,B)?-1:Q+1;if(he==="-u"||he==="--unset"||he==="-C"||he==="--chdir"||he==="-P"){Q++;continue}if(he==="-i"||he==="-0"||he==="--null"||he.startsWith("-u=")||he.startsWith("--unset=")||he.startsWith("-C")||he.startsWith("--chdir=")||he.startsWith("-P"))continue;if(he.startsWith("-"))continue;if(Rn(he))continue;return Q}return null}function nR(O,D){if(!O.words.every((B)=>Rn(B.text)!==null))return;for(let B of O.words){let Q=Rn(B.text);if(!Q)continue;if(Zo(B,D))D.add(Q.name)}}function Zo(O,D){if(!O)return!1;return O.parts.filter((B)=>B.provenance==="variable").some((B)=>Array.from(B.raw.matchAll(vm)).some((Q)=>{let ee=Q[1]??Q[2];return ee!==void 0&&($x.test(ee)||D.has(ee))}))}function Cm(O,D){return!!O&&(O.parts.some((B)=>B.provenance!=="literal"&&B.provenance!=="variable")||Zo(O,D))}var rR=["--init-file","--rcfile"],oR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Yn(O){for(let D=1;D<O.length;D++){let B=O[D];if(!B)continue;if(B==="-c")return wm(O,D,!0);if(B.startsWith("-")&&B.includes("c")&&!B.startsWith("--")){let Q=wm(O,D,!1);if(Q!==null)return Q}}return null}function Zn(O){let D=Tt(O[0]??"").toLowerCase();if(D==="zsh"||D==="ksh")return hn(O).syntaxCheck;let B=!1;for(let Q of O.slice(1)){if(Q==="--")return B;if(Q.startsWith("+")&&!Q.startsWith("++")){if(Q.slice(1).includes("n"))B=!1;continue}if(!Q.startsWith("-")||Q.startsWith("--"))return B;let ee=Q.slice(1);if(ee.includes("n"))B=!0;if(ee.includes("c"))return B}return B}function wm(O,D,B){if(O[D+1]==="--")return O[D+2]||null;let Q=O[D+1];if(!Q||!B&&Q.startsWith("-"))return null;return Q}function Pm(O){let D=Tt(O[0]??"").toLowerCase(),B=iR(O,D),Q=oR.get(D)??null,ee=B.argvSource?.kind!=="absent";return{argvSource:D==="bash"?B.argvSource:null,argvSourceApplies:D==="bash"&&B.interactive&&B.argvSource?.kind==="literal",envName:Q,envSourceApplies:ee&&(Q==="BASH_ENV"?!B.interactive:Q==="ENV"&&B.interactive)}}function iR(O,D){let B=hn(O),Q=B.commandIndex??B.scriptIndex??O.length,ee=[],he=!1,je=!0;for(let at=1;at<Q;at++){let lt=O[at];if(lt===void 0||lt==="--"||lt==="-"||lt[0]!=="-"&&lt[0]!=="+")break;if(lt.startsWith("--")){if(D==="bash"&&je?rR.find((dt)=>lt===dt):void 0){let dt=O[at+1];ee.push(dt===void 0?{kind:"absent"}:{kind:"literal",value:dt}),at++;continue}let ft=lt.split("=",1)[0]??lt;if(D==="bash"&&pa.has(ft)&&!lt.includes("="))at++;continue}if(D==="bash")je=!1;let ct=ga(D,lt,O[at+1],"startup");if(ct.interactive)he=lt[0]==="-";at+=ct.followingValues}return{argvSource:ee.at(-1)??null,interactive:he}}var Kl="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ql="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",sR="__CC_SAFETY_NET_XARGS_INPUT__",xs="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Rs="rm",aR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,lR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,cR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,uR=/^(?:[0-9]+|[@*])$/;function Im(O,D){let B=O.map(t),{childStart:Q,replacementToken:ee}=Ir(B),he=B.slice(Q),je=St("xargs.shell-dynamic",ql);if(fR(he,ee,D)&&wt(je,D.policy))return wt(je,D.policy);for(let at of Mn(he,D)){let lt=at.tokens,ct=ee!==null&&lt[0]!==he[0]&&(lt[0]?.includes(ee)??!1)?wt(je,D.policy):null;if(ct)return ct;let ut=Lm(lt,ee,at.wrapperEnvAssignments),ft=at.head==="rm"&&ee!==null&&Dm(lt,ee),dt=D.analyzeChild(lt,{...Pr(at,D),dynamicInput:ut,dynamicSourceInput:ft||Om(lt,at.head,ee,at.wrapperEnvAssignments,ut,D.environment,D.strict?void 0:D.analyzeNested),dynamicRmInput:ft,shellDynamicMatch:je,dynamicSourceMatch:je,rmDynamicMatch:St("xargs.rm-recursive-force-dynamic",Kl)});if(dt)return dt;let mt=dR(lt,ee,D.policy?.rules??[],wt(je,D.policy));if(mt)return mt;if(at.head==="git"){let gt=ee===null?[...lt,sR]:lt,ht=ee!==null&&(lt.some((Ct)=>Ct.includes(ee))||Array.from(at.envAssignments.values()).some((Ct)=>Ct.includes(ee))),yt=D.analyzeChild(gt,{...Pr(at,D),worktreeMode:ee===null||ht?!1:D.worktreeMode});if(yt)return yt}let pt=_(lt,D.policy?.rules??[]);if(pt)return pt}return null}function dR(O,D,B,Q){if(B.length===0)return null;if(D===null){for(let he of B){let je=_([...O,...he.subcommand?[he.subcommand]:[],...he.block_args],B);if(je)return je}return null}let ee=kt(O[0]??"");if(!B.some((he)=>kt(he.command)===ee))return null;return O.slice(1).some((he)=>he.includes(D))?Q:null}function km(O,D,B){let Q=O.indexOf(D);if(Q===-1||O.indexOf(D,Q+D.length)!==-1)return[];let ee=hm(O,Q,D.length,B);return ee===null?[]:[ee]}function Om(O,D,B,Q,ee,he,je){if(Kt.has(D)){if(Zn(O))return!1;if(B!==null&&mR(O,B,je))return!0;let at=Yn(O);if(!at){let lt=qn($t(O));if(lt.kind==="literal")return B!==null&&lt.source.includes(B);return lt.kind==="none"&&ee}if(B!==null&&at.includes(B)&&!Mm(at,B,je))return!0;if(xn(at))return!0;return pR(at,B,Q)}if(An(D))return Am(O,B,ji,Gd(D));if(En.has(D))return Am(O,B,_l,Ff);if(D==="eval"){let at=Cs($t(O));if(at.kind==="dynamic")return!0;if(B!==null)return at.kind==="literal"&&at.source.includes(B);return ee}if(D==="find")return gR(O,B,he);if(D==="git"){let at=Sn(O);return B===null?at.subcommand===null:(at.subcommand?.includes(B)??!1)||at.subcommand!==null&&Jr.has(at.subcommand.toLowerCase())&&Nm(at.rest,B).some((lt)=>lt.includes(B))}return!1}function Mm(O,D,B){if(B===void 0)return!1;let Q=D.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${Q}`).test(O)||/\bcase\b/.test(O))return!1;let he=O.replaceAll(D,"/");return xn(he)===null&&B(he)===null}function Am(O,D,B,Q){let ee=B(O);if(D===null)return ee.optionsOpen||B([...O,xs]).sources.some((at)=>at.value===xs);if(ee.sources.some((at)=>at.value.includes(D)))return!0;let he=Q.flatMap((at)=>[at.selector,...at.valueForm==="attached-only"||at.valueForm==="attached-or-separate"?[`${at.selector}${xs}`]:[],...at.valueForm==="equals-or-separate"?[`${at.selector}=${xs}`]:[]]),je=new Set(he.flatMap((at)=>O.flatMap((lt)=>km(lt,D,at))));return bs(ee.sources,je,(at)=>B(O.map((lt)=>lt.replaceAll(D,at))).sources)}function fR(O,D,B){if(O.length===0||(O[0]??"").toLowerCase()==="command")return!1;let Q=new Set(Array.from(Mn(O,B),(he)=>he.head)),ee=D===null?[...O,Rs]:O.map((he,je)=>je===0?he:he.replaceAll(D,Rs));return Array.from(Mn(ee,B)).some((he)=>he.head===Rs&&!Q.has(Rs))}function Dm(O,D){return Nm(O.slice(1),D).some((B)=>B.includes(D)&&(B.startsWith("-")||B.startsWith(D)))}function Nm(O,D){let B=O.findIndex((Q)=>Q==="--"&&!Q.includes(D));return B===-1?O:O.slice(0,B)}function Lm(O,D,B){if(D===null)return!0;return O.some((Q)=>Q.includes(D))||Array.from(B.values()).some((Q)=>Q.includes(D))}function mR(O,D,B){let Q=hn(O),ee=Q.commandIndex===null?"":O[Q.commandIndex]??"";if(ee.includes(D)&&!Mm(ee,D,B)||Q.scriptIndex!==null&&(O[Q.scriptIndex]??"").includes(D))return!0;return["-c","-nc","-cn",`--${D}`,D].some((je)=>O.some((at,lt)=>{if(lt===0||!at.includes(D))return!1;return km(at,D,je).some((ut)=>{let ft=O.map((mt,pt)=>pt===lt?mt.replaceAll(D,ut):mt),dt=hn(ft);if(dt.commandIndex===null&&dt.scriptIndex===null)return!1;if(Q.commandIndex===null&&dt.commandIndex!==null)return!0;if(Q.scriptIndex===null&&dt.scriptIndex!==null)return!0;if(dt.commandIndex!==null&&(ft[dt.commandIndex]??"").includes(ut))return!0;return dt.scriptIndex!==null&&(ft[dt.scriptIndex]??"").includes(ut)})}))}function pR(O,D,B){let Q=new Set(D===null?[]:Array.from(B).filter(([,ee])=>ee.includes(D)).map(([ee])=>ee));for(let ee of O.matchAll(aR))if(Tm(ee,Q))return!0;for(let ee of O.matchAll(lR))for(let he of(ee[1]??"").matchAll(cR))if(Tm(he,Q))return!0;return Vl(O,Q)}function Tm(O,D){let B=O[1]??O[2];return B!==void 0&&(uR.test(B)||D.has(B))}function gR(O,D,B){if(D===null)return!0;let Q=!1,ee=0;for(let he=1;he<O.length;he++){let je=O[he]??"";if(!Q&&!je.startsWith("-")&&je!=="!"&&je!=="("){if(je.indexOf(D)===0)return!0;continue}if(Q=!0,ee>0){ee--;continue}if(Kn(je)){let lt=Vo(O,he);he=lt.nextIndex-1;for(let ct of Mn(lt.tokens,{environment:B,cwd:void 0})){let ut=Lm(ct.tokens,D,ct.wrapperEnvAssignments);if(ct.head==="rm"&&Dm(ct.tokens,D)||Om(ct.tokens,ct.head,D,ct.wrapperEnvAssignments,ut,B))return!0}continue}let at=sr(je);if(at>0){if(ee=at,je.includes(D))return!0;continue}if(je.includes(D))return!0}return!1}function Ir(O){let D=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),B=null,Q=1;while(Q<O.length){let ee=O[Q];if(!ee)break;if(ee==="--")return{childStart:Q+1,replacementToken:B};if(!ee.startsWith("-"))return{childStart:Q,replacementToken:B};if(ee==="-I"){B=O[Q+1]??"{}",Q+=2;continue}if(ee.startsWith("-I")&&ee.length>2){B=ee.slice(2),Q++;continue}if(ee==="--replace"){B="{}",Q++;continue}if(ee.startsWith("--replace=")){let he=ee.slice(10);B=he===""?"{}":he,Q++;continue}if(ee==="-J"){B=O[Q+1]??"{}",Q+=2;continue}Q+=D.has(ee)?2:1}return{childStart:O.length,replacementToken:B}}var Jo="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Qo="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",yR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",bR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",ws=/\{[^{}\s]*\}/g,Wm=/\{\}|\{-?\d+\}/g,SR=["e","f","source","file","-e","-f","--source","--file"],CR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],vR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),ER=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Gm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),xR=new Set(["--workdir","--wd"]),Fm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function _n(O,D){for(let B of O){let Q=D(B);if(Q)return Q}return null}function Hm(O){return _n([...O],(D)=>xn(D))}function jm(O,D){let B=O.map(t);if((D.envAssignments?.has("PARALLEL")?D.envAssignments.get("PARALLEL"):D.environment.env.get("PARALLEL"))?.trim()){let pt=eo(D);if(pt)return pt}if(B.length===2&&(B[1]==="--version"||B[1]==="--help"))return null;let ee=ep(B),{template:he,jobs:je,runsRemotely:at,readsCommandsFromInput:lt,unsupported:ct,workdir:ut,dryRun:ft}=ee;if(ct){let pt=eo(D);if(pt)return pt;let gt=Hm(D.envAssignments?.values()??[]);if(gt)return gt}if(lt){let pt=TR(D);if(pt)return pt}if(ut!==void 0&&at){let pt=eo(D);if(pt)return pt}let dt=IR(ut,D.cwd,D.environment.paths);if(dt===null){let pt=eo(D);if(pt)return pt}let mt=at?{...D,cwd:void 0,originalCwd:void 0}:dt===null||dt===void 0||dt===D.cwd?D:{...D,cwd:dt};if(ft){if([...Mn(he,mt)].flatMap((gt)=>[...gt.envAssignments.values()]).some(Xl)){let gt=eo(D);if(gt)return gt}return null}if(he.length===0){let pt=je.map((ht)=>ht[0]??"");D.budget.charge("derivedTokens",pt.length);let gt=Ym(mt.envAssignments,mt.cwd,at);return _n(pt,(ht)=>D.analyzeNested(ht,gt))}return _n(Mn(he,mt),(pt)=>RR(pt,ee,D,mt))}function RR(O,D,B,Q){let{jobs:ee,templateHasPlaceholder:he,runsRemotely:je,usesStdin:at}=D,lt=O.tokens,ct=[...O.envAssignments.values()];if(ct.some(Jm)){let ht=eo(B);if(ht)return ht}let ut=Hm(ct);if(ut)return ut;let ft=ct.some(Nt),dt=he||ft,mt=at&&dt,pt=Ym(O.envAssignments,O.wrapperCwd,je||mt);if(Kt.has(O.head)){let ht=()=>{if(!he||ee.length===0)return null;return _n(ee,(Et)=>B.analyzeChild(_s(lt,Et,B.budget),Pr(O,Q)))};if(Zn(lt))return ht();let yt=Yn(lt);if(yt){if(Qm(yt)){let xt=cr(B);if(xt)return xt;if(ee.length===0)return null;return _n(ee,(_t)=>B.analyzeNested($m(yt,_t,B.budget),pt))}if(Nt(yt)){if(ee.length>0)return _n(ee,(Ut)=>B.analyzeNested($m(yt,Ut,B.budget),pt));let xt=Ko(yt);if(xt?.[0]&&kt(xt[0])==="rm"&&Dn(xt)){let Ut=Bm(B);if(Ut)return Ut}let _t=xt?B.analyzeChild(xt,{...Pr(O,Q),dynamicInput:at,shellDynamicMatch:St("parallel.shell-dynamic",Qo),rmDynamicMatch:St("parallel.rm-recursive-force-dynamic",Jo)}):null;if(_t)return _t;return B.analyzeNested(yt,pt)}let Et=!ft&&(!he||ee.length>0)?(ee.length>0?ee:[void 0]).map((xt)=>vs($t(xt===void 0?lt:he?lt.map((_t)=>Zm(_t,xt)):[...lt,...xt]),yt)):[];if(Et.some((xt)=>xt.kind==="dynamic")){let xt=cr(B);if(xt)return xt}let vt=Et.flatMap((xt)=>xt.kind==="literal"?[xt.source]:[]);if(vt.length>0)return B.budget.charge("derivedTokens",vt.length),_n(vt,(xt)=>B.analyzeNested(xt,pt));if(Xo(yt)){let xt=cr(B);if(xt)return xt}let Pt=B.analyzeNested(yt,pt);if(Pt)return Pt;if(dt)return cr(B);return null}let Ct=qn($t(lt));if(Ct.kind==="dynamic"||Ct.kind==="literal"&&Nt(Ct.source))return cr(B)??ht();if(Ct.kind==="literal")return ht();if(ee.length>0){let Et=cr(B);if(Et)return Et;let vt=ht();if(vt)return vt;if(he)return null;let Pt=ee.flatMap((xt)=>xt[0]===void 0?[]:[xt[0]]);return B.budget.charge("derivedTokens",Pt.length),_n(Pt,(xt)=>B.analyzeNested(xt,pt))}if(dt||at)return cr(B)??ht();return null}if(O.head==="rm"&&Dn(lt)){if(he&&ee.length>0)return _n(ee,(yt)=>Yl(_s(lt,yt,B.budget,Wm),O.cwd,Q));if(ee.length>0)return _n(ee,(yt)=>Yl(Um(lt,yt,B.budget),O.cwd,Q));let ht=Yl(lt.flatMap((yt,Ct)=>{if(Ct===0||!Nt(yt))return[yt];return yt.startsWith("-")?[yt.replace(Wm,"")]:[]}),O.cwd,Q);if(ht)return ht;return Bm(B)}let gt=ee.length>0?ee:[void 0];return _n(gt,(ht)=>{let yt=ht===void 0?lt:he?_s(lt,ht,B.budget):Um(lt,ht,B.budget),Ct=St("parallel.shell-dynamic",Qo),Et=at&&O.head==="find"?AR(yt,Q):null,vt=Km(yt,at,B)??Et?.customResult??null,Pt=kt(O.head),xt=at&&(Pt==="rm"&&Zl(yt)||Pt==="xargs"&&qm(yt)||Et?.rmOptions===!0),_t=at&&(xt||Et?.executedSource===!0||Et===null&&Vm(yt,Pt)),Ut=B.analyzeChild(yt,{...Pr(O,Q),worktreeMode:je||at||dt?!1:B.worktreeMode,dynamicInput:at||dt,dynamicRmInput:xt,dynamicSourceInput:vt!==null||_t,shellDynamicMatch:Ct,dynamicSourceMatch:Ct,rmDynamicMatch:St("parallel.rm-recursive-force-dynamic",Jo)});if(_t){let jt=wt(Ct,B.policy);if(jt)return jt}return Ut??vt??_(yt,B.policy?.rules??[])})}function Vm(O,D){if(Nt(O[0]??""))return!0;if(D==="eval"||D==="source"||D===".")return!0;if(D==="parallel"||D==="xargs")return!0;if(Kt.has(D))return PR(O);if(D==="git")return _R(O);if(D==="find")return!0;if(En.has(D))return zm(O,SR,jo);if(An(D))return zm(O,CR,Hi);return!1}function Zl(O){let D=O.indexOf("--"),B=O.slice(1,D===-1?void 0:D);if(!O.some(Nt))return D===-1;return B.some((ee)=>Nt(ee)&&(ee.startsWith("-")||Qm(ee)))}function _R(O){if(wR(O))return!0;let D=Sn(O);if(D.subcommand===null||Nt(D.subcommand))return!0;if(!Jr.has(D.subcommand.toLowerCase()))return!1;let B=D.rest.indexOf("--"),Q=D.rest.slice(0,B===-1?void 0:B);if(!O.some(Nt))return B===-1;return Q.some(Nt)}function wR(O){for(let D=1;D<O.length;D++){let B=O[D];if(!B||B==="--"||!B.startsWith("-"))return!1;if(B==="-c"||B==="--config-env"){if(Nt(O[D+1]??""))return!0;D++;continue}if(B.startsWith("-c")&&B.length>2||B.startsWith("--config-env=")){if(Nt(B))return!0;continue}if(Nt(B))return!0}return!1}function PR(O){if(Zn(O))return!1;let D=Yn(O);if(D!==null)return Nt(D);let B=qn($t(O));if(B.kind==="literal")return Nt(B.source);if(B.kind==="dynamic")return!0;return!O.some(Nt)}function zm(O,D,B){let Q=B(O);if(Q.some((ee)=>Nt(ee.value)))return!0;if(!O.some(Nt))return B([...O,Fm]).some((ee)=>ee.value===Fm);return bs(Q,D,(ee)=>B(O.map((he)=>Zm(he,[ee]))))}function Km(O,D,B){let Q=B.policy?.rules??[];if(!D||Q.length===0)return null;let ee=Q.filter((he)=>kt(he.command)===kt(O[0]??""));if(ee.length===0)return null;if(O.slice(1).some(Nt))return cr(B);return _n(ee,(he)=>_([...O,...he.subcommand?[he.subcommand]:[],...he.block_args],[he]))}function AR(O,D){let B={customResult:null,executedSource:!O.some(Nt),rmOptions:!1},Q=!1,ee=0,he=null,je=()=>{if(!he?.some(Nt))return;for(let at of Mn(he,D))B.executedSource||=Vm(at.tokens,at.head),B.rmOptions||=at.head==="rm"&&Zl(at.tokens)||at.head==="xargs"&&qm(at.tokens),B.customResult??=Km(at.tokens,!0,D)};for(let at of O.slice(1)){if(!Q&&!at.startsWith("-")&&at!=="!"&&at!=="("){B.executedSource||=Nt(at);continue}if(Q=!0,he){if(at===";"||at==="+"){je(),he=null;continue}he.push(at);continue}if(ee>0){ee--;continue}if(Kn(at)){he=[],B.executedSource||=Nt(at);continue}let lt=sr(at);if(lt>0){ee=lt,B.executedSource||=Nt(at);continue}B.executedSource||=Nt(at)}return je(),B}function qm(O){let D=O.slice(Ir(O).childStart);return kt(D[0]??"")==="rm"&&Zl(D)}function Ps(O,D){return(B)=>wt(St(O,D),B.policy)}var cr=Ps("parallel.shell-dynamic",Qo),TR=Ps("parallel.command-stream-dynamic",yR),eo=Ps("parallel.command-stream-dynamic",bR),Bm=Ps("parallel.rm-recursive-force-dynamic",Jo);function Yl(O,D,B){return wt(Ss($t(O),{environment:B.environment,cwd:D,budget:B.budget,originalCwd:B.originalCwd,strict:B.strict,paranoid:B.paranoidRm,allowTmpdirVar:B.allowTmpdirVar,tmpdirWordSplittingUnsafe:ir(B.envAssignments??new Map,B.environment),trustedTmpdirValue:xr(B.envAssignments??new Map,B.environment),protectedGitMetadata:B.protectedGitMetadata,policy:B.policy}),B.policy)}function Ym(O,D,B){let Q={};if(O)Q.envAssignments=O;if(B)return Q.effectiveCwd=null,Q.worktreeMode=!1,Q;if(D!==void 0)Q.effectiveCwd=D;return Object.keys(Q).length>0?Q:void 0}function Zm(O,D){return O.replace(ws,(B)=>Xm(B,D))}function _s(O,D,B,Q=ws){return B.charge("derivedTokens",O.reduce((ee,he)=>ee+1+Math.floor(he.length/64),0)),O.map((ee)=>ee.replace(Q,(he)=>{let je=Xm(he,D);return B.charge("derivedTokens",Math.max(1,Math.ceil(je.length/64))),je}))}function $m(O,D,B){return _s([O],D,B)[0]??""}function Um(O,D,B){return B.charge("derivedTokens",O.length+D.length),[...O,...D]}function Xm(O,D){let B=/^\{(-?\d+)[^{}\s]*\}$/.exec(O)?.[1];if(B===void 0)return D[0]??"";let Q=Number(B);return D[Q>0?Q-1:D.length+Q]??""}function Nt(O){return O.search(ws)!==-1}function Jm(O){if(Xl(O))return!0;for(let D of O.matchAll(ws))if(!/^(?:\{\}|\{\d+\})$/.test(D[0]))return!0;return!1}function Xl(O){let D=O.indexOf("{=");return D!==-1&&O.indexOf("=}",D+2)!==-1}function Qm(O){return/^\{[^{}\s]*\}$/.test(O)}function IR(O,D,B){if(O===void 0)return;if(O==="..."||/^~|[{}$`*?[]/.test(O))return null;if(!D&&!hR(O))return null;try{return nr(D??O,O,B)}catch{return null}}function ep(O){let D=1,B=[],Q=O.length,ee=-1,he=!1,je=!1,at,lt=!1,ct=O.some((pt)=>pt==="::::"||pt==="::::+"||pt===":::+");while(D<O.length){let pt=O[D];if(pt===void 0)break;if(pt===":::"){ee=D;break}if(pt==="--"){let Et=Al(O,D+1);B.push(...Et.templateTokens),Q=D+1,ee=Et.markerIndex;break}if(!pt.startsWith("-")){let Et=Al(O,D);B.push(...Et.templateTokens),Q=D,ee=Et.markerIndex;break}let gt=O[D+1],ht=pt.indexOf("="),yt=ht===-1?pt:pt.slice(0,ht),Ct=ht===-1?void 0:pt.slice(ht+1);if(pt==="--dry-run"){lt=!0,D++;continue}if(pt==="-I"||pt.startsWith("-I")&&pt.length>2){ct||=(pt==="-I"?gt:pt.slice(2))!=="{}",D+=pt==="-I"?2:1;continue}if(pt==="--replace"||pt==="-i"){ct=!0,D+=2;continue}if(yt==="--replace"||pt.startsWith("-i")&&pt.length>2){let Et=yt==="--replace"?Ct:pt.slice(2);ct||=Et!==""&&Et!=="{}",D++;continue}if(pt==="-a"||ER.has(yt)){ct=!0,D+=Ct===void 0?2:1;continue}if(pt==="--pipe"||pt==="--pipepart"){je=!0,D++;continue}if(yt==="--env"){ct=!0,D+=Ct===void 0?2:1;continue}if(Gm.has(yt)||pt.startsWith("-S")&&pt.length>2){he=!0,D+=Gm.has(pt)?2:1;continue}if(xR.has(yt)){ct=!0;let Et=Ct??gt;if(Et===void 0||Et===":::"||Et==="--"){D++;continue}at=Et,D+=Ct===void 0?2:1;continue}if(pt.startsWith("-j")&&pt.length>2&&/^\d+$/.test(pt.slice(2))){D++;continue}if(pt.startsWith("--")&&Ct!==void 0){D++;continue}if(vR.has(pt)){if(gt===void 0||gt===":::"||gt==="--"){ct=!0,D++;continue}D+=2;continue}D+=pt==="-j"||pt==="--jobs"?2:1}ct||=B.some(lt?Xl:Jm);let ut=[];if(ee!==-1){let pt=[];for(let gt=ee+1;gt<O.length;gt++){let ht=O[gt];if(ht===":::"){ut.push(pt),pt=[];continue}if(ht!==void 0)pt.push(ht)}ut.push(pt)}ct||=ut.length>1;let ft=kR(ut),dt=B.some(Nt),mt=B.length===0&&ee===-1;return{template:B,jobs:ft,childStart:Q,templateHasPlaceholder:dt,runsRemotely:he,usesStdin:je||ee===-1,readsCommandsFromInput:mt,unsupported:ct,workdir:at,dryRun:lt}}function kR(O){if(O.length===0||O.some((B)=>B.length===0))return[];let D=[[]];for(let[B,Q]of O.entries()){if(Q.length===1){let he=Q[0];if(he===void 0)return[];for(let je of D)je.push(he);if(D.length*(B+1)>a.derivedTokens.cap)throw new s("derivedTokens");continue}let ee=[];for(let he of D)for(let je of Q){if((ee.length+1)*(B+1)>a.derivedTokens.cap)throw new s("derivedTokens");ee.push([...he,je])}D=ee}return D}function tp(O){return ep(O).childStart}var OR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",As="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ql(O){return O?.parts.some((D)=>D.provenance==="command-substitution")??!1}function Jl(O){return O?.parts.some((D)=>D.provenance==="literal"&&D.raw.replace(/^["']/,"").startsWith("-"))??!1}function rp(O,D,B,Q,ee=!1,he){let at=(xo(O,D)||Q&&O!=="powershell"&&D[0]?.provenance==="variable")&&Jt(he,"shell.dynamic-executable",ee)?St("shell.dynamic-executable",OR):null;return wt(at,he)??op(O,D,B,ee,he)}function op(O,D,B,Q,ee){if(D.length<2)return null;let he=D.flatMap((at,lt)=>Ql(at)?[lt]:[]);if(he.length===0)return null;let je=kt(D[0]?.text??"");if(je==="git"){let at=X(O,D),lt=DR(at);if(Jt(ee,"shell.dynamic-structure",Q)&&he.some((ft)=>ft<=lt))return wt(St("shell.dynamic-structure",As),ee);if(wt(ys(at,{environment:B}),ee))return null;let ct=D[lt]?.text.toLowerCase(),ut=at.findIndex((ft,dt)=>dt>lt&&t(ft)==="--");if(Jt(ee,"shell.dynamic-structure",Q)&&ct&&Jr.has(ct)&&he.some((ft)=>ft>lt&&(ut===-1||ft<ut)))return wt(St("shell.dynamic-structure",As),ee);return null}if(je==="find")return Jt(ee,"shell.dynamic-structure",Q)&&NR(D)?wt(St("shell.dynamic-structure",As),ee):null;if(je==="rm"){let at=D.findIndex((ct,ut)=>ut>0&&t(ct)==="--"),lt=Dn(D.map(t));return Jt(ee,"shell.dynamic-structure",Q)&&he.some((ct)=>(at===-1||ct<at)&&(ct<D.length-1||!lt))?wt(St("shell.dynamic-structure",As),ee):null}if(je==="xargs")return np(O,D.slice(Ir(D.map(t)).childStart),"xargs",B,Q,ee);if(je==="parallel")return np(O,D.slice(tp(D.map(t))),"parallel",B,Q,ee);return null}function np(O,D,B,Q,ee,he){if(D.length===0)return null;let je=MR(D,Q);if(xo(O,je)){let lt=wt(St(`${B}.shell-dynamic`,B==="xargs"?ql:Qo),he);if(lt)return lt}let at=op(O,je,Q,ee,he);if(at)return at;if(je[0]?.text==="rm"&&je.slice(1).some((lt)=>Ql(lt)&&Jl(lt)))return wt(St(`${B}.rm-recursive-force-dynamic`,B==="xargs"?Kl:Jo),he);return null}function MR(O,D){let B=Sr(O,D),Q=B.rewritten?$t(B.words.map(t)):B.words,ee=Q[0];return ee&&t(ee)==="busybox"?Q.slice(1):Q}function DR(O){let D=1;while(D<O.length){let B=O[D],Q=B?t(B):"";if(gn.has(Q)){D+=2;continue}if(Q.startsWith("-")){D++;continue}return D}return D}function NR(O){let D=!1,B=0,Q=!1,ee=!1;for(let he=1;he<O.length;he++){let je=O[he];if(!je)continue;let at=Ql(je);if(B>0){B--;continue}if(ee){if(je.text===";"||je.text==="+"){ee=!1,D=!0,Q=!1;continue}if(at&&(Q||Jl(je)))return!0;Q=!1;continue}if(!D&&!je.text.startsWith("-")){if(at&&(he>1||Jl(je)))return!0;continue}if(D=!0,at)return!0;let lt=sr(je.text);if(lt>0){B=lt;continue}if(Kn(je.text))ee=!0,Q=!0}return!1}function ec(O,D){return O.some((B)=>{if(B.value==="-"&&(B.kind==="main-script"||B.kind==="program-file"))return!0;return!zi(D[B.tokenIndex],B.value)})}var LR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",WR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",GR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function ip(O,D){let B=D.slice(1);if(O==="dd"&&B.some((Q)=>/^of=\/dev\/.+/.test(Q)))return St("dd.device-write",LR);if((O==="mkfs"||O.startsWith("mkfs."))&&B.some((Q)=>Q.startsWith("/dev/")))return St("mkfs.device",WR);if(O==="shred"&&B.length>0)return St("shred.target",GR);return null}var ap=[{heads:new Set(["rm","rmdir"]),analyze:(O)=>Ss(O.words,{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,paranoid:O.options.paranoidRm,allowTmpdirVar:O.allowTmpdirVar,tmpdirWordSplittingUnsafe:ir(O.envAssignments,O.options.environment),trustedTmpdirValue:xr(O.envAssignments,O.options.environment),protectedGitMetadata:O.options.protectedGitMetadata,policy:O.options.policy,budget:O.options.budget})},{heads:new Set(["git"]),analyze:(O)=>ys(O.words,tc(O))},{heads:new Set(["find"]),analyze:(O)=>jf(O.words,{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,allowTmpdirVar:O.allowTmpdirVar,tmpdirWordSplittingUnsafe:ir(O.envAssignments,O.options.environment),trustedTmpdirValue:xr(O.envAssignments,O.options.environment),protectedGitMetadata:O.options.protectedGitMetadata,budget:O.options.budget,envAssignments:O.envAssignments,policy:O.options.policy,analyzeTokens:O.analyzeChildTokens,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})},{heads:new Set(["xargs"]),analyze:(O)=>Im(O.words,{...sp(O),analyzeChild:O.analyzeChild,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})},{heads:new Set(["parallel"]),analyze:(O)=>jm(O.words,{...sp(O),analyzeChild:O.analyzeChild,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})}];function sp(O){return{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,paranoidRm:O.options.paranoidRm,paranoidInterpreters:O.options.paranoidInterpreters,allowTmpdirVar:O.allowTmpdirVar,protectedGitMetadata:O.options.protectedGitMetadata,budget:O.options.budget,envAssignments:O.envAssignments,worktreeMode:O.options.worktreeMode,policy:O.options.policy}}function kr(O){return O?{id:O.ruleId??"",reason:O.reason,intent:O.intent??"manual_only"}:null}function tc(O){return{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,dynamicArguments:O.dynamicArguments,envAssignments:O.envAssignments,shellAssignments:O.options.shellAssignments,policy:O.options.policy,worktreeMode:O.options.worktreeMode}}function dp(O){return ap.find((D)=>D.heads.has(O))?.analyze}function no(O,D,B){let Q=B.trace;if(O.length===0)return null;let ee=B.commandView?.dialect??"posix",he=(Rt)=>Rt.map((At)=>ee==="posix"?t(At):At.text),je=B.child,at=je!==void 0&&!je.embedded,lt=je?.embedded===!0,ct=B.effectiveCwd===null,ut=je?je.cwd:ct?void 0:B.effectiveCwd??B.cwd,ft=je?je.originalCwd:ct?void 0:B.cwd,dt=ge(O);if(dt.envAssignments.size>0)Q?.recordSegment({type:"env-strip",input:he(O),envVars:[...dt.envAssignments.keys()],output:he(dt.words)});let mt=Sr(dt.words,B.environment,ut,new Map([...B.envAssignments??[],...dt.envAssignments])),pt=mt.envSplitValues??[];if(pt.length>0){let Rt=[...pt,...he(mt.words)].join(" "),At=xn(Rt);if(At)return Q?.recordSegment({type:"dangerous-text",token:Rt,matched:!0,reason:At.reason}),sn(At);if(B.strict)return fn(Q);let Mt=qi(pt,he(mt.words));if(Mt){B.budget.charge("derivedTokens",Mt.length);let Yt=B.analyzeNested(Mt.join(" "),{effectiveCwd:mt.cwd===void 0?B.effectiveCwd:mt.cwd,envAssignments:new Map([...B.envAssignments??[],...dt.envAssignments,...mt.envAssignments])});if(Yt)return Yt}}let gt=mt.rewritten?$t(he(mt.words)):X(ee,mt.words),ht=he(gt),yt={...B,wrapperNormalizationBudget:B.wrapperNormalizationBudget??{iterations:0}};if(Q&&dt.words.length>gt.length){let Rt=he(dt.words);Q.recordSegment({type:"leading-tokens-stripped",input:Rt,removed:Rt.slice(0,Rt.length-gt.length),output:ht})}let Ct=new Map([...B.envAssignments??[],...dt.envAssignments,...mt.envAssignments]),Et=ht[0];if(!Et)return null;if(wr(Et))throw new s("wrapperPeelIterations");let vt=kt(Et),Pt=mt.cwd===null?void 0:mt.cwd??ut,xt=mt.cwd===null?void 0:ft,_t=mt.cwd===void 0?B.effectiveCwd:mt.cwd,Ut=je?je.allowTmpdirVar:!zo(Ct,B.environment),jt=rp(ee,mt.words,B.environment,D===0,B.strict,B.policy);if(jt)return Q?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:jt.reason}),sn(jt);let qt=ds(ht,B.policy);if(qt){for(let Rt of[qt.childIndex,...qt.alternativeChildIndices]){lp(yt.wrapperNormalizationBudget);let At=gt.slice(Rt);Q?.recordSegment({type:"transparent-wrapper",wrapper:qt.wrapper,output:he(At)});let Mt=no(At,D,{...yt,effectiveCwd:_t,envAssignments:Ct});if(Mt)return Mt}return null}let Vt=lt?void 0:vt==="eval"?Cs(gt):vt==="trap"&&!at?xm(gt):void 0;if(at&&je&&vt==="eval"){if(Vt?.kind==="dynamic")return to(je,B.policy);if(Vt?.kind==="literal"){let Rt=B.analyzeNested(Vt.source,{effectiveCwd:_t,envAssignments:Ct});if(Rt)return Rt}return ro(je,B.policy)}if(Vt?.kind==="dynamic"&&(B.strict||!B.commandView||!jl(B.commandView)))return fn(Q);if(Vt?.kind==="literal"){Q?.recordSegment({type:"recurse",reason:vt==="eval"?"shell-eval":"shell-trap",innerCommand:Vt.source,depth:D+1});let Rt=B.analyzeNested(Vt.source,{effectiveCwd:_t,envAssignments:Ct,functionDefinitions:B.functionDefinitions});if(Rt)return Rt}if(at?Kt.has(vt):mp(Et,vt)){if(Zn(ht))return null;if(at&&je){let Rt=Yn(ht);if(Rt){if(je.dynamicSourceInput??je.dynamicInput){let Mt=to(je,B.policy);if(Mt)return Mt}if(Xo(Rt)){let Mt=to(je,B.policy);if(Mt)return Mt}return B.analyzeNested(Rt,{effectiveCwd:_t,envAssignments:Ct})}let At=qn(gt);if(At.kind==="dynamic")return to(je,B.policy);if(At.kind==="literal")return je.dynamicSourceInput?to(je,B.policy):null;return je.dynamicSourceInput??je.dynamicInput?to(je,B.policy):null}if(lt){let Rt=Yn(ht),At=Rt?B.analyzeNested(Rt,{effectiveCwd:_t,envAssignments:Ct}):qn(gt).kind==="dynamic"?fn(Q):null;if(At)return At}if(je===void 0){let Rt=$R(ht,Ct,_t,B,Q,D);if(Rt)return Rt;let At=Yn(ht);if(At){let Dr=vs(gt,At);if(Dr.kind==="dynamic")return fn(Q);let Hs=Dr.kind==="literal"?Dr.source:At,wc=UR(Hs);Q?.recordSegment({type:"shell-wrapper",wrapper:vt,innerCommand:wc}),Q?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:wc,depth:D+1});let Pc=B.analyzeNested(Hs,{effectiveCwd:_t,envAssignments:Ct});if(Pc)return Pc;return Xo(Hs)?fn(Q):null}let Mt=qn(gt);if(Mt.kind==="dynamic")return fn(Q);if(Mt.kind==="literal")return Ts(Mt.source,_t,Ct,B,Q,D);let Yt=Rm(gt,B.commandView?.redirections??[],B.hasPipelineInput??!1,B.literalShellInput);if(Yt.kind==="dynamic")return fn(Q);if(Yt.kind==="literal")return Q?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Yt.source,depth:D+1}),B.analyzeNested(Yt.source,{effectiveCwd:_t,envAssignments:Ct})}}if(!je&&(vt==="source"||vt===".")){let Rt=ht[1]==="-p"?2:null;if(Rt!==null){let Dr=B.commandView?gt[Rt]:void 0;if(!Dr)return null;if(Dr.provenance!=="literal")return fn(Q)}let At=Rt===null?1:3,Mt=ht[At]==="--"?At+1:At,Yt=B.commandView?gt[Mt]:void 0;if(!Yt)return null;if(Yt.provenance==="literal")return Ts(Yt.text,_t,Ct,B,Q,D);if(B.strict||!B.commandView||!jl(B.commandView))return fn(Q)}if(En.has(vt)&&!lt){if(!je&&B.strict&&ec(jo(ht),gt))return fn(Q);let Rt=zf(ht,(Mt)=>kr(B.analyzeNested(Mt,{effectiveCwd:_t,envAssignments:Ct}))),At=wt(Rt,B.policy);if(At)return Q?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:At.reason}),sn(At)}if(An(vt)&&!lt){if(!je&&B.strict&&ec(Hi(ht),gt))return fn(Q);let Rt=Wd(ht);if(at&&je)return zR(vt,Rt,_t,Ct,B,je);if(Rt){let At=Jt(B.policy,"interpreter.one-liner-paranoid",!!B.paranoidInterpreters);if(Q?.recordSegment({type:"interpreter",interpreter:vt,codeArg:Rt,paranoidBlocked:At}),At){let Yt=wt(St("interpreter.one-liner-paranoid",ko),B.policy);if(Yt)return sn(Yt)}if(ol(vt,Rt))return null;Q?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:Rt,depth:D+1});let Mt=B.analyzeNested(Rt,{effectiveCwd:_t,envAssignments:Ct});if(Mt&&!fp(Mt,Rt))return Mt;if(Oo(Rt,void 0,!B.strict)){let Yt=wt(St("interpreter.dangerous-command",Kr),B.policy);if(Yt)return Q?.recordSegment({type:"dangerous-text",token:Rt,matched:!0,reason:Kr}),sn(Yt)}Q=void 0}}if(vt==="busybox"&&ht.length>1)return lp(yt.wrapperNormalizationBudget),Q?.recordSegment({type:"busybox",subcommand:ht[1]??"unknown"}),Q?.recordSegment({type:"recurse",reason:"busybox",innerCommand:ht.slice(1).join(" "),depth:D+1}),no(gt.slice(1),D,{...yt,effectiveCwd:_t,envAssignments:Ct});let Ot=je?null:wt(ip(vt,ht),B.policy);if(Ot)return Q?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:Ot.reason}),sn(Ot);let on=Q===yt.trace?yt:{...yt,trace:Q},Cn={words:gt,head:vt,cwd:Pt,originalCwd:xt,envAssignments:Ct,allowTmpdirVar:Ut,dynamicArguments:mt.words.some((Rt)=>Rt.provenance==="command-substitution"),depth:D,effectiveCwd:_t,options:on,analyzeChildTokens:(Rt,At)=>at&&je?nc(Rt,D,on,{...je,cwd:At??void 0,effectiveCwd:At??void 0}):kr(no($t(Rt),D+1,{...on,child:void 0,commandView:void 0,effectiveCwd:At,envAssignments:Ct}))??_(Rt,on.policy.rules),analyzeChild:(Rt,At)=>nc(Rt,D,on,At)},Bn=je&&(vt==="xargs"||vt==="parallel")?void 0:dp(vt);if(vt==="rm"||vt==="xargs"||vt==="parallel")Q?.recordSegment({type:"tmpdir-check",tmpdirValue:Ct.has("TMPDIR")||B.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Ut});let wn=Q&&vt==="git"?gm(Cn.words,tc(Cn)):void 0,$s=cp(wn?wn.match:Bn?.(Cn)??null,B.policy);if(Q)HR(Cn,$s,wn?.relaxation??null);if($s)return sn($s);if(at&&je&&(vt==="rm"||vt==="rmdir")){if(!(vt==="rm"&&(Dn(ht)||je.dynamicRmInput)))return null;return(je.dynamicRmInput?ro(je,B.policy):null)??BR(je,B.policy)}let Rc=Bn!==void 0,_c=!je&&!Rc&&!bi.has(vt),Us=Q&&_c?[]:void 0;if(_c)for(let Rt=1;Rt<ht.length;Rt++){let At=ht[Rt];if(!At)continue;Us?.push(At);let Mt=cp(FR(ht,Rt,D,on,Pt,xt,_t,Ct),B.policy);if(Mt)return Q?.recordSegment({type:"fallback-scan",tokensScanned:Us??[],embeddedCommandFound:kt(At)}),sn(Mt)}if(Q?.recordSegment({type:"fallback-scan",tokensScanned:Us??[]}),lt&&je&&!je.wrappedByTransparent)return null;if(!je&&D!==0&&Rc)return Q?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let si=_(ht,B.policy.rules);if(Q?.recordSegment({type:"custom-rules-check",rulesChecked:B.policy.rules.length>0,matched:!!si,reason:si?.reason}),si)return sn(si);return at&&je?ro(je,B.policy):null}function nc(O,D,B,Q){return kr(no($t(O),D+1,{...B,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:Q.originalCwd,effectiveCwd:Q.effectiveCwd,envAssignments:Q.envAssignments,worktreeMode:Q.dynamicInput?!1:Q.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:Q}))}function FR(O,D,B,Q,ee,he,je,at){for(let lt of Mn(O.slice(D),{environment:Q.environment,cwd:ee,envAssignments:at,policy:Q.policy})){let ct=lt.tokens[0];if(!ct)continue;let ut=kt(ct);if(mp(ct,ut)||dp(ut)!==void 0&&ut!=="xargs"&&ut!=="parallel"||lt.wrappedByTransparent&&Q.policy.rules.length>0)Q.budget.charge("derivedTokens",O.length-D);let dt=nc(lt.tokens,B,Q,{embedded:!0,cwd:lt.cwd,originalCwd:lt.wrapperCwd===null?void 0:he,effectiveCwd:lt.wrapperCwd===void 0?je:lt.wrapperCwd,envAssignments:lt.envAssignments,allowTmpdirVar:!zo(lt.envAssignments,Q.environment),worktreeMode:!1,wrappedByTransparent:lt.wrappedByTransparent});if(dt)return dt}return null}function zR(O,D,B,Q,ee,he){if(!D)return ro(he,ee.policy);if(Jt(ee.policy,"interpreter.one-liner-paranoid",!!ee.paranoidInterpreters)){let at=wt(St("interpreter.one-liner-paranoid",ko),ee.policy);if(at)return sn(at)}if(ol(O,D))return ro(he,ee.policy);let je=ee.analyzeNested(D,{effectiveCwd:B,envAssignments:Q});if(je&&!fp(je,D))return je;if(Oo(D,void 0,!ee.strict)){let at=wt(St("interpreter.dangerous-command",Kr),ee.policy);if(at)return sn(at)}return ro(he,ee.policy)}function fp(O,D){if(O.ruleId==="raw-text.dangerous-command")return!0;return(O.reason.startsWith(ls)||O.reason===Xr)&&!Si(D)}function to(O,D){let B=O.shellDynamicMatch?wt(O.shellDynamicMatch,D):null;return B?sn(B):null}function ro(O,D){let B=O.dynamicSourceInput&&O.dynamicSourceMatch?wt(O.dynamicSourceMatch,D):null;return B?sn(B):null}function BR(O,D){let B=O.dynamicInput&&O.rmDynamicMatch?wt(O.rmDynamicMatch,D):null;return B?sn(B):null}function $R(O,D,B,Q,ee,he){let je=Pm(O);if(je.argvSource?.kind==="absent")return fn(ee);if(je.argvSourceApplies&&je.argvSource){let lt=Ts(je.argvSource.value,B,D,Q,ee,he,!0);if(lt)return lt}if(!je.envSourceApplies||!je.envName)return null;let at=D.get(je.envName);if(!at)return null;return Ts(at,B,D,Q,ee,he,!0)}function Ts(O,D,B,Q,ee,he,je=!1){if(je&&/[$`*?[\]]/.test(O))return fn(ee);let at=Io(O,D,Q.environment.paths,Q.budget),lt=at?Q.literalHeredocFiles?.get(at):void 0;if(lt===void 0)return je?fn(ee):null;return Q.budget.charge("derivedTokens",1),ee?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:lt,depth:he+1}),Q.analyzeNested(lt,{effectiveCwd:D,envAssignments:B})}function UR(O){let D=O[0];return O.length>=2&&(D==='"'||D==="'")&&O.at(-1)===D?O.slice(1,-1):O}function HR(O,D,B){let Q={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[O.head];if(!Q)return;if(O.options.trace?.recordSegment({type:"rule-check",rule:Q,matched:!!D||!!B,reason:D?.reason??B?.originalReason}),B)O.options.trace?.recordSegment({type:B.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:B.originalReason,gitCwd:B.gitCwd})}function lp(O){if(O.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");O.iterations++}function sn(O){return{reason:O.reason,ruleId:O.id||void 0,intent:O.intent}}function fn(O){return O?.recordSegment({type:"error",message:Uo}),sn(jR())}function jR(){return{id:"",reason:Uo,intent:"stop_and_explain"}}function mp(O,D){return Kt.has(D)||O==="$SHELL"||O==="${SHELL}"||Kt.has(Tt(D))}function cp(O,D){return O?.id.startsWith("custom.")||O?.id==="raw-text.dangerous-command"?O:wt(O,D)}var VR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,KR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function qR(O,D){let B=hp(O,D);if(B.length===0)return!1;let Q=B[gp(B)];if(Q==="cd"||Q==="pushd"||Q==="popd")return!0;return VR.test(O.join(" "))}function pp(O,D,B,Q,ee){if(O.dialect==="powershell"){let ht=ZR(O.words,ee);if(ht.kind==="none")return;if(!D||ht.kind==="unknown")return null;return up(e_(ht.target),D,B.paths)}let he=O.words.map(t),je=he.some((ht)=>/^CDPATH\+?=/.test(ht));if(!qR(he,B))return je?null:void 0;if(!D)return null;let at=hp(he,B,D),lt=gp(at);if(lt===-1||at[lt]!=="cd")return null;let ct=at.slice(lt+1),ut=ct.findIndex((ht)=>ht.length<=1||!ht.startsWith("-")||ht==="--");if((ut===-1?ct:ct.slice(0,ut)).some((ht)=>!/^-[LP]+$/.test(ht)))return null;let dt=ut===-1?[]:ct.slice(ut),mt=dt[0]==="--"?dt.slice(1):dt;if(mt.length!==1)return null;let pt=mt[0]??"",gt=O.words.some((ht)=>ht.provenance==="variable"&&ht.text===pt)?YR(pt,Q):pt;if(gt===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(gt)&&(je||B.env.has("CDPATH")))return null;return up(gt,D,B.paths)}function YR(O,D){let B=qo(O,D);return B.startsWith("~")||/[\s$`*?[]/.test(B)?null:B}function up(O,D,B){if(!O||O==="-"||O.includes("$")||O.includes("`"))return null;try{return nr(D,O,B)}catch{return null}}function ZR(O,D){let B=XR(O[0])?1:0,Q=O[B];if(!JR(Q,B===1))return{kind:"none"};let ee=Q.text.toLowerCase(),he=ee.split(/[\\/]/).pop()??ee;if(!KR.has(he))return{kind:"none"};if(ee!==he||he==="pop-location"||he==="popd")return{kind:"unknown"};return QR(O.slice(B+1),D)}function XR(O){return O?.provenance==="literal"&&!O.quoted&&O.raw===O.text&&(O.text==="&"||O.text===".")}function JR(O,D){return O?.provenance==="literal"&&(D||!O.quoted&&O.raw===O.text)}function QR(O,D){let B;for(let Q of O){if(Q.provenance!=="literal"||B!==void 0)return{kind:"unknown"};B=Q.text}if(B!==void 0)return{kind:"target",target:B};return D===void 0?{kind:"unknown"}:{kind:"target",target:D}}function e_(O){return O.includes("::")?void 0:O.replaceAll("\\","/")}function gp(O){let D=0;if(O[0]==="builtin"&&O.length>1)D=1;if(O[D]!=="time")return D;let B=D+1;while(O[B]?.startsWith("-"))B++;return B}function hp(O,D,B){let Q=t_(O);return rr([...Q],D,B)}function t_(O){let D=0;while(D<O.length){let B=O[D];if(B!=="{"&&B!=="("&&B!=="$(")break;D++}return O.slice(D)}var n_="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Or="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function ac(O,D,B,Q){if(D>=a.recursionDepth.cap)return B.trace?.recordSegment({type:"error",message:Wn}),{reason:Wn,segment:O,intent:"stop_and_explain"};let ee=Q??B.factStore?.getCommandProgram(O,B.shell??"auto")??h(O,B.shell);if(ee.status==="limited")return B.trace?.recordSegment({type:"error",message:Wn}),{reason:Wn,segment:O,intent:"stop_and_explain"};if(ee.status==="invalid"){let ct=ee.issues.find((ut)=>ut.code.includes("heredoc"));if(ct){if(!B.strict)return sc(O,B);let ut=`${ls}: ${ct.message}`;return B.trace?.recordGlobal({type:"error",message:ut}),{reason:ut,segment:O,intent:"stop_and_explain"}}return Ep(O,B),{reason:Xr,segment:O,intent:"stop_and_explain"}}if(B.strict&&ee.status==="partial")return Ep(O,B),{reason:Xr,segment:O,intent:"stop_and_explain"};if(ee.issues.some((ct)=>ct.code.includes("quote")))return sc(O,B);let je=B.cwd,at=B.effectiveCwd!==void 0?B.effectiveCwd:B.cwd,lt=rm(B.environment.env,B.envAssignments);return Os(ee,D,{...B,rootProgram:ee},je,[{effectiveCwd:at,shellGitContextState:lt,literalHeredocFiles:new Map(B.literalHeredocFiles),functionDefinitions:new Map(B.functionDefinitions)}]).result}function Os(O,D,B,Q,ee){let he=[...ee],je,at;for(let[lt,ct]of O.nodes.entries()){if(ct.kind==="connector"){at=ct.operator;continue}let ut=O.nodes[lt+1],ft=ut?.kind==="connector"?ut.operator:void 0,dt=r_(O,lt,ct,at,ft),mt=at==="&&"||at==="||",pt=mt?je:void 0,gt=at==="&&"?pt?.success??he:at==="||"?pt?.failure??he:he,ht=at==="||"?pt?.success??[]:[],yt=at==="&&"?pt?.failure??[]:[],Ct=mt||io(ft);if(ct.kind==="function"){let jt=gt.flatMap((Vt)=>{let Ft=so(Vt);return Ft.functionDefinitions.set(ct.name,ct.body),rc(Vt,[Ft],dt,ft==="&",io(ft))}),qt=oc(jt,[],ht,yt,at,ft);he=qt.states,je=qt.conditionalStates,at=void 0;continue}if(ct.kind==="group"){let jt=[],qt=[];for(let Ft of gt){let Ot=Os(ct.body,D,B,Q,[so(Ft)]);if(Ot.result)return Ot;if(jt.push(...rc(Ft,Ot.states,dt,ft==="&",io(ft))),Ct)qt.push(Ft,...dt?Ot.states.map((on)=>Is(Ft,on)):Ot.states)}let Vt=oc(jt,qt,ht,yt,at,ft);he=Vt.states,je=Vt.conditionalStates,at=void 0;continue}if(ct.kind!=="command")continue;let Et=B.trace?.flattenNested?B.trace.currentSegmentIndex:B.trace?.allocateSegment(),vt=O.nodes[lt-2],Pt=Ms(at)&&vt?.kind==="command"?Em(vt)??i_(vt):void 0,xt=[],_t=[];for(let jt of gt){let qt=s_(ct,D,B,Q,[so(jt)]);if(qt.result)return{result:qt.result,states:he};let Vt=O.dialect==="powershell"?qt.states:qt.states.map((Ft)=>Is(jt,Ft));for(let Ft of Vt){let Ot=so(Ft),on=c_(ct,D,B.trace?{...B,trace:xp(B.trace,Et)}:B,Q,Ot,Ms(at),Pt);if(on)return{result:on,states:he};let Cn=__(ct,Ot.functionDefinitions);if(Cn)B.budget.charge("derivedTokens",Ds(Cn));let Bn=Cn?D+1>=a.recursionDepth.cap?ic(ct.displayText,B,[Ot]):Os(Cn,D+1,B,Q,[Ot]):{result:null,states:x_(ct,Ot)};if(Bn.result)return Bn;if(xt.push(...rc(jt,Bn.states,dt,ft==="&",io(ft))),Ct)_t.push(jt),_t.push(...Bn.states.map((wn)=>dt?Is(jt,wn):wn))}}let Ut=oc(xt,_t,ht,yt,at,ft);he=Ut.states,je=Ut.conditionalStates,at=void 0}return{result:null,states:he}}function r_(O,D,B,Q,ee){if(B.kind==="group"&&B.style==="subshell")return!0;if(O.dialect==="posix"&&(Ms(Q)||Ms(ee)))return!0;if(ee==="&")return!0;return O.dialect==="powershell"&&B.kind==="group"&&B.style==="brace"&&o_(O,D)}function rc(O,D,B,Q,ee){let he=B?D.map((at)=>Is(O,at)):[...D],je=ee?he.flatMap((at)=>oo(O.literalHeredocFiles,at.literalHeredocFiles)?[at]:[{...at,literalHeredocFiles:new Map(O.literalHeredocFiles)},at]):he;return Q?[O,...je]:je}function Is(O,D){return{...O,literalHeredocFiles:new Map(D.literalHeredocFiles)}}function o_(O,D){let B=O.nodes.slice(0,D).reverse().find((ee)=>ee.kind==="command"||ee.kind==="connector");if(!B||B.kind!=="command")return!0;let Q=B.words[0]?.text.toLowerCase();if(Q==="&"||Q===".")return!1;if(Q==="write-output"||Q==="function"||Q==="start-job")return!0;if(a_(B))return!0;return B.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Ms(O){return O==="|"||O==="|&"}function i_(O){if(O?.dialect!=="powershell")return;if(O.words.length===1&&O.words[0]?.quoted&&O.words[0].provenance==="literal")return O.words[0].text;if(O.words[0]?.text.toLowerCase()==="write-output"&&O.words.length===2&&O.words[1]?.provenance==="literal")return O.words[1].text;return}function io(O){return O==="&&"||O==="||"}function oc(O,D,B,Q,ee,he){let je={success:ks([...B,...O]),failure:ks([...Q,...D])},at=io(he)?je:void 0;return{states:io(ee)||at?ks([...je.success,...je.failure]):je.success,conditionalStates:at}}function xp(O,D,B=O.flattenNested){return{currentSegmentIndex:D,flattenNested:B,allocateSegment:O.allocateSegment,getNextSegmentIndex:O.getNextSegmentIndex,recordGlobal:O.recordGlobal,recordSegment:(Q,ee=D)=>O.recordSegment(Q,ee)}}function s_(O,D,B,Q,ee){let he=O.nested.map((je)=>({program:je,depth:D}));if(O.dialect==="powershell"){let je=l_(O);if(je){if(D+1>=a.recursionDepth.cap)return ic(je,B,ee);let at=h(je,"powershell");if(at.status==="limited")return ic(je,B,ee);if(at.status!=="complete")return yp(he,B,Q,ee);B.budget.charge("derivedTokens",Ds(at)),he.push({program:at,depth:D+1})}}return yp(he,B,Q,ee)}function a_(O){let D=O.words[0];return D?.provenance==="variable"&&O.words.at(-1)?.text==="="?D.text.toLowerCase():void 0}function yp(O,D,B,Q){let ee=[...Q];for(let he of O){let je=[];for(let at of ee){let lt=Os(he.program,he.depth,D,B,[so(at)]);if(lt.result)return lt;je.push(...lt.states)}ee=ks(je)}return{result:null,states:ee}}function l_(O){let D=O.words[0]?.provenance==="literal"&&!O.words[0].quoted&&O.words[0].raw===O.words[0].text&&(O.words[0].text==="&"||O.words[0].text==="."),B=D?1:0,Q=O.words[B];if(Q?.provenance!=="literal"||!D&&(Q.quoted||Q.raw!==Q.text)||!["iex","invoke-expression"].includes(Q.text.toLowerCase()))return;let ee=O.words.slice(B+1),he=ee[0]&&!ee[0].quoted&&ee[0].raw===ee[0].text&&["-c","-command"].includes(ee[0].text.toLowerCase())?1:0,je=ee[he];return ee.length===he+1&&je?.quoted&&je.provenance==="literal"?je.text:void 0}function Ds(O){return O.nodes.reduce((D,B)=>D+(B.kind==="command"?B.words.length+B.nested.reduce((Q,ee)=>Q+Ds(ee),0):B.kind==="group"||B.kind==="function"?Ds(B.body):0),0)}function ic(O,D,B){return D.trace?.recordSegment({type:"error",message:Wn}),{result:{reason:Wn,segment:O,intent:"stop_and_explain"},states:[...B]}}function c_(O,D,B,Q,ee,he,je){let at={...B,environment:{...B.environment,env:ee.shellGitContextState.env}},lt=h_(O,!at.strict);if(lt&&at.strict)return at.trace?.recordSegment({type:"error",message:lt}),{reason:lt,segment:O.source,intent:"stop_and_explain"};Rp(O,ee,"before-consumer",at.environment.paths,at.budget);let ct=X(O.dialect,O.words),ut=ct.map(t),ft=O.displayText,dt=nm(ct,ee.shellGitContextState),mt=im(dt,ee.shellGitContextState);if(O.dialect==="powershell"){let ht=wt(Of(O,he,P_(at,ee.effectiveCwd)),at.policy);if(at.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!ht,reason:ht?.reason}),ht)return w_(ft,ht)}if(ut.length===1&&ut[0]?.includes(" ")&&!xo(O.dialect,O.words)){let ht=wt(xn(ut[0]),at.policy),yt=ht!==null&&!at.strict&&Md(O,at.rootProgram);if(ht&&!yt)return at.trace?.recordSegment({type:"dangerous-text",token:ut[0],matched:!0,reason:ht.reason}),{reason:ht.reason,segment:ft,ruleId:ht.id,intent:ht.intent};at.trace?.recordSegment({type:"dangerous-text",token:ut[0],matched:!1});let Ct=bp(O,lt,ee,mt,je,at);if(Ct)return Ct;return Fl(dt,ee.shellGitContextState),null}let pt=no(O.words,D,{...at,commandView:O,cwd:Q,effectiveCwd:ee.effectiveCwd,envAssignments:mt,shellAssignments:ee.shellGitContextState.shellAssignments,literalHeredocFiles:ee.literalHeredocFiles,functionDefinitions:ee.functionDefinitions,hasPipelineInput:he,literalShellInput:je,analyzeNested:(ht,yt)=>{let Ct=yt&&Object.hasOwn(yt,"effectiveCwd")?yt.effectiveCwd:ee.effectiveCwd,Et=ac(ht,D+1,{...at,effectiveCwd:Ct,envAssignments:yt?.envAssignments??mt,literalHeredocFiles:ee.literalHeredocFiles,functionDefinitions:yt?.functionDefinitions,worktreeMode:yt?.worktreeMode??at.worktreeMode,trace:at.trace?xp(at.trace,at.trace.currentSegmentIndex,!0):void 0});return Et?{reason:Et.reason,ruleId:Et.ruleId,intent:Et.intent}:null}});if(pt)return{...pt,segment:ft};let gt=bp(O,lt,ee,mt,je,at);if(gt)return gt;return Fl(dt,ee.shellGitContextState),null}function bp(O,D,B,Q,ee,he){let je=y_(O,D,B,Q??new Map,he);if(je)return je;return Rp(O,B,"after-consumer",he.environment.paths,he.budget),B.literalHeredocFiles.clear(),f_(O,D,B,he.environment.paths,he.budget),C_(O,B,ee,he.environment,he.trace),null}var u_=new Set([">>","<>"]);function Rp(O,D,B,Q,ee){for(let je of O.redirections){if(!(B==="before-consumer"?d_(je):u_.has(je.operator)))continue;Sp(je.target,D,Q,ee)}if(B!=="before-consumer"||!nn(O.words[0],"tee"))return;let he=_p(O.words.slice(1));if(!he)return;for(let je of he.operands)Sp(je,D,Q,ee)}function d_(O){if(O.operator===">"||O.operator===">|")return!0;return O.operator===">&"&&O.fd===void 0&&O.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(O.target.text)}function Sp(O,D,B,Q){let ee=O?.provenance==="literal"?Io(O.text,D.effectiveCwd,B,Q):void 0;if(!ee)return;D.literalHeredocFiles.delete(ee)}function f_(O,D,B,Q,ee){if(D)return;let he=O.redirections.find((je)=>je.operator==="<<"||je.operator==="<<-")?.heredoc;if(!he)return;for(let je of m_(O)){let at=Io(je.text,B.effectiveCwd,Q,ee);if(!at||!Ld(at))continue;if(!B.literalHeredocFiles.has(at)&&B.literalHeredocFiles.size>=a.trackedHeredocFiles.cap)throw new s("trackedHeredocFiles");B.literalHeredocFiles.set(at,he.body)}}function m_(O){let D=g_(O.redirections)?.target,B=Cp(D)?[D]:[];if(nn(O.words[0],"cat"))return p_(O.words)?B:[];if(!nn(O.words[0],"tee"))return[];let Q=_p(O.words.slice(1));if(!Q||Q.append||Q.hasUnsupportedOptions||!Q.operands.every(Cp))return[];return[...Q.operands,...B]}function p_(O){let D=!1;for(let B of O.slice(1)){if(D||B.provenance!=="literal")return!1;if(B.text==="--"){D=!0;continue}if(!/^-u+$/.test(B.text))return!1}return!0}function g_(O){let D=O.findLast((B)=>(B.fd??([">",">|",">>",">&"].includes(B.operator)?1:0))===1);return D?.operator===">"||D?.operator===">|"?D:void 0}function _p(O){let D=[],B=!0,Q=!1,ee=!1;for(let he of O){if(he.provenance!=="literal")return;if(B&&nn(he,"--")){B=!1;continue}if(B&&!he.quoted&&he.raw===he.text&&/^-[^-]/.test(he.text)){Q||=he.text.slice(1).includes("a"),ee||=Array.from(he.text.slice(1)).some((je)=>je!=="a"&&je!=="i");continue}if(B&&!he.quoted&&he.raw===he.text&&he.text.startsWith("--")){Q||=he.text==="--append",ee||=he.text!=="--append"&&he.text!=="--ignore-interrupts";continue}D.push(he)}return{operands:D,append:Q,hasUnsupportedOptions:ee}}function Cp(O){if(!O||O.provenance!=="literal"||O.text.length===0)return!1;if(O.quoted||O.raw!==O.text)return!0;return!O.raw.startsWith("~")&&!/[{}]/.test(O.raw)}function nn(O,D){return O?.text===D&&O.raw===D&&O.provenance==="literal"&&!O.quoted}function lc(O){return O.quotedDelimiter||!/[$`\\]/.test(O.body)}function h_(O,D){let B=O.redirections.filter((at)=>at.operator==="<<"||at.operator==="<<-");if(B.length===0)return;if(B.length!==1)return Or;let Q=B[0];if(!Q?.heredoc)return Or;if(!lc(Q.heredoc)&&!(D&&!/\$\(|`/.test(Q.heredoc.body)))return n_;if(Q.fd!==void 0&&Q.fd!==0)return Or;if(O.redirections.some((at)=>at!==Q&&["<","<<","<<-","<<<","<&","<>"].includes(at.operator)))return Or;let ee=O.redirections.some((at)=>at!==Q&&vp(at.target));if(nn(O.words[0],"cat"))return ee?Or:void 0;if(nn(O.words[0],"tee"))return ee||O.words.slice(1).some(vp)?Or:void 0;let he=O.words[0],je=O.words[1];if(nn(he,"git")&&(nn(je,"apply")||nn(je,"commit")))return;if(nn(he,"gh")&&(nn(je,"pr")||nn(je,"issue"))&&nn(O.words[2],"create"))return;return Or}function vp(O){return O?.parts.some((D)=>D.provenance==="command-substitution"&&D.raw.startsWith(">("))??!1}function y_(O,D,B,Q,ee){if(!D)return null;let he=O.redirections.filter((ct)=>ct.operator==="<<"||ct.operator==="<<-"),je=he.flatMap((ct)=>ct.heredoc?[ct.heredoc.body]:[]);if(S_(O,he,B,Q,ee))return null;let at=b_(O,he,ee);if(at!==void 0)return at?{reason:at.reason,segment:O.displayText,ruleId:at.id,intent:at.intent}:null;let lt=sc(je.length===he.length?je.join(`
-`):O.source,ee);return lt?{...lt,segment:O.displayText}:null}function b_(O,D,B){let Q=D.length===1?D[0]:void 0;if(!Q?.heredoc||!lc(Q.heredoc)||Q.fd!==void 0&&Q.fd!==0)return;let ee=nn(O.words[0],"uv")&&nn(O.words[1],"run")?O.words.slice(2):O.words,he=ee[0];if(he?.provenance!=="literal"||!An(he.text))return;let je=ee.findIndex((ft)=>nn(ft,"-"));if(!ee.slice(1,je===-1?void 0:je).every((ft)=>ft.provenance==="literal"&&ft.text.startsWith("-")))return;let lt=Q.heredoc.body,ct=Jt(B.policy,"interpreter.one-liner-paranoid",!!B.paranoidInterpreters);if(B.trace?.recordSegment({type:"interpreter",interpreter:he.text,codeArg:lt,paranoidBlocked:ct}),ct){let ft=wt(St("interpreter.one-liner-paranoid",ko),B.policy);if(ft)return ft}if(!Oo(lt,void 0,!B.strict))return null;let ut=wt(St("interpreter.dangerous-command",Kr),B.policy);if(!ut)return null;return B.trace?.recordSegment({type:"dangerous-text",token:lt,matched:!0,reason:ut.reason}),ut}function S_(O,D,B,Q,ee){let he=D.length===1?D[0]:void 0;if(!he?.heredoc||!lc(he.heredoc)||he.fd!==void 0&&he.fd!==0)return!1;let je=Sr(O.words,ee.environment,B.effectiveCwd,Q),at=je.words.map(t),lt=kt(at[0]??"");if((je.envSplitValues?.length??0)>0||!Kt.has(lt)&&!Kt.has(Tt(lt)))return!1;return Zn(at)}function C_(O,D,B,Q,ee){let he=pp(O,D.effectiveCwd,Q,D.shellGitContextState.shellAssignments,B);if(he===null)ee?.recordSegment({type:"cwd-change",segment:O.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(he!==void 0)D.effectiveCwd=he}var v_=/^[A-Za-z_][A-Za-z0-9_]*$/,E_=8;function x_(O,D){let B=O.words[1]?.text;if(O.dialect!=="posix"||O.words[0]?.text!=="for"||B===void 0||!v_.test(B))return[D];let Q=O.words.slice(3);if(!(O.words[2]?.text==="in"&&Q.length>=1&&Q.length<=E_&&Q.every((he)=>he.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(he.text))))return D.shellGitContextState.shellAssignments.delete(B),[D];return Q.map((he)=>{let je=so(D);return je.shellGitContextState.shellAssignments.set(B,he.text),je})}function so(O){return{effectiveCwd:O.effectiveCwd,shellGitContextState:om(O.shellGitContextState),literalHeredocFiles:new Map(O.literalHeredocFiles),functionDefinitions:new Map(O.functionDefinitions)}}function ks(O){let D=[];for(let B of O){if(!D.some((Q)=>R_(Q,B)))D.push(B);if(D.length>a.controlFlowStates.cap)throw new s("controlFlowStates")}return D}function R_(O,D){return O.effectiveCwd===D.effectiveCwd&&oo(O.shellGitContextState.env,D.shellGitContextState.env)&&oo(O.literalHeredocFiles,D.literalHeredocFiles)&&oo(O.functionDefinitions,D.functionDefinitions)&&oo(O.shellGitContextState.effectiveEnvAssignments,D.shellGitContextState.effectiveEnvAssignments)&&oo(O.shellGitContextState.shellAssignments,D.shellGitContextState.shellAssignments)&&O.shellGitContextState.bodyDepth===D.shellGitContextState.bodyDepth&&O.shellGitContextState.bodyAssignments.size===D.shellGitContextState.bodyAssignments.size&&[...O.shellGitContextState.bodyAssignments].every((B)=>D.shellGitContextState.bodyAssignments.has(B))}function oo(O,D){if(O===D)return!0;if(!O||!D||O.size!==D.size)return!1;return[...O].every(([B,Q])=>D.get(B)===Q&&D.has(B))}function __(O,D){let B=Ro(O);return B===void 0?void 0:D.get(B)}function w_(O,D){if(!D)return null;return{reason:D.reason,segment:O,ruleId:D.id,intent:D.intent}}function P_(O,D=O.effectiveCwd){let B=D===null;return{environment:O.environment,cwd:B?void 0:D??O.cwd,originalCwd:B?void 0:O.cwd,strict:O.strict,paranoid:O.paranoidRm,allowTmpdirVar:O.allowTmpdirVar,protectedGitMetadata:O.protectedGitMetadata,policy:O.policy,budget:O.budget}}function sc(O,D){let B=wt(xn(O),D.policy),Q=D.trace?.currentSegmentIndex??D.trace?.allocateSegment(),ee={type:"dangerous-text",token:O,matched:!!B,reason:B?.reason};if(D.trace?.recordSegment(ee,Q),!B&&/^(?:cd|pushd)\s/.test(O))D.trace?.recordSegment({type:"cwd-change",segment:O,effectiveCwdNowUnknown:!0},Q);return B?{reason:B.reason,segment:O,ruleId:B.id,intent:B.intent}:null}function Ep(O,D){let B={type:"strict-unparseable",rawCommand:O,reason:Xr},Q=D.trace?.currentSegmentIndex;if(Q===void 0)D.trace?.recordGlobal(B);if(Q!==void 0)D.trace?.recordSegment(B)}var A_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function wp(O,D,B,Q){let ee=ac(O,0,{...D,...Fe(D),budget:D.budget??mn(),factStore:Q},B);if(!ee)return null;return{kind:"deny",reason:ee.reason,intent:ee.intent??"manual_only",...ee.ruleId?{ruleId:ee.ruleId}:{},evidence:{command:O,segment:ee.segment}}}function Pp(O,D,B){try{return{decision:O()}}catch(Q){let ee=T_(Q,D,B);if(!ee)throw Q;return ee}}function T_(O,D,B){if(!(O instanceof s)||!A_.has(O.kind))return null;let Q=a[O.kind];if(B?.currentSegmentIndex!==void 0)B.recordSegment({type:"error",message:Q.reason});if(B?.currentSegmentIndex===void 0)B?.recordGlobal({type:"error",message:Q.reason});return{decision:{kind:"deny",reason:Q.reason,intent:"stop_and_explain",evidence:{command:D,segment:D}},errorCode:Q.errorCode}}var I_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),uc=new Set(["cc-safety-net","ccsn"]),k_=new Set(["bunx","npx","pnpx"]),O_=new Set(["pnpm","yarn"]),M_=new Set(["npm","pnpm","yarn"]),D_=new Set(["bun","node"]);function Ls(O,D,B={}){if(uc.has(O))return 0;if(k_.has(O)){if(B.broad)return cc(D);let ee=D[0]==="-y"||D[0]==="--yes"?1:0;return Ns(D[ee])?ee+1:null}let Q=B.broad?D.findIndex((ee)=>!ee.startsWith("-")):0;if(Q!==-1&&M_.has(O)&&B.broad&&D[Q]==="exec"){let ee=cc(D.slice(Q+1));return ee===null?null:Q+1+ee}if(O_.has(O)){if(O==="yarn"&&!B.broad)return null;if(!B.broad)return D[0]==="dlx"&&Ns(D[1])?2:null;if(Q===-1||D[Q]!=="dlx")return null;let ee=cc(D.slice(Q+1));return ee===null?null:Q+1+ee}if(D_.has(O)){let ee=B.broad&&Q!==-1?Q:0;if(Ap(D[ee]))return ee+1;if(O==="bun"&&D[ee]==="run"&&Ap(D[ee+1]))return ee+2}return null}function cc(O){let D=O.findIndex((Q)=>Ns(Q));if(D===-1)return null;let B=D;while(B<O.length){let Q=O[B]??"";if(!Q.startsWith("-")&&!Ns(Q))break;B++}return B}function Ns(O){if(!O)return!1;let D=O.indexOf("@");if(D===-1)return uc.has(O);if(D===0)return!1;let B=O.slice(D+1);if(B===""||B.includes("/")||B.includes(":"))return!1;return uc.has(O.slice(0,D))}function Ap(O){let D=O?.replaceAll("\\","/");return[...I_].some((B)=>D===B||D?.endsWith(`/${B}`))}var Me="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Tp(O,D,B){let Q=un(O,"input-candidate");if(!Q)return null;let ee=Yr(Q.shell,O.invocation.context.executionCwd,D,B,{findSegmentTarget:(he)=>N_(he,D),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return ee?{target:ee}:null}function N_(O,D){let B=rr([...O],D),Q=B.slice(1),ee=Ls(Tt(B[0]??"").toLowerCase(),Q,{broad:!0});if(ee===null)return null;let he=Q.slice(ee).filter((je)=>je!=="-g"&&je!=="--global");return he[0]==="policy"&&he[1]==="apply"?B.join(" "):null}import{dirname as Ws}from"node:path";var $e="This path contains the protected policy config and you must not modify or delete it.",L_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Mp(O,D,B){let Q=$_(O.invocation.context,D,B);if(O.invocation.route.kind==="patch")return Ip(O.paths,!1,O.invocation.context.executionCwd,Q,D,B);let ee=un(O,"input-candidate");if(O.invocation.route.kind==="command")return ee?kp(ee.shell,O.invocation.context.executionCwd,Q,D,B):null;if(O.invocation.route.kind==="unknown"&&ee){let he=kp(ee.shell,O.invocation.context.executionCwd,Q,D,B);if(he)return he}return Ip(O.paths,O.invocation.route.kind==="grep"||O.invocation.route.kind==="glob"||ui(O.invocation.toolName),O.invocation.context.executionCwd,Q,D,B)}function Ip(O,D,B,Q,ee,he){if(D)return null;let je=O.find((at)=>ei(at,B,Q,ee,he));return je?{target:je}:null}function kp(O,D,B,Q,ee){let he=Yr(O,D,Q,ee,{findSegmentTarget:(je,at)=>W_(je,at,B,Q,ee)?.target??null,isRedirectionTarget:(je,at)=>ei(je,at.cwd,B,Q,ee),findMalformedTarget:(je)=>B_(je,D,B,Q,ee)?.target??null});return he?{target:he}:null}function W_(O,D,B,Q,ee){if(Wo(O))return null;let he=Cr([...O],Q),je=Tt(he[0]??"").toLowerCase(),at=he.slice(1);if(je==="rm"&&G_(at)){let lt=F_(at).find((ct)=>Op(cn(ct,D.variables),D.cwd,B,Q,ee));if(lt)return{target:lt}}if(je==="find"){if(ps(he,1)||Il(he,Q)){let ct=(ms($t(he))??$t(["."])).find((ut)=>{let ft=cn(ut.text,D.variables);return ei(ft,D.cwd,B,Q,ee)||Op(ft,D.cwd,B,Q,ee)})?.text;if(ct)return{target:ct}}}if(je==="mv"){let lt=es(at).sources.find((ct)=>U_(cn(ct,D.variables),D.cwd,B,Q,ee));if(lt)return{target:lt}}if(z_(he,je))return null;for(let lt of[...O,...he])for(let ct of Dp(lt))if(ei(cn(ct,D.variables),D.cwd,B,Q,ee))return{target:ct};return null}function G_(O){return O.some((D)=>D==="--recursive"||D.startsWith("-")&&!D.startsWith("--")&&/[rR]/.test(D.slice(1)))}function F_(O){let D=O.indexOf("--");if(D!==-1)return[...O.slice(0,D).filter((B)=>!B.startsWith("-")),...O.slice(D+1)];return O.filter((B)=>!B.startsWith("-"))}function z_(O,D){if(!L_.has(D))return!1;if(D!=="sed")return!0;return!O.slice(1).some((B)=>B.startsWith("-i")||B==="--in-place"||B.startsWith("--in-place="))}function B_(O,D,B,Q,ee){for(let he of O.split(/\s+/))for(let je of Dp(he))if(ei(je,D,B,Q,ee))return{target:je};return null}function Dp(O){let D=O.trim().replace(/^['"]|['"]$/g,""),B=D.indexOf("=");return B===-1||B===D.length-1?[D]:[D,D.slice(B+1)]}function $_(O,D,B){let Q=(at)=>ti(tn(at,O.executionCwd,D,B)),ee=Q(u(D)),he=[Q(b(O.executionCwd)),Q(b(O.configCwd))],je=new Set(he.map((at)=>Ws(at)));for(let at=Ws(ee);;at=Ws(at))if(je.add(at),Ws(at)===at)break;return{files:new Set([ee,...he]),directoriesAndAncestors:je}}function ei(O,D,B,Q,ee){let he=Oc(O,D,Q,ee,(je)=>ti(je)===hi);return he!==null&&B.files.has(ti(he))}function Op(O,D,B,Q,ee){return B.directoriesAndAncestors.has(ti(tn(O,D,Q,ee)))}function U_(O,D,B,Q,ee){let he=ti(tn(O,D,Q,ee));return B.files.has(he)||B.directoriesAndAncestors.has(he)}function ti(O){return process.platform==="win32"?O.toLowerCase():O}import{isAbsolute as Gs,posix as H_,resolve as zs,win32 as j_}from"node:path";import{fileURLToPath as V_}from"node:url";var Vp="Access to a sensitive path is not allowed.",Kp=new Set(["echo","printf"]),K_=new Set(["find"]),q_=new Set(["!","do","elif","else","if","then","until","while"]),Y_=new Set(["-exec","-execdir"]),Z_=new Set([";","+"]),X_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),J_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),qp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),Q_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),ew=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Yp=new Set(["-c","-e","-r","-E","--eval","--exec"]),tw=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),nw=new Set(["grep","rg"]),rw=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),ow=new Set(["commit","merge","notes","stash","tag"]),iw=new Set(["-m","--message"]),sw=new Set(["--grep"]),Np=new Set(["jq","gojq","jaq"]),Lp="f",Wp="file",aw="files",lw=new Set(["e","f"]),cw=new Set(["regexp","file"]),uw=new Set(["e","f","A","B","C","m"]),dw=new Set(["regexp","file","after-context","before-context","context","max-count"]),dc="__CC_SAFETY_NET_PIPE_INPUT__",mc=/[\w./~@+-]*[./~][\w./~@+-]*/g,fw=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,mw=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,pw=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Gp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Fp=/\b(?:system|exec|spawn|popen)\s*$/,gw=/\b(?:eval|exec)\s*\(/g,hw=/\b(?:eval|exec)\s*$/,yw=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function zp(O,D,B,Q,ee,he){for(let je of O){let at=je.target;if(pP(at,je.cwd,D?.denyPaths??[],B,Q,ee))return{target:at,ruleId:"secret.deny-path"};if(he&&!he.has(at))continue;let lt=fP(at,je.cwd,D,Q,ee);if(lt){let ct=!lt.startsWith("secret.home.")&&!lt.startsWith("secret.cli.");if(he&&(ct&&Q.paths.isDirectory(ng(at,je.cwd,Q,ee))||ct&&je.written===!0&&!at.includes("$")&&!gc(at,je.cwd,Q,ee)||ct&&/\s/.test(at)&&!at.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(at)&&!gc(at,je.cwd,Q,ee)))continue;if(!lt.startsWith("secret.cli.")&&gP(at,je.cwd,D?.allowPaths??[],B,Q,ee))continue;return{target:at,ruleId:lt}}}return null}function Zp(O,D,B,Q,ee={}){let he=Bp(O,B,Q),je=zp(he,D,O.invocation.context.configCwd,B,Q);if(je===null||je.ruleId==="secret.deny-path"||ee.strict!==!1)return je;let at=zp(he,D,O.invocation.context.configCwd,B,Q,new Set(Bp(O,B,Q,{standard:!0}).map((lt)=>lt.target)));return at?.ruleId!=="secret.deny-path"&&bw(O,B)?null:at}function bw(O,D){let B=un(O,"input-candidate")??un(O,"declared-command");if(!B)return!1;if(B.program.nodes.some((je)=>je.kind==="command"&&je.nested.length>0))return!1;let Q=[];for(let je of Qi(B.shell)){if(je.kind==="operator"&&je.boundary)return!1;if(je.kind==="redirection")return!1;if(je.kind==="operator")continue;Q.push(Vn(je.text,D))}let ee=Jn(Q);if(ee.length===0)return!1;let he=Ln(ee[0]??"").toLowerCase();if(O.invocation.route.kind==="unknown")return B.program.dialect==="powershell"&&(he==="ls"||he==="stat");return hc(he,ee.slice(1))}function hc(O,D){if(O==="ls"||O==="stat")return!0;if(O==="test")return D.length===2&&(D[0]==="-e"||D[0]==="-f");if(O==="[")return D.length===3&&(D[0]==="-e"||D[0]==="-f")&&D[2]==="]";if(O==="git")return D[0]==="check-ignore";if(O!=="find")return!1;return!D.some((B)=>X_.has(B))}function Bp(O,D,B,Q={}){let ee=O.invocation.context.executionCwd,he=O.invocation.route.kind;if(he!=="command"&&he!=="unknown")return O.paths.map((at)=>({target:at,cwd:ee}));let je=un(O,"input-candidate");return[...je?ao(je.shell,O.store,Q,D,ee,B,Sw(je)):[],...he==="unknown"?O.paths.map((at)=>({target:at,cwd:ee})):[]]}function Sw(O){return O.program.dialect==="powershell"}function ao(O,D,B,Q,ee,he,je=!1){if(O.status==="structural-limit")throw new y;if(O.status==="unclosed-quote")return[];if(O.status==="invalid")throw Error("Unable to parse command for secret protection");let at=[...O.assignmentFallbacks.map((ct)=>({target:ct,cwd:ee})),...Yw(Vn(O.source,Q),D,B,Q,ee,he)],lt=(ct)=>Vn(Iw(ct,je),Q);return Ji(O,ee,Q,he,{word:lt,segment:(ct,ut,ft,dt,mt)=>{if(ct.length===0)return null;if(at.push(...Bs(ct,D,B,Q,ut.cwd,he,mt)),ft!==null)at.push(...vw(ft,ct,D,B,Q,ut.cwd,he));return null},redirection:(ct,ut)=>{if(ct.body!==void 0&&ct.consumer!==void 0)at.push(...Xp(ct.consumer,[ct.body],D,B,Q,ut.cwd,he,(ft)=>Ew(ct.consumer??[],ft,D,B,Q,ut.cwd,he)));if(ct.targetOrder==="legacy-segment")return ml;return at.push({target:lt(ct.target),cwd:ut.cwd,...ct.role==="file-write"?{written:!0}:{}}),null}}),at}function yc(O,D,B,Q,ee,he){let je=D.getShellSyntax(O);if(je.status==="structural-limit")throw new y;return je.status==="complete"?ao(je,D,B,Q,ee,he):null}function Bs(O,D,B,Q,ee,he,je){let at=(gt)=>({target:gt,cwd:ee});if(je?.size){let gt=O.filter((ht,yt)=>!je.has(yt));if(Np.has(Ln(Jn(gt)[0]??"").toLowerCase()))return[...O.filter((ht,yt)=>je.has(yt)).map(at),...Bs(gt,D,B,Q,ee,he)]}let lt=Tw(O).map(at),ct=Jn(O);if(ct.length===0)return lt;let ut=ct[0]??"",ft=Ln(ut).toLowerCase(),dt=ct.slice(1),mt=ct.findIndex((gt)=>!q_.has(gt));if(B.standard===!0&&mt!==-1&&hc(Ln(ct[mt]??"").toLowerCase(),ct.slice(mt+1)))return lt;let pt=Cw(ut,ft,dt);if(pt)return[...lt,...pt.map(at)];if(Kp.has(ft))return B.capturedOutput===!0?[...lt,...Jp(O).map(at)]:lt;if(ft==="eval")return[...lt,...yc(dt.join(" "),D,B,Q,ee,he)??dt.map(at)];if(ft==="export")return[...lt,...dt.flatMap((gt)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(gt)?[gt.slice(gt.indexOf("=")+1)]:zn(ft,gt)).map(at)];if(ft==="git")return[...lt,...Ow(dt).map(at)];if(ft==="gh")return[...lt,...pc(ft,dt,rw).map(at)];if(Np.has(ft))return[...lt,...kw(dt).map(at)];if(nw.has(ft))return[...lt,...rP(dt).map(at)];if(K_.has(ft))return[...lt,...Lw(dt,D,B,Q,ee,he).map(at)];if(En.has(ft))return[...lt,...dt.flatMap((gt)=>zn("awk",gt)).map(at),...dt.flatMap((gt)=>Gw(gt,D,B,Q,ee,he)),...dt.flatMap(Fw).map(at)];if(ft==="curl")return[...lt,...dt.flatMap((gt)=>zn(ft,gt)).map(at),...Mw(dt).map(at)];if(Go(ft)){let gt=Lo.has(ft)?hn([ft,...dt]):null;if(gt!==null&&gt.command!==null&&gt.commandIndex!==null){let ht=D.getShellSyntax(gt.command);if(ht.status==="structural-limit")throw new y;if(ht.status==="complete")return[...lt,...ao(ht,D,B,Q,ee,he),...dt.slice(gt.commandIndex).filter((yt)=>!yt.startsWith("-")).map(at)]}return[...lt,...Ww(ft,dt,D,B,Q,ee,he)]}return[...lt,...dt.flatMap((gt)=>zn(ft,gt)).map(at)]}function Cw(O,D,B){let Q=Ls(D,B);if(Q===null||B[Q]!=="explain")return null;let ee=[O,...B.slice(0,Q)],he=B.slice(Q+1);for(let je=0;je<he.length;je++){let at=he[je];if(at==="--json"||at==="--help"||at==="-h")continue;if(at==="--cwd"){let lt=he[je+1];if(lt&&!lt.startsWith("--"))ee.push(lt);je++;continue}return ee}return ee}function vw(O,D,B,Q,ee,he,je){if(ww(D,B,Q,ee,he,je)){let at=Jn(O),lt=hc(Ln(at[0]??"").toLowerCase(),at.slice(1))?at.slice(1).filter((ct)=>!ct.startsWith("-")):[];return[...Jp(O),...lt].map((ct)=>({target:ct,cwd:he}))}return Xp(D,xw(O),B,Q,ee,he,je,()=>[])}function Ew(O,D,B,Q,ee,he,je){let at=Jn(O);if(!Go(Ln(at[0]??"").toLowerCase()))return[];return yc(D,B,Q,ee,he,je)??[{target:D,cwd:he}]}function Xp(O,D,B,Q,ee,he,je,at){let lt=Pw(O);if(lt===null)return D.flatMap(at);return D.flatMap((ct)=>Lo.has(lt)?ao(B.getShellSyntax(ct),B,Q,ee,he,je):Fs(lt,ct,B,Q,ee,he,je))}function Jp(O){let D=Jn(O);if(D.length===0)return[];let B=Ln(D[0]??"").toLowerCase();if(!Kp.has(B))return[];let Q=D[D[1]==="--"?2:1];if(B==="printf"&&Q!==void 0&&!Q.startsWith("-")&&!Q.replaceAll("%%","").includes("%"))return[bc(Q.replaceAll("%%","%"))];return D.slice(1)}function xw(O){let D=Jn(O);if(D.length===0)return[];let B=Ln(D[0]??"").toLowerCase(),Q=D.slice(1);if(B==="echo"){let ee=Q.findIndex((he)=>!/^-[neE]+$/.test(he));return[(ee===-1?[]:Q.slice(ee)).join(" ")]}if(B==="printf")return Rw(Q);return[]}function Rw(O){let D=O[0];if(D===void 0)return[];let B=(D.match(/%%|%[bqs]/g)??[]).filter((ee)=>ee!=="%%").length;if(B===0||O.length===1)return[bc(D)];let Q=O.slice(1);return Array.from({length:Math.ceil(Q.length/B)},(ee,he)=>_w(D,Q.slice(he*B,(he+1)*B)))}function _w(O,D){let B=0;return bc(O.replace(/%%|%[bqs]/g,(Q)=>{if(Q==="%%")return"%";let ee=D[B]??"";return B++,ee}))}function bc(O){return O.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function ww(O,D,B,Q,ee,he){let je=Jn(O);if(je.length===0||Ln(je[0]??"").toLowerCase()!=="xargs")return!1;let at=Ir(je),lt=je.slice(at.childStart);if(lt.length===0)return!1;if(at.replacementToken==="")return!1;let ct=at.replacementToken,ut=ct===null?[...lt,dc]:lt.map((ft)=>ft.split(ct).join(dc));return Bs(ut,D,B,Q,ee,he).some((ft)=>ft.target.includes(dc))}function Pw(O){let D=Jn(O);if(D.length===0)return null;let B=Ln(D[0]??"").toLowerCase();if(!Go(B))return null;return Aw(B,D.slice(1))?B:null}function Aw(O,D){let B=Sc(O);for(let Q=0;Q<D.length;Q++){let ee=D[Q];if(ee===void 0)break;if(Yp.has(ee)||Qp(O,ee)||/^--(?:eval|exec)=/.test(ee))return!1;if(ee==="-")return!0;if(ee.startsWith("-")){if(B==="python"&&ee==="-m")return!1;if(yw.get(B)?.has(ee))Q++;continue}return!1}return!0}function Sc(O){return/^python\d/.test(O)?"python":O}function Tw(O){let D=[];for(let B of O){if(tg(B))continue;let Q=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(B);if(Q===null)break;if(Q[1]!==void 0&&Q[1]!=="")D.push(Q[1])}return D}var $p=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function Iw(O,D){if(!D||!$p.test(O))return O;return`~${O.replace($p,"").replace(/\\/g,"/")}`}function zn(O,D){if(D==="--")return[];let B=[],Q=D.indexOf("=");if(Q>0&&Q<D.length-1)B.push(D.slice(Q+1));if(D.startsWith("-"))return B;if(O==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(D))return B;if(O==="zip"&&/\.zip$/i.test(D))return B;return B.push(D),B}function kw(O){let D=-1,B=!1;for(let Q=0;Q<O.length;Q++){let ee=O[Q]??"";if(!B&&ee==="--"){B=!0;continue}if(B||!/^-(?:[A-Za-z]|-)/.test(ee)){if(D===-1)D=Q;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(ee)){Q+=2;continue}if(ee==="--indent"||ee==="-L"){Q++;continue}if(ee.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(ee)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(ee))continue;return O.flatMap((he)=>zn("jq",he))}return O.flatMap((Q,ee)=>ee===D?[]:zn("jq",Q))}function Ow(O){let D=[];for(let B=0;B<O.length;B++){let Q=O[B]??"";if(Q==="--"||!Q.startsWith("-"))return[...D,...ow.has(Q)?pc("git",O.slice(B).map((he)=>/^-[aeinopqsv]+m$/.test(he)?"-m":he),iw):pc("git",O.slice(B),sw)];if(D.push(...zn("git",Q)),!gn.has(Q))continue;let ee=O[B+1];if(ee===void 0)break;D.push(...Q==="-c"&&ee.includes("=")?[ee.slice(ee.indexOf("=")+1)]:zn("git",ee)),B++}return D}function pc(O,D,B){let Q=[];for(let ee=0;ee<D.length;ee++){let he=D[ee]??"";if(he==="--")return[...Q,...D.slice(ee).flatMap((je)=>zn(O,je))];if(B.has(he)){ee++;continue}if(he.includes("=")&&B.has(he.slice(0,he.indexOf("="))))continue;Q.push(...zn(O,he))}return Q}function Mw(O){return O.flatMap((D,B)=>{let Q=Nw(D);if(Q!==null)return Up(Q.flag,Q.value);let ee=Dw(O[B-1]);return ee===null?[]:Up(ee,D)})}function Up(O,D){if(O==="-F"||O==="--form"){let B=D.indexOf("="),Q=B===-1?D:D.slice(B+1);if(!Q.startsWith("@")&&!Q.startsWith("<"))return[];return fc(Q.slice(1).split(";")[0]??"")}if(O==="--data-urlencode"){let B=D.indexOf("@"),Q=D.indexOf("=");if(B===-1||Q!==-1&&Q<B)return[];return fc(D.slice(B+1))}return D.startsWith("@")?fc(D.slice(1)):[]}function Dw(O){if(O===void 0)return null;if(qp.has(O))return O;return/^-[A-Za-z]+[dF]$/.test(O)?`-${O.slice(-1)}`:null}function Nw(O){let D=O.slice(0,2);if(O.length>2&&(D==="-d"||D==="-F"))return{flag:D,value:O.slice(2)};let B=O.indexOf("=");if(B===-1)return null;let Q=O.slice(0,B);return qp.has(Q)?{flag:Q,value:O.slice(B+1)}:null}function fc(O){return O===""||O==="-"?[]:[O]}function Lw(O,D,B,Q,ee,he){let je=O.findIndex((lt)=>lt.startsWith("-")||lt==="("||lt==="!"||lt===";"),at=[...O.slice(0,je===-1?O.length:je),...O.flatMap((lt,ct)=>lt==="-files0-from"&&O[ct+1]!==void 0?[O[ct+1]??""]:[])];for(let lt=0;lt<O.length;lt++){if(!Y_.has(O[lt]??""))continue;let ct=O.slice(lt+1),ut=ct.findIndex((mt)=>Z_.has(mt)),ft=ut===-1?ct:ct.slice(0,ut),dt=Bs(ft,D,B,Q,ee,he).map((mt)=>mt.target);if(at.push(...dt.filter((mt)=>mt!=="{}")),!dt.includes("{}"))continue;at.push(...O.slice(0,lt).flatMap((mt,pt,gt)=>{if(!J_.has(mt))return[];let ht=gt[pt+1];return ht===void 0?[]:[ht,ht.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return at}function Ww(O,D,B,Q,ee,he,je){let at=[];for(let lt=0;lt<D.length;lt++){let ct=D[lt];if(ct===void 0)break;if(Yp.has(ct)||Qp(O,ct)){let ft=D[lt+1];if(ft!==void 0)at.push(...Fs(O,ft,B,Q,ee,he,je)),lt++;continue}let ut=/^--(?:eval|exec)=(.*)$/.exec(ct);if(ut!==null&&ut[1]!==void 0){at.push(...Fs(O,ut[1],B,Q,ee,he,je));continue}if(!ct.startsWith("-"))at.push({target:ct,cwd:he})}return at}function Qp(O,D){if(!D.startsWith("-")||D.startsWith("--")||D.length<=2)return!1;return tw.get(D[D.length-1]??"")?.has(Sc(O))??!1}function Gw(O,D,B,Q,ee,he){if(!O.includes("system"))return[];return wl(O)?.commands.flatMap((je)=>ao(D.getShellSyntax(je),D,B,Q,ee,he))??[]}function Fw(O){return Array.from(O.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((D)=>D[1]).filter((D)=>D!==void 0&&D!=="")}function zw(O){let D=Array.from(O.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((B)=>B[2]).filter((B)=>B!==void 0&&B!=="");return[...D,...D.flatMap(Cc),...O.match(mc)??[]]}function Fs(O,D,B,Q,ee,he,je){let at=(gt)=>({target:gt,cwd:he}),lt=$w(D,Bw(O));if(lt===null)return zw(D).map(at);let ct=lt.masked.match(Gp)!==null||lt.literals.some((gt)=>Fp.test(lt.masked.slice(0,gt.start))),ut=lt.masked.match(gw)!==null||lt.literals.some((gt)=>hw.test(lt.masked.slice(0,gt.start))),ft=Q.standard===!0&&!Lo.has(O),dt=ft&&!(Vw(lt.masked)||ct||ut)?[]:lt.literals,mt=ft?Array.from(lt.masked.matchAll(Gp),(gt)=>{let ht=gt.index+gt[0].length;return{start:ht,end:sl(lt.masked,ht)}}):[],pt=!ft||mt.some((gt)=>al(lt.masked,gt.start))?lt.literals:lt.literals.filter((gt)=>Fp.test(lt.masked.slice(0,gt.start))||mt.some((ht)=>gt.start>=ht.start&&gt.start<ht.end));return[...dt.map((gt)=>gt.text).filter((gt)=>gt!=="").map(at),...dt.flatMap((gt)=>Cc(gt.text)).map(at),...ft?[]:lt.literals.flatMap((gt)=>gt.text.match(mc)??[]).map(at),...ct?pt.flatMap((gt)=>yc(gt.text,B,Q,ee,he,je)??[at(gt.text)]):[],...ut?lt.literals.flatMap((gt)=>Fs(O,gt.text.replace(/\\(.)/g,(ht,yt)=>yt==="n"?`
-`:yt),B,Q,ee,he,je)):[],...(lt.masked.match(mc)??[]).map(at)]}function Bw(O){let D=Sc(O);if(D==="python")return"python";if(D==="osascript")return"opaque";return D==="node"||D==="bun"||D==="deno"?"javascript":"simple"}function $w(O,D){if(D==="opaque")return null;let B=O.split(""),Q=[];for(let ee=0;ee<O.length;ee++){let he=O[ee]??"";if(D==="simple"&&(he==="`"||he==="%"||he==="<")){if(mw.test(O.slice(ee)))return null}let je=he==="'"||he==='"'||D==="javascript"&&he==="`"?he:null;if(je===null)continue;if(je==="`"&&jw(O,ee))return null;let at=D==="python"?Uw(O,ee):"",lt=D==="python"&&O.startsWith(je.repeat(3),ee)?je.repeat(3):je,ct=ee+lt.length,ut=Hw(O,ct,lt);if(ut===null)return null;let ft=O.slice(ct,ut);if(/[fF]/.test(at)&&ft.includes("{"))return null;if(D==="simple"&&je==='"'&&pw.test(ft))return null;Q.push({start:ct,text:ft});for(let dt=ee;dt<ut+lt.length;dt++)B[dt]=" ";ee=ut+lt.length-1}return{masked:B.join(""),literals:Q}}function Uw(O,D){return fw.exec(O.slice(Math.max(0,D-3),D))?.[1]??""}function Hw(O,D,B){let Q=B==="`",ee=Q||B.length===3;for(let he=D;he<O.length;he++){let je=O[he];if(je==="\\"){he++;continue}if(Q&&je==="$"&&O[he+1]==="{")return null;if(!ee&&(je===`
-`||je==="\r"))return null;if(O.startsWith(B,he))return he}return null}function jw(O,D){for(let B=D-1;B>=0;B--){let Q=O[B];if(!Q||/\s/.test(Q))continue;return/[\w$\])]/.test(Q)}return!1}function Vw(O){for(let D of O.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let B=D[0],Q=D.index;if(Q_.has(B.toLowerCase()))return!0;let ee=B.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((he)=>he.toLowerCase());if(!ee.some((he)=>ew.has(he)))continue;if(ee.length>1)return!0;if(Kw(O,Q)===".")return!0;if(qw(O,Q+B.length)==="(")return!0}return!1}function Kw(O,D){for(let B=D-1;B>=0;B--)if(!/\s/.test(O[B]??""))return O[B];return}function qw(O,D){for(let B=D;B<O.length;B++)if(!/\s/.test(O[B]??""))return O[B];return}function Yw(O,D,B,Q,ee,he){return eP(O).flatMap((je)=>{let at=D.getShellSyntax(je);if(at.status==="invalid")return[];return[...ao(at,D,{...B,capturedOutput:!0},Q,ee,he),...Zw(at,Q)?Xw(at,Q).map((lt)=>({target:lt,cwd:ee})):[]]})}function Zw(O,D){let B=Qi(O);for(let Q=0;Q<B.length;Q++){let ee=B[Q];if(ee?.kind!=="word"||Ln(Vn(ee.text,D)).toLowerCase()!=="base64")continue;for(let he=Q+1;he<B.length;he++){let je=B[he];if(je?.kind==="operator")break;if(je?.kind!=="word")continue;let at=Vn(je.text,D);if(at==="--decode"||!at.startsWith("--")&&at.startsWith("-")&&/[dD]/.test(at))return!0}}return!1}function Xw(O,D){return Qi(O).flatMap((B)=>B.kind==="word"?[Vn(B.text,D)]:B.kind==="redirection"&&B.target?[Vn(B.target,D)]:[]).flatMap(Cc)}function Cc(O){let D=Qw(O);if(D===null)return[];let B=Buffer.from(D,"base64").toString("utf8");if(B===""||Jw(B))return[];return Buffer.from(B,"utf8").toString("base64").replace(/=+$/g,"")===D.replace(/=+$/g,"")?[B]:[]}function Jw(O){return Array.from(O).some((D)=>{let B=D.charCodeAt(0);return B<32||B===127})}function Qw(O){if(O.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(O))return null;if(/=/.test(O.replace(/=+$/g,"")))return null;let D=O.replace(/=+$/g,"");if(D.length%4===1)return null;return`${D.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-D.length%4)%4)}`}function eP(O){let D=[],B={inSingle:!1,inDouble:!1,escaped:!1};for(let Q=0;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(So(ee,B))continue;if(eg(O,Q,B)){let he=tP(O,Q+1);if(he!==null)D.push(he.body),Q=he.endIndex;continue}if(!B.inSingle&&ee==="`"){let he=nP(O,Q);if(he!==null)D.push(he.body),Q=he.endIndex}}return D}function tP(O,D){let B={inSingle:!1,inDouble:!1,escaped:!1},Q=1;for(let ee=D+1;ee<O.length;ee++){let he=O[ee];if(!he)break;if(So(he,B))continue;if(eg(O,ee,B)){Q++,ee++;continue}if(!B.inSingle&&!B.inDouble&&he===")"){if(Q--,Q===0)return{body:O.slice(D+1,ee),endIndex:ee}}}return null}function nP(O,D){let B=!1;for(let Q=D+1;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(B){B=!1;continue}if(ee==="\\"){B=!0;continue}if(ee==="`")return{body:O.slice(D+1,Q),endIndex:Q}}return null}function eg(O,D,B){return!B.inSingle&&O[D]==="$"&&O[D+1]==="("&&O[D+2]!=="("}function rP(O){let D=[],B=[],Q=!1,ee=!1,he=!1;for(let lt=0;lt<O.length;lt++){let ct=O[lt];if(ct===void 0)break;if(!he&&ct==="--"){he=!0;continue}if(he){B.push(ct);continue}let ut=/^--([^=]+)(?:=(.*))?$/.exec(ct);if(ut!==null){let ft=ut[1]??"",dt=ut[2];if(ft===aw)ee=!0;if(cw.has(ft))Q=!0;if(dt!==void 0){if(ft===Wp)D.push(dt);continue}if(dw.has(ft)){let mt=O[lt+1];if(ft===Wp&&mt!==void 0)D.push(mt);lt++}continue}if(ct.startsWith("-")&&ct.length>1){let ft=ct.slice(1),dt="",mt="";for(let gt=0;gt<ft.length;gt++){let ht=ft[gt]??"";if(lw.has(ht))Q=!0;if(uw.has(ht)){dt=ht,mt=ft.slice(gt+1);break}}if(dt==="")continue;if(mt.length>0){if(dt===Lp)D.push(mt);continue}let pt=O[lt+1];if(dt===Lp&&pt!==void 0)D.push(pt);lt++;continue}B.push(ct)}let at=!Q&&!ee?B.slice(1):B;return[...D,...at]}function Jn(O){let D=O.findIndex((B)=>!tg(B)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(B));return D===-1?[]:O.slice(D)}function tg(O){return O==="env"||O==="command"||O==="builtin"||O==="sudo"}var oP=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),iP=".env.",sP=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),aP=[".env.example.",".env.sample."];function lP(O){let D;try{D=new URL(O.trim())}catch{return!1}return D.protocol!=="file:"&&D.host!==""}function cP(O){return O.length>0&&!/\s/.test(O)}function gc(O,D,B,Q){let ee=ng(O,D,B,Q);return ee!==""&&B.paths.entryKind(ee)!=="missing"}function ng(O,D,B,Q){try{return oi(O,D,B,Q)}catch(ee){if(ee instanceof s)throw ee;return""}}var uP=new Set(["node_modules","__pycache__"]),dP=[["vendor","bundle"],["vendor","cache"]];function fP(O,D,B,Q,ee){if(lP(O))return null;let he=Fn(O,D,Q,ee);if(!he)return null;let je=Gt(he.split("/").pop()??""),at=Gt(he),lt=()=>cP(je)||gc(O,D,Q,ee);if(sP.has(je)||aP.some((dt)=>je.startsWith(dt)))return null;let ct=Gt(bP(O,D,Q,ee));for(let dt of Ea){let mt=`~/${dt.suffixParts.join("/")}`;if((jp(at,mt)||jp(ct,mt))&&Xn(dt.id,B))return dt.id}let ut=mP(he,D,B,Q,ee);if(ut)return ut;if(oP.has(je))return null;for(let dt of va)if(je===dt.basename&&Xn(dt.id,B))return dt.id;if(je.startsWith(iP)&&Xn(vi.id,B)&&lt())return vi.id;for(let dt of xa)if(je.length>dt.prefix.length&&je.startsWith(dt.prefix)){let mt=je.slice(dt.prefix.length)[0];if((mt==="-"||mt==="_")&&Xn(dt.id,B)&&lt())return dt.id}for(let dt of Ra)if(je.length>dt.prefix.length&&je.startsWith(dt.prefix)){if(je.slice(dt.prefix.length)===dt.suffix&&Xn(dt.id,B))return dt.id}if(hP(at))return null;if(!je.includes(".")&&Co.pattern.test(je)&&Xn(Co.id,B))return Co.id;let ft=yP(je,B);if(ft)return ft;return null}function mP(O,D,B,Q,ee){return Ei.find((he)=>{if(!Xn(he.id,B))return!1;switch(he.id){case"secret.cli.claude-code":return Dt(O,Wt(Q.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",D,Q,ee),[".credentials.json"]);case"secret.cli.claude-code.config":{let je=Gt(O).split("/");return Dt(O,Wt(Q.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",D,Q,ee),["settings.json","settings.local.json"])||ri(O,"~/.claude.json",D,Q,ee)||je.at(-1)==="settings.local.json"&&je.at(-2)===".claude"||je.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Dt(O,Fn("~/.gemini/config",D,Q,ee),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let je=Wt(Q.env.get("CODEX_HOME"),"~/.codex",D,Q,ee);return Dt(O,je,["auth.json",".credentials.json"])||ni(O,je,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let je=Wt(Q.env.get("CODEX_HOME"),"~/.codex",D,Q,ee),at=Gt(O).split("/").at(-1)??"";return Dt(O,je,["config.toml"])||at.endsWith(".config.toml")&&Dt(O,je,[at])}case"secret.cli.gemini":return Dt(O,rn(Wt(Q.env.get("GEMINI_CLI_HOME"),"~",D,Q,ee),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let je=Gt(O).split("/"),at=Q.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),lt=Q.env.get("ProgramData")?[rn(Wt(Q.env.get("ProgramData"),"",D,Q,ee),"gemini-cli")]:[];return Dt(O,rn(Wt(Q.env.get("GEMINI_CLI_HOME"),"~",D,Q,ee),".gemini"),["settings.json","google_accounts.json"])||je.at(-1)==="settings.json"&&je.at(-2)===".gemini"||(at?.trim()?ri(O,at,D,Q,ee):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...lt].some((ct)=>Dt(O,Fn(ct,D,Q,ee),["settings.json"]))}case"secret.cli.copilot-cli":{let je=Wt(Q.env.get("COPILOT_HOME"),"~/.copilot",D,Q,ee);return Dt(O,je,["config.json"])||ni(O,je,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Dt(O,Wt(Q.env.get("COPILOT_HOME"),"~/.copilot",D,Q,ee),["mcp-config.json"]);case"secret.cli.kimi-code":{let je=Wt(Q.env.get("KIMI_CODE_HOME"),"~/.kimi-code",D,Q,ee),at=Wt(Q.env.get("KIMI_SHARE_DIR"),"~/.kimi",D,Q,ee);return Dt(O,je,["server.token"])||ni(O,je,["credentials"])||ni(O,at,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let je=["config.toml","mcp.json"],at=Gt(O).split("/");return at.at(-1)==="mcp.json"&&at.at(-2)===".kimi-code"||Dt(O,Wt(Q.env.get("KIMI_CODE_HOME"),"~/.kimi-code",D,Q,ee),je)||Dt(O,Wt(Q.env.get("KIMI_SHARE_DIR"),"~/.kimi",D,Q,ee),[...je,"config.json","config.json.bak"])}case"secret.cli.opencode":{let je=rn(Wt(Q.env.get("XDG_DATA_HOME"),"~/.local/share",D,Q,ee),"opencode"),at=Gt(O).split("/").at(-1)??"",lt=Q.env.get("OPENCODE_DB")?.trim(),ct=lt&&lt!==":memory:"?[lt,`${lt}-wal`,`${lt}-shm`]:[];return Dt(O,je,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(at)&&Dt(O,je,[at])||ct.some((ut)=>ri(O,ut,D,Q,ee))}case"secret.cli.opencode.config":{let je=Q.env.get("OPENCODE_CONFIG_DIR")?Wt(Q.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",D,Q,ee):rn(Wt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"opencode"),at=Q.env.get("ProgramData")?[rn(Wt(Q.env.get("ProgramData"),"",D,Q,ee),"opencode")]:[],lt=["opencode.json","opencode.jsonc"],ct=Q.env.get("OPENCODE_CONFIG");return lt.includes(Gt(O).split("/").at(-1)??"")||Dt(O,je,lt)||(ct?.trim()?ri(O,ct,D,Q,ee):!1)||["/Library/Application Support/opencode","/etc/opencode",...at].some((ut)=>Dt(O,Fn(ut,D,Q,ee),lt))}case"secret.cli.pi":return Dt(O,Wt(Q.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",D,Q,ee),["auth.json"]);case"secret.cli.pi.config":return Dt(O,Wt(Q.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",D,Q,ee),["models.json"]);case"secret.cli.amp":{let je=Fn("~",D,Q,ee);return[rn(Wt(Q.env.get("XDG_DATA_HOME"),"~/.local/share",D,Q,ee),"amp"),rn(je,".local","share","amp")].some((lt)=>Dt(O,lt,["secrets.json"]))||ni(O,rn(je,".amp"),["oauth"])}case"secret.cli.amp.config":{let je=["settings.json","settings.jsonc"],at=[rn(Wt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"amp"),rn(Fn("~",D,Q,ee),".config","amp")],lt=Gt(O).split("/"),ct=Q.env.get("AMP_SETTINGS_FILE");return at.some((ut)=>Dt(O,ut,je))||lt.at(-2)===".amp"&&je.includes(lt.at(-1)??"")||(ct?.trim()?ri(O,ct,D,Q,ee):!1)}case"secret.cli.cursor":{let je=rn(Wt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"cursor"),at=rn(Wt(Q.env.get("CURSOR_DATA_DIR"),"~/.cursor",D,Q,ee),"projects");return Dt(O,Fn("~/.cursor",D,Q,ee),["auth.json"])||Dt(O,je,["auth.json"])||Gt(O).split("/").at(-1)==="mcp-auth.json"&&Mr(Gt(O),Gt(at))}case"secret.cli.cursor.config":{let je=Gt(O).split("/");return je.at(-1)==="mcp.json"&&je.at(-2)===".cursor"}case"secret.cli.grok-build":return Dt(O,Wt(Q.env.get("GROK_HOME"),"~/.grok",D,Q,ee),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let je=Gt(O).split("/");return je.at(-1)==="config.toml"&&je.at(-2)===".grok"||Dt(O,Wt(Q.env.get("GROK_HOME"),"~/.grok",D,Q,ee),["config.toml","managed_config.toml","requirements.toml"])||Dt(O,Fn("/etc/grok",D,Q,ee),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Hp=new WeakMap;function Wt(O,D,B,Q,ee){let he=Hp.get(ee)??new Map;Hp.set(ee,he);let je=`${B}\x00${O??""}\x00${D}`,at=he.get(je);if(at!==void 0)return at;let lt=Fn(O?.trim()?O:D,B,Q,ee);return he.set(je,lt),lt}function Dt(O,D,B){return B.some((Q)=>rg(O,rn(D,Q)))}function ni(O,D,B){return B.some((Q)=>Mr(Gt(O),Gt(rn(D,Q))))}function ri(O,D,B,Q,ee){return rg(O,Fn(D,B,Q,ee))}function rg(O,D){return Gt(O)===Gt(D)}function rn(O,...D){return Nn([O,...D].filter(Boolean).join("/"))}function pP(O,D,B,Q,ee,he){if(B.length===0)return!1;let je=Gt(oi(O,D,ee,he));return B.some((at)=>Mr(je,Gt(oi(at,Q,ee,he))))}function gP(O,D,B,Q,ee,he){if(B.length===0)return!1;let je=Gt(oi(O,D,ee,he));if(!je)return!1;let at=ee.env.get("HOME")??ee.home,lt=at?Nn(Lt(pn(at),ee.paths,he)):"",ct=Gt(lt),ut=ee.env.get("CC_SAFETY_NET_HOME"),ft=Gt(ut?Nn(Lt(zs(pn(ut)),ee.paths,he)):lt&&Nn(Lt(`${lt}/.cc-safety-net`,ee.paths,he)));if(ft&&Mr(je,ft))return!1;return B.some((dt)=>{let mt=Gt(oi(dt,Q,ee,he));if(!mt)return!1;if(ct&&(ct===mt||ct.startsWith(mt.endsWith("/")?mt:`${mt}/`)))return!1;return Mr(je,mt)})}function hP(O){let D=O.split("/");return D.some((B)=>uP.has(B))||dP.some(([B,Q])=>D.some((ee,he)=>ee===B&&D[he+1]===Q))}function yP(O,D){let B=O.lastIndexOf("."),Q=B>0&&B<O.length-1?O.slice(B+1):"";if(Q==="")return null;for(let ee of _a)if(Q===ee.extension&&Xn(ee.id,D))return ee.id;for(let ee of wa)if(ee.pattern.test(Q)&&Xn(ee.id,D))return ee.id;return null}function Gt(O){return O.toLowerCase()}function Xn(O,D){return!D?.disabledRules?.includes(O)}function Fn(O,D,B,Q){let{home:ee,normalized:he}=vc(O,B,Q);if(!he)return"";if(!ee)return he;let je=Ec(he,ee),at=Gs(je)?je:Nn(zs(D,je)),lt=Nn(Lt(at,B.paths,Q));if(!Mr(lt,ee)){if(Gs(je))return lt;return lt===at?he:lt}let ct=lt.slice(ee.length);return ct?`~${ct}`:"~"}function jp(O,D){return O===D||O.startsWith(`${D}/`)}function bP(O,D,B,Q){let{home:ee,normalized:he}=vc(O,B,Q);if(!he||!ee)return"";let je=Ec(he,ee),at=H_.normalize(Gs(je)?je:Nn(zs(D,je))),lt=Nn(pn(B.env.get("HOME")??B.home)),ct=(dt)=>process.platform==="win32"?dt.toLowerCase():dt,ut=[ee,lt].find((dt)=>dt!==""&&Mr(ct(at),ct(dt)));if(ut===void 0)return"";let ft=at.slice(ut.length);return ft?`~${ft}`:"~"}function oi(O,D,B,Q){let{home:ee,normalized:he}=vc(O,B,Q);if(!he)return"";let je=ee?Ec(he,ee):he;return Nn(Lt(Gs(je)?je:zs(D,je),B.paths,Q))}function vc(O,D,B){let Q=D.env.get("HOME")??D.home,ee=Q?Nn(Lt(pn(Q),D.paths,B)):"",he=Nn(pn(SP(Vn(O,D))));return{home:ee,normalized:he}}function SP(O){if(!O.trim().toLowerCase().startsWith("file:"))return O;try{return V_(O)}catch{return O}}function Ec(O,D){if(O==="~")return D;if(O.startsWith("~/"))return rn(D,O.slice(2));return O}function CP(O){if(process.platform==="win32")return!0;return j_.parse(O).root.length>1}function Nn(O){let D=O.trim(),B=(D.includes("\\")&&CP(D)?D.replace(/\\/g,"/"):D).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(B==="/")return B;return B.replace(/\/+$/g,"")}function Mr(O,D){return O===D||O.startsWith(D.endsWith("/")?D:`${D}/`)}function Ln(O){return O.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??O}class p extends Error{stage;evaluation;name="GuardEvaluationError";constructor(O,D,B){super(`CC Safety Net ${O} dependency failed`,{cause:B});this.stage=O;this.evaluation=D}}var vP={findPolicyMutation:Mp,findGitMetadataMutation:pf,resolveGitMetadata:EP,loadPolicySnapshot:E,findSensitiveTarget:Zp,analyzeCommand:wp,getModes:R};function W(O,D){let B={...vP,...D.dependencies},Q=_P(O),ee=ii(O)?O.command:Q,he=ur("policy-protection",ee,()=>Fo(O)),je=un(he,"input-candidate"),at=un(he,"declared-command");if(ii(O)&&O.command?.trim()&&at?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Wn,intent:"stop_and_explain",evidence:{command:O.command,segment:O.command}}};if(je?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Mf,intent:"stop_and_explain"}};let lt=mn(),ct=ur("policy-protection",ee,()=>B.resolveGitMetadata([O.context.executionCwd,O.context.configCwd],D.environment)),ut=ur("policy-protection",ee,()=>B.findPolicyMutation(he,D.environment,lt));if(ut){let Et=ee??ut.target;return{stage:"policy-protection",decision:{kind:"deny",reason:$e,intent:"hard_stop",evidence:{command:Et,segment:ut.target}}}}let ft=ur("policy-protection",ee,()=>Tp(he,D.environment,lt));if(ft){let Et=ee??ft.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Me,intent:"hard_stop",evidence:{command:Et,segment:ft.target}}}}let dt=ur("policy-protection",ee,()=>B.findGitMetadataMutation(he,ct,D.environment,lt));if(dt){let Et=ee??dt.target;return{stage:"policy-protection",decision:{kind:"deny",reason:x,intent:"hard_stop",evidence:{command:Et,segment:dt.target}}}}let mt=ur("config-load",ee,()=>B.loadPolicySnapshot(D.environment,{...D.policyOptions,cwd:O.context.configCwd})),pt=mt.policy,gt=B.getModes(pt,D.environment.env),ht={level:gt.effectiveLevel,...xP(mt)},yt=pt.secretProtection.enabled===!1?null:ur("secret-protection",ee,()=>B.findSensitiveTarget(he,pt.secretProtection,D.environment,lt,{strict:ii(O)||je?.program.dialect==="powershell"?gt.strict:void 0}));if(yt){let Et=ee??yt.target;return{stage:"secret-protection",...ht,decision:{kind:"deny",reason:Vp,intent:"hard_stop",ruleId:yt.ruleId,evidence:{command:Et,segment:yt.target}}}}if(!ii(O))return{stage:"non-command",...ht,decision:{kind:"allow"}};if(!O.command||O.command.trim()==="")return{...xc("command-validation",ee),...ht};let Ct=ur("command-analysis",ee,()=>Pp(()=>B.analyzeCommand(O.command,{cwd:O.context.executionCwd,shell:O.route.shell,policySnapshot:mt,environment:D.environment,protectedGitMetadata:ct,effectiveCapabilities:gt.capabilities,strict:gt.strict,paranoidRm:gt.paranoidRm,paranoidInterpreters:gt.paranoidInterpreters,worktreeMode:gt.worktreeMode,budget:lt,...D.trace?{trace:D.trace}:{}},RP(he),he.store),O.command,D.trace));if(Ct.decision){let Et=!gt.strict&&Ct.decision.kind==="deny"&&(Ct.decision.ruleId==="raw-text.dangerous-command"||Ct.decision.reason===Uo&&!/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/.test(Ct.decision.evidence?.segment??"")&&xn(O.command)===null);return{stage:"command-analysis",...ht,..."errorCode"in Ct?{errorCode:Ct.errorCode}:{},decision:Et?{...Ct.decision,ask:!0}:Ct.decision}}return{stage:"command-analysis",...ht,decision:{kind:"allow"}}}function EP(O,D){let B=[...new Set(O.filter((Q)=>typeof Q==="string"&&Q!==""))].flatMap((Q)=>D.gitMetadata(Q)??[]);if(B.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(B.flatMap((Q)=>Q.entries))]),markerFiles:Object.freeze([...new Set(B.flatMap((Q)=>Q.markerFiles))]),directories:Object.freeze([...new Set(B.flatMap((Q)=>Q.directories))]),hooksDirectories:Object.freeze([...new Set(B.flatMap((Q)=>Q.hooksDirectories))])})}function xP(O){if(O.state==="ready")return{};return{configFallback:{reason:O.reason}}}function RP(O){return un(O,"declared-command")?.program}function _P(O){try{return ne(O.input)}catch(D){let B=ii(O)?O.command:void 0;throw new p("policy-protection",xc("policy-protection",D instanceof f?void 0:B,D),D)}}function ur(O,D,B){try{return B()}catch(Q){throw new p(O,xc(O,Q instanceof f?void 0:D,Q),Q)}}function xc(O,D,B){let Q=B instanceof s||B instanceof y;return{stage:O,decision:{kind:"deny",reason:Q?Vs:te,intent:"stop_and_explain",...D?{evidence:{command:D,segment:D}}:{}}}}function ii(O){return O.route.kind==="command"}
+`?O.trim().split(/\s+/).filter(Boolean):O.split(D).filter(Boolean)}function xs(O){if(!O)return!0;return O.provenance==="unknown"?!/[$`]/.test(t(O)):O.provenance==="literal"}function Yo(O){return O?t(O):""}function Qx(O){return`'${O.replaceAll("'",`'"'"'`)}'`}function ql(O,D){return Vl(h(O,"posix"),D)}function Xo(O){return ql(O,new Set(Array.from(O.matchAll(xm)).flatMap((D)=>{let B=D[1]??D[2];return B===void 0?[]:[B]})))}function Vl(O,D){if(O.status==="invalid"||O.status==="limited")return!1;let B=new Set(D);for(let Q of O.nodes){if(Q.kind==="group"){if(Vl(Q.body,B))return!0;continue}if(Q.kind!=="command")continue;if(Q.nested.some((ee)=>Vl(ee,B))||Pm(Q.words,B))return!0;oR(Q,B)}return!1}function Pm(O,D){let B=O.findIndex((je)=>Rn(je.text)===null);if(B===-1)return!1;let Q=O[B];if(!Q)return!1;if(Zo(Q,D))return!0;let ee=kt(Q.text);if(ee==="source"||ee==="."){let je=O[B+1]?.text==="--"?B+2:B+1;return Em(O[je],D)}if(Kt.has(ee)){let je=O.slice(B),at=hn(je.map((ct)=>ct.text)),lt=at.commandIndex??at.scriptIndex;return!at.syntaxCheck&&lt!==null&&Em(je[lt],D)}let he=eR(O,B,D);if(he===null)return!1;if(he===-1)return!0;return Pm(O.slice(he),D)}function eR(O,D,B){let Q=kt(O[D]?.text??"");if(Q==="command")return tR(O,D+1);if(Q==="exec")return nR(O,D+1);if(Q==="env")return rR(O,D+1,B);return null}function tR(O,D){for(let B=D;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return O[B+1]?B+1:null;if(/^-[p]*[vV][pvV]*$/.test(Q))return null;if(/^-p+$/.test(Q))continue;return B}return null}function nR(O,D){for(let B=D;B<O.length;B++){let Q=O[B]?.text??"";if(Q==="--")return O[B+1]?B+1:null;if(Q==="-a"){B++;continue}if(/^-a.+/.test(Q)||/^-[cl]+$/.test(Q))continue;return B}return null}function rR(O,D,B){for(let Q=D;Q<O.length;Q++){let ee=O[Q],he=ee?.text??"";if(he==="--")return O[Q+1]?Q+1:null;if(he==="-S"||he==="--split-string")return Zo(O[Q+1],B)?-1:Q+2;if(he.startsWith("-S")||he.startsWith("--split-string="))return Zo(ee,B)?-1:Q+1;if(he==="-u"||he==="--unset"||he==="-C"||he==="--chdir"||he==="-P"){Q++;continue}if(he==="-i"||he==="-0"||he==="--null"||he.startsWith("-u=")||he.startsWith("--unset=")||he.startsWith("-C")||he.startsWith("--chdir=")||he.startsWith("-P"))continue;if(he.startsWith("-"))continue;if(Rn(he))continue;return Q}return null}function oR(O,D){if(!O.words.every((B)=>Rn(B.text)!==null))return;for(let B of O.words){let Q=Rn(B.text);if(!Q)continue;if(Zo(B,D))D.add(Q.name)}}function Zo(O,D){if(!O)return!1;return O.parts.filter((B)=>B.provenance==="variable").some((B)=>Array.from(B.raw.matchAll(xm)).some((Q)=>{let ee=Q[1]??Q[2];return ee!==void 0&&(Hx.test(ee)||D.has(ee))}))}function Em(O,D){return!!O&&(O.parts.some((B)=>B.provenance!=="literal"&&B.provenance!=="variable")||Zo(O,D))}var iR=["--init-file","--rcfile"],sR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Yn(O){for(let D=1;D<O.length;D++){let B=O[D];if(!B)continue;if(B==="-c")return Am(O,D,!0);if(B.startsWith("-")&&B.includes("c")&&!B.startsWith("--")){let Q=Am(O,D,!1);if(Q!==null)return Q}}return null}function Zn(O){let D=Tt(O[0]??"").toLowerCase();if(D==="zsh"||D==="ksh")return hn(O).syntaxCheck;let B=!1;for(let Q of O.slice(1)){if(Q==="--")return B;if(Q.startsWith("+")&&!Q.startsWith("++")){if(Q.slice(1).includes("n"))B=!1;continue}if(!Q.startsWith("-")||Q.startsWith("--"))return B;let ee=Q.slice(1);if(ee.includes("n"))B=!0;if(ee.includes("c"))return B}return B}function Am(O,D,B){if(O[D+1]==="--")return O[D+2]||null;let Q=O[D+1];if(!Q||!B&&Q.startsWith("-"))return null;return Q}function Tm(O){let D=Tt(O[0]??"").toLowerCase(),B=aR(O,D),Q=sR.get(D)??null,ee=B.argvSource?.kind!=="absent";return{argvSource:D==="bash"?B.argvSource:null,argvSourceApplies:D==="bash"&&B.interactive&&B.argvSource?.kind==="literal",envName:Q,envSourceApplies:ee&&(Q==="BASH_ENV"?!B.interactive:Q==="ENV"&&B.interactive)}}function aR(O,D){let B=hn(O),Q=B.commandIndex??B.scriptIndex??O.length,ee=[],he=!1,je=!0;for(let at=1;at<Q;at++){let lt=O[at];if(lt===void 0||lt==="--"||lt==="-"||lt[0]!=="-"&&lt[0]!=="+")break;if(lt.startsWith("--")){if(D==="bash"&&je?iR.find((dt)=>lt===dt):void 0){let dt=O[at+1];ee.push(dt===void 0?{kind:"absent"}:{kind:"literal",value:dt}),at++;continue}let ft=lt.split("=",1)[0]??lt;if(D==="bash"&&ga.has(ft)&&!lt.includes("="))at++;continue}if(D==="bash")je=!1;let ct=ha(D,lt,O[at+1],"startup");if(ct.interactive)he=lt[0]==="-";at+=ct.followingValues}return{argvSource:ee.at(-1)??null,interactive:he}}var Yl="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Zl="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",lR="__CC_SAFETY_NET_XARGS_INPUT__",Rs="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",_s="rm",cR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,uR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,dR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,fR=/^(?:[0-9]+|[@*])$/;function Om(O,D){let B=O.map(t),{childStart:Q,replacementToken:ee}=Ir(B),he=B.slice(Q),je=St("xargs.shell-dynamic",Zl);if(pR(he,ee,D)&&wt(je,D.policy))return wt(je,D.policy);for(let at of Mn(he,D)){let lt=at.tokens,ct=ee!==null&&lt[0]!==he[0]&&(lt[0]?.includes(ee)??!1)?wt(je,D.policy):null;if(ct)return ct;let ut=Gm(lt,ee,at.wrapperEnvAssignments),ft=at.head==="rm"&&ee!==null&&Lm(lt,ee),dt=D.analyzeChild(lt,{...Pr(at,D),dynamicInput:ut,dynamicSourceInput:ft||Dm(lt,at.head,ee,at.wrapperEnvAssignments,ut,D.environment,D.strict?void 0:D.analyzeNested),dynamicRmInput:ft,shellDynamicMatch:je,dynamicSourceMatch:je,rmDynamicMatch:St("xargs.rm-recursive-force-dynamic",Yl)});if(dt)return dt;let mt=mR(lt,ee,D.policy?.rules??[],wt(je,D.policy));if(mt)return mt;if(at.head==="git"){let gt=ee===null?[...lt,lR]:lt,ht=ee!==null&&(lt.some((Ct)=>Ct.includes(ee))||Array.from(at.envAssignments.values()).some((Ct)=>Ct.includes(ee))),yt=D.analyzeChild(gt,{...Pr(at,D),worktreeMode:ee===null||ht?!1:D.worktreeMode});if(yt)return yt}let pt=_(lt,D.policy?.rules??[]);if(pt)return pt}return null}function mR(O,D,B,Q){if(B.length===0)return null;if(D===null){for(let he of B){let je=_([...O,...he.subcommand?[he.subcommand]:[],...he.block_args],B);if(je)return je}return null}let ee=kt(O[0]??"");if(!B.some((he)=>kt(he.command)===ee))return null;return O.slice(1).some((he)=>he.includes(D))?Q:null}function Mm(O,D,B){let Q=O.indexOf(D);if(Q===-1||O.indexOf(D,Q+D.length)!==-1)return[];let ee=bm(O,Q,D.length,B);return ee===null?[]:[ee]}function Dm(O,D,B,Q,ee,he,je){if(Kt.has(D)){if(Zn(O))return!1;if(B!==null&&gR(O,B,je))return!0;let at=Yn(O);if(!at){let lt=qn($t(O));if(lt.kind==="literal")return B!==null&&lt.source.includes(B);return lt.kind==="none"&&ee}if(B!==null&&at.includes(B)&&!Nm(at,B,je))return!0;if(xn(at))return!0;return hR(at,B,Q)}if(An(D))return Im(O,B,Vi,zd(D));if(En.has(D))return Im(O,B,Pl,Bf);if(D==="eval"){let at=vs($t(O));if(at.kind==="dynamic")return!0;if(B!==null)return at.kind==="literal"&&at.source.includes(B);return ee}if(D==="find")return yR(O,B,he);if(D==="git"){let at=Sn(O);return B===null?at.subcommand===null:(at.subcommand?.includes(B)??!1)||at.subcommand!==null&&Jr.has(at.subcommand.toLowerCase())&&Wm(at.rest,B).some((lt)=>lt.includes(B))}return!1}function Nm(O,D,B){if(B===void 0)return!1;let Q=D.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${Q}`).test(O)||/\bcase\b/.test(O))return!1;let he=O.replaceAll(D,"/");return xn(he)===null&&B(he)===null}function Im(O,D,B,Q){let ee=B(O);if(D===null)return ee.optionsOpen||B([...O,Rs]).sources.some((at)=>at.value===Rs);if(ee.sources.some((at)=>at.value.includes(D)))return!0;let he=Q.flatMap((at)=>[at.selector,...at.valueForm==="attached-only"||at.valueForm==="attached-or-separate"?[`${at.selector}${Rs}`]:[],...at.valueForm==="equals-or-separate"?[`${at.selector}=${Rs}`]:[]]),je=new Set(he.flatMap((at)=>O.flatMap((lt)=>Mm(lt,D,at))));return Ss(ee.sources,je,(at)=>B(O.map((lt)=>lt.replaceAll(D,at))).sources)}function pR(O,D,B){if(O.length===0||(O[0]??"").toLowerCase()==="command")return!1;let Q=new Set(Array.from(Mn(O,B),(he)=>he.head)),ee=D===null?[...O,_s]:O.map((he,je)=>je===0?he:he.replaceAll(D,_s));return Array.from(Mn(ee,B)).some((he)=>he.head===_s&&!Q.has(_s))}function Lm(O,D){return Wm(O.slice(1),D).some((B)=>B.includes(D)&&(B.startsWith("-")||B.startsWith(D)))}function Wm(O,D){let B=O.findIndex((Q)=>Q==="--"&&!Q.includes(D));return B===-1?O:O.slice(0,B)}function Gm(O,D,B){if(D===null)return!0;return O.some((Q)=>Q.includes(D))||Array.from(B.values()).some((Q)=>Q.includes(D))}function gR(O,D,B){let Q=hn(O),ee=Q.commandIndex===null?"":O[Q.commandIndex]??"";if(ee.includes(D)&&!Nm(ee,D,B)||Q.scriptIndex!==null&&(O[Q.scriptIndex]??"").includes(D))return!0;return["-c","-nc","-cn",`--${D}`,D].some((je)=>O.some((at,lt)=>{if(lt===0||!at.includes(D))return!1;return Mm(at,D,je).some((ut)=>{let ft=O.map((mt,pt)=>pt===lt?mt.replaceAll(D,ut):mt),dt=hn(ft);if(dt.commandIndex===null&&dt.scriptIndex===null)return!1;if(Q.commandIndex===null&&dt.commandIndex!==null)return!0;if(Q.scriptIndex===null&&dt.scriptIndex!==null)return!0;if(dt.commandIndex!==null&&(ft[dt.commandIndex]??"").includes(ut))return!0;return dt.scriptIndex!==null&&(ft[dt.scriptIndex]??"").includes(ut)})}))}function hR(O,D,B){let Q=new Set(D===null?[]:Array.from(B).filter(([,ee])=>ee.includes(D)).map(([ee])=>ee));for(let ee of O.matchAll(cR))if(km(ee,Q))return!0;for(let ee of O.matchAll(uR))for(let he of(ee[1]??"").matchAll(dR))if(km(he,Q))return!0;return ql(O,Q)}function km(O,D){let B=O[1]??O[2];return B!==void 0&&(fR.test(B)||D.has(B))}function yR(O,D,B){if(D===null)return!0;let Q=!1,ee=0;for(let he=1;he<O.length;he++){let je=O[he]??"";if(!Q&&!je.startsWith("-")&&je!=="!"&&je!=="("){if(je.indexOf(D)===0)return!0;continue}if(Q=!0,ee>0){ee--;continue}if(Kn(je)){let lt=Vo(O,he);he=lt.nextIndex-1;for(let ct of Mn(lt.tokens,{environment:B,cwd:void 0})){let ut=Gm(ct.tokens,D,ct.wrapperEnvAssignments);if(ct.head==="rm"&&Lm(ct.tokens,D)||Dm(ct.tokens,ct.head,D,ct.wrapperEnvAssignments,ut,B))return!0}continue}let at=sr(je);if(at>0){if(ee=at,je.includes(D))return!0;continue}if(je.includes(D))return!0}return!1}function Ir(O){let D=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),B=null,Q=1;while(Q<O.length){let ee=O[Q];if(!ee)break;if(ee==="--")return{childStart:Q+1,replacementToken:B};if(!ee.startsWith("-"))return{childStart:Q,replacementToken:B};if(ee==="-I"){B=O[Q+1]??"{}",Q+=2;continue}if(ee.startsWith("-I")&&ee.length>2){B=ee.slice(2),Q++;continue}if(ee==="--replace"){B="{}",Q++;continue}if(ee.startsWith("--replace=")){let he=ee.slice(10);B=he===""?"{}":he,Q++;continue}if(ee==="-J"){B=O[Q+1]??"{}",Q+=2;continue}Q+=D.has(ee)?2:1}return{childStart:O.length,replacementToken:B}}var Jo="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Qo="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",SR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",CR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Ps=/\{[^{}\s]*\}/g,Fm=/\{\}|\{-?\d+\}/g,vR=["e","f","source","file","-e","-f","--source","--file"],ER=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],xR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),RR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),zm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),_R=new Set(["--workdir","--wd"]),Bm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function _n(O,D){for(let B of O){let Q=D(B);if(Q)return Q}return null}function Vm(O){return _n([...O],(D)=>xn(D))}function Km(O,D){let B=O.map(t);if((D.envAssignments?.has("PARALLEL")?D.envAssignments.get("PARALLEL"):D.environment.env.get("PARALLEL"))?.trim()){let pt=eo(D);if(pt)return pt}if(B.length===2&&(B[1]==="--version"||B[1]==="--help"))return null;let ee=np(B),{template:he,jobs:je,runsRemotely:at,readsCommandsFromInput:lt,unsupported:ct,workdir:ut,dryRun:ft}=ee;if(ct){let pt=eo(D);if(pt)return pt;let gt=Vm(D.envAssignments?.values()??[]);if(gt)return gt}if(lt){let pt=kR(D);if(pt)return pt}if(ut!==void 0&&at){let pt=eo(D);if(pt)return pt}let dt=OR(ut,D.cwd,D.environment.paths);if(dt===null){let pt=eo(D);if(pt)return pt}let mt=at?{...D,cwd:void 0,originalCwd:void 0}:dt===null||dt===void 0||dt===D.cwd?D:{...D,cwd:dt};if(ft){if([...Mn(he,mt)].flatMap((gt)=>[...gt.envAssignments.values()]).some(Ql)){let gt=eo(D);if(gt)return gt}return null}if(he.length===0){let pt=je.map((ht)=>ht[0]??"");D.budget.charge("derivedTokens",pt.length);let gt=Xm(mt.envAssignments,mt.cwd,at);return _n(pt,(ht)=>D.analyzeNested(ht,gt))}return _n(Mn(he,mt),(pt)=>wR(pt,ee,D,mt))}function wR(O,D,B,Q){let{jobs:ee,templateHasPlaceholder:he,runsRemotely:je,usesStdin:at}=D,lt=O.tokens,ct=[...O.envAssignments.values()];if(ct.some(ep)){let ht=eo(B);if(ht)return ht}let ut=Vm(ct);if(ut)return ut;let ft=ct.some(Nt),dt=he||ft,mt=at&&dt,pt=Xm(O.envAssignments,O.wrapperCwd,je||mt);if(Kt.has(O.head)){let ht=()=>{if(!he||ee.length===0)return null;return _n(ee,(Et)=>B.analyzeChild(ws(lt,Et,B.budget),Pr(O,Q)))};if(Zn(lt))return ht();let yt=Yn(lt);if(yt){if(tp(yt)){let xt=cr(B);if(xt)return xt;if(ee.length===0)return null;return _n(ee,(_t)=>B.analyzeNested(Hm(yt,_t,B.budget),pt))}if(Nt(yt)){if(ee.length>0)return _n(ee,(Ut)=>B.analyzeNested(Hm(yt,Ut,B.budget),pt));let xt=Ko(yt);if(xt?.[0]&&kt(xt[0])==="rm"&&Dn(xt)){let Ut=Um(B);if(Ut)return Ut}let _t=xt?B.analyzeChild(xt,{...Pr(O,Q),dynamicInput:at,shellDynamicMatch:St("parallel.shell-dynamic",Qo),rmDynamicMatch:St("parallel.rm-recursive-force-dynamic",Jo)}):null;if(_t)return _t;return B.analyzeNested(yt,pt)}let Et=!ft&&(!he||ee.length>0)?(ee.length>0?ee:[void 0]).map((xt)=>Es($t(xt===void 0?lt:he?lt.map((_t)=>Jm(_t,xt)):[...lt,...xt]),yt)):[];if(Et.some((xt)=>xt.kind==="dynamic")){let xt=cr(B);if(xt)return xt}let vt=Et.flatMap((xt)=>xt.kind==="literal"?[xt.source]:[]);if(vt.length>0)return B.budget.charge("derivedTokens",vt.length),_n(vt,(xt)=>B.analyzeNested(xt,pt));if(Xo(yt)){let xt=cr(B);if(xt)return xt}let Pt=B.analyzeNested(yt,pt);if(Pt)return Pt;if(dt)return cr(B);return null}let Ct=qn($t(lt));if(Ct.kind==="dynamic"||Ct.kind==="literal"&&Nt(Ct.source))return cr(B)??ht();if(Ct.kind==="literal")return ht();if(ee.length>0){let Et=cr(B);if(Et)return Et;let vt=ht();if(vt)return vt;if(he)return null;let Pt=ee.flatMap((xt)=>xt[0]===void 0?[]:[xt[0]]);return B.budget.charge("derivedTokens",Pt.length),_n(Pt,(xt)=>B.analyzeNested(xt,pt))}if(dt||at)return cr(B)??ht();return null}if(O.head==="rm"&&Dn(lt)){if(he&&ee.length>0)return _n(ee,(yt)=>Xl(ws(lt,yt,B.budget,Fm),O.cwd,Q));if(ee.length>0)return _n(ee,(yt)=>Xl(jm(lt,yt,B.budget),O.cwd,Q));let ht=Xl(lt.flatMap((yt,Ct)=>{if(Ct===0||!Nt(yt))return[yt];return yt.startsWith("-")?[yt.replace(Fm,"")]:[]}),O.cwd,Q);if(ht)return ht;return Um(B)}let gt=ee.length>0?ee:[void 0];return _n(gt,(ht)=>{let yt=ht===void 0?lt:he?ws(lt,ht,B.budget):jm(lt,ht,B.budget),Ct=St("parallel.shell-dynamic",Qo),Et=at&&O.head==="find"?IR(yt,Q):null,vt=Ym(yt,at,B)??Et?.customResult??null,Pt=kt(O.head),xt=at&&(Pt==="rm"&&Jl(yt)||Pt==="xargs"&&Zm(yt)||Et?.rmOptions===!0),_t=at&&(xt||Et?.executedSource===!0||Et===null&&qm(yt,Pt)),Ut=B.analyzeChild(yt,{...Pr(O,Q),worktreeMode:je||at||dt?!1:B.worktreeMode,dynamicInput:at||dt,dynamicRmInput:xt,dynamicSourceInput:vt!==null||_t,shellDynamicMatch:Ct,dynamicSourceMatch:Ct,rmDynamicMatch:St("parallel.rm-recursive-force-dynamic",Jo)});if(_t){let jt=wt(Ct,B.policy);if(jt)return jt}return Ut??vt??_(yt,B.policy?.rules??[])})}function qm(O,D){if(Nt(O[0]??""))return!0;if(D==="eval"||D==="source"||D===".")return!0;if(D==="parallel"||D==="xargs")return!0;if(Kt.has(D))return TR(O);if(D==="git")return PR(O);if(D==="find")return!0;if(En.has(D))return $m(O,vR,jo);if(An(D))return $m(O,ER,ji);return!1}function Jl(O){let D=O.indexOf("--"),B=O.slice(1,D===-1?void 0:D);if(!O.some(Nt))return D===-1;return B.some((ee)=>Nt(ee)&&(ee.startsWith("-")||tp(ee)))}function PR(O){if(AR(O))return!0;let D=Sn(O);if(D.subcommand===null||Nt(D.subcommand))return!0;if(!Jr.has(D.subcommand.toLowerCase()))return!1;let B=D.rest.indexOf("--"),Q=D.rest.slice(0,B===-1?void 0:B);if(!O.some(Nt))return B===-1;return Q.some(Nt)}function AR(O){for(let D=1;D<O.length;D++){let B=O[D];if(!B||B==="--"||!B.startsWith("-"))return!1;if(B==="-c"||B==="--config-env"){if(Nt(O[D+1]??""))return!0;D++;continue}if(B.startsWith("-c")&&B.length>2||B.startsWith("--config-env=")){if(Nt(B))return!0;continue}if(Nt(B))return!0}return!1}function TR(O){if(Zn(O))return!1;let D=Yn(O);if(D!==null)return Nt(D);let B=qn($t(O));if(B.kind==="literal")return Nt(B.source);if(B.kind==="dynamic")return!0;return!O.some(Nt)}function $m(O,D,B){let Q=B(O);if(Q.some((ee)=>Nt(ee.value)))return!0;if(!O.some(Nt))return B([...O,Bm]).some((ee)=>ee.value===Bm);return Ss(Q,D,(ee)=>B(O.map((he)=>Jm(he,[ee]))))}function Ym(O,D,B){let Q=B.policy?.rules??[];if(!D||Q.length===0)return null;let ee=Q.filter((he)=>kt(he.command)===kt(O[0]??""));if(ee.length===0)return null;if(O.slice(1).some(Nt))return cr(B);return _n(ee,(he)=>_([...O,...he.subcommand?[he.subcommand]:[],...he.block_args],[he]))}function IR(O,D){let B={customResult:null,executedSource:!O.some(Nt),rmOptions:!1},Q=!1,ee=0,he=null,je=()=>{if(!he?.some(Nt))return;for(let at of Mn(he,D))B.executedSource||=qm(at.tokens,at.head),B.rmOptions||=at.head==="rm"&&Jl(at.tokens)||at.head==="xargs"&&Zm(at.tokens),B.customResult??=Ym(at.tokens,!0,D)};for(let at of O.slice(1)){if(!Q&&!at.startsWith("-")&&at!=="!"&&at!=="("){B.executedSource||=Nt(at);continue}if(Q=!0,he){if(at===";"||at==="+"){je(),he=null;continue}he.push(at);continue}if(ee>0){ee--;continue}if(Kn(at)){he=[],B.executedSource||=Nt(at);continue}let lt=sr(at);if(lt>0){ee=lt,B.executedSource||=Nt(at);continue}B.executedSource||=Nt(at)}return je(),B}function Zm(O){let D=O.slice(Ir(O).childStart);return kt(D[0]??"")==="rm"&&Jl(D)}function As(O,D){return(B)=>wt(St(O,D),B.policy)}var cr=As("parallel.shell-dynamic",Qo),kR=As("parallel.command-stream-dynamic",SR),eo=As("parallel.command-stream-dynamic",CR),Um=As("parallel.rm-recursive-force-dynamic",Jo);function Xl(O,D,B){return wt(Cs($t(O),{environment:B.environment,cwd:D,budget:B.budget,originalCwd:B.originalCwd,strict:B.strict,paranoid:B.paranoidRm,allowTmpdirVar:B.allowTmpdirVar,tmpdirWordSplittingUnsafe:ir(B.envAssignments??new Map,B.environment),trustedTmpdirValue:xr(B.envAssignments??new Map,B.environment),protectedGitMetadata:B.protectedGitMetadata,policy:B.policy}),B.policy)}function Xm(O,D,B){let Q={};if(O)Q.envAssignments=O;if(B)return Q.effectiveCwd=null,Q.worktreeMode=!1,Q;if(D!==void 0)Q.effectiveCwd=D;return Object.keys(Q).length>0?Q:void 0}function Jm(O,D){return O.replace(Ps,(B)=>Qm(B,D))}function ws(O,D,B,Q=Ps){return B.charge("derivedTokens",O.reduce((ee,he)=>ee+1+Math.floor(he.length/64),0)),O.map((ee)=>ee.replace(Q,(he)=>{let je=Qm(he,D);return B.charge("derivedTokens",Math.max(1,Math.ceil(je.length/64))),je}))}function Hm(O,D,B){return ws([O],D,B)[0]??""}function jm(O,D,B){return B.charge("derivedTokens",O.length+D.length),[...O,...D]}function Qm(O,D){let B=/^\{(-?\d+)[^{}\s]*\}$/.exec(O)?.[1];if(B===void 0)return D[0]??"";let Q=Number(B);return D[Q>0?Q-1:D.length+Q]??""}function Nt(O){return O.search(Ps)!==-1}function ep(O){if(Ql(O))return!0;for(let D of O.matchAll(Ps))if(!/^(?:\{\}|\{\d+\})$/.test(D[0]))return!0;return!1}function Ql(O){let D=O.indexOf("{=");return D!==-1&&O.indexOf("=}",D+2)!==-1}function tp(O){return/^\{[^{}\s]*\}$/.test(O)}function OR(O,D,B){if(O===void 0)return;if(O==="..."||/^~|[{}$`*?[]/.test(O))return null;if(!D&&!bR(O))return null;try{return nr(D??O,O,B)}catch{return null}}function np(O){let D=1,B=[],Q=O.length,ee=-1,he=!1,je=!1,at,lt=!1,ct=O.some((pt)=>pt==="::::"||pt==="::::+"||pt===":::+");while(D<O.length){let pt=O[D];if(pt===void 0)break;if(pt===":::"){ee=D;break}if(pt==="--"){let Et=Il(O,D+1);B.push(...Et.templateTokens),Q=D+1,ee=Et.markerIndex;break}if(!pt.startsWith("-")){let Et=Il(O,D);B.push(...Et.templateTokens),Q=D,ee=Et.markerIndex;break}let gt=O[D+1],ht=pt.indexOf("="),yt=ht===-1?pt:pt.slice(0,ht),Ct=ht===-1?void 0:pt.slice(ht+1);if(pt==="--dry-run"){lt=!0,D++;continue}if(pt==="-I"||pt.startsWith("-I")&&pt.length>2){ct||=(pt==="-I"?gt:pt.slice(2))!=="{}",D+=pt==="-I"?2:1;continue}if(pt==="--replace"||pt==="-i"){ct=!0,D+=2;continue}if(yt==="--replace"||pt.startsWith("-i")&&pt.length>2){let Et=yt==="--replace"?Ct:pt.slice(2);ct||=Et!==""&&Et!=="{}",D++;continue}if(pt==="-a"||RR.has(yt)){ct=!0,D+=Ct===void 0?2:1;continue}if(pt==="--pipe"||pt==="--pipepart"){je=!0,D++;continue}if(yt==="--env"){ct=!0,D+=Ct===void 0?2:1;continue}if(zm.has(yt)||pt.startsWith("-S")&&pt.length>2){he=!0,D+=zm.has(pt)?2:1;continue}if(_R.has(yt)){ct=!0;let Et=Ct??gt;if(Et===void 0||Et===":::"||Et==="--"){D++;continue}at=Et,D+=Ct===void 0?2:1;continue}if(pt.startsWith("-j")&&pt.length>2&&/^\d+$/.test(pt.slice(2))){D++;continue}if(pt.startsWith("--")&&Ct!==void 0){D++;continue}if(xR.has(pt)){if(gt===void 0||gt===":::"||gt==="--"){ct=!0,D++;continue}D+=2;continue}D+=pt==="-j"||pt==="--jobs"?2:1}ct||=B.some(lt?Ql:ep);let ut=[];if(ee!==-1){let pt=[];for(let gt=ee+1;gt<O.length;gt++){let ht=O[gt];if(ht===":::"){ut.push(pt),pt=[];continue}if(ht!==void 0)pt.push(ht)}ut.push(pt)}ct||=ut.length>1;let ft=MR(ut),dt=B.some(Nt),mt=B.length===0&&ee===-1;return{template:B,jobs:ft,childStart:Q,templateHasPlaceholder:dt,runsRemotely:he,usesStdin:je||ee===-1,readsCommandsFromInput:mt,unsupported:ct,workdir:at,dryRun:lt}}function MR(O){if(O.length===0||O.some((B)=>B.length===0))return[];let D=[[]];for(let[B,Q]of O.entries()){if(Q.length===1){let he=Q[0];if(he===void 0)return[];for(let je of D)je.push(he);if(D.length*(B+1)>a.derivedTokens.cap)throw new s("derivedTokens");continue}let ee=[];for(let he of D)for(let je of Q){if((ee.length+1)*(B+1)>a.derivedTokens.cap)throw new s("derivedTokens");ee.push([...he,je])}D=ee}return D}function rp(O){return np(O).childStart}var DR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Ts="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function tc(O){return O?.parts.some((D)=>D.provenance==="command-substitution")??!1}function ec(O){return O?.parts.some((D)=>D.provenance==="literal"&&D.raw.replace(/^["']/,"").startsWith("-"))??!1}function ip(O,D,B,Q,ee=!1,he){let at=(xo(O,D)||Q&&O!=="powershell"&&D[0]?.provenance==="variable")&&Jt(he,"shell.dynamic-executable",ee)?St("shell.dynamic-executable",DR):null;return wt(at,he)??sp(O,D,B,ee,he)}function sp(O,D,B,Q,ee){if(D.length<2)return null;let he=D.flatMap((at,lt)=>tc(at)?[lt]:[]);if(he.length===0)return null;let je=kt(D[0]?.text??"");if(je==="git"){let at=X(O,D),lt=LR(at);if(Jt(ee,"shell.dynamic-structure",Q)&&he.some((ft)=>ft<=lt))return wt(St("shell.dynamic-structure",Ts),ee);if(wt(bs(at,{environment:B}),ee))return null;let ct=D[lt]?.text.toLowerCase(),ut=at.findIndex((ft,dt)=>dt>lt&&t(ft)==="--");if(Jt(ee,"shell.dynamic-structure",Q)&&ct&&Jr.has(ct)&&he.some((ft)=>ft>lt&&(ut===-1||ft<ut)))return wt(St("shell.dynamic-structure",Ts),ee);return null}if(je==="find")return Jt(ee,"shell.dynamic-structure",Q)&&WR(D)?wt(St("shell.dynamic-structure",Ts),ee):null;if(je==="rm"){let at=D.findIndex((ct,ut)=>ut>0&&t(ct)==="--"),lt=Dn(D.map(t));return Jt(ee,"shell.dynamic-structure",Q)&&he.some((ct)=>(at===-1||ct<at)&&(ct<D.length-1||!lt))?wt(St("shell.dynamic-structure",Ts),ee):null}if(je==="xargs")return op(O,D.slice(Ir(D.map(t)).childStart),"xargs",B,Q,ee);if(je==="parallel")return op(O,D.slice(rp(D.map(t))),"parallel",B,Q,ee);return null}function op(O,D,B,Q,ee,he){if(D.length===0)return null;let je=NR(D,Q);if(xo(O,je)){let lt=wt(St(`${B}.shell-dynamic`,B==="xargs"?Zl:Qo),he);if(lt)return lt}let at=sp(O,je,Q,ee,he);if(at)return at;if(je[0]?.text==="rm"&&je.slice(1).some((lt)=>tc(lt)&&ec(lt)))return wt(St(`${B}.rm-recursive-force-dynamic`,B==="xargs"?Yl:Jo),he);return null}function NR(O,D){let B=Sr(O,D),Q=B.rewritten?$t(B.words.map(t)):B.words,ee=Q[0];return ee&&t(ee)==="busybox"?Q.slice(1):Q}function LR(O){let D=1;while(D<O.length){let B=O[D],Q=B?t(B):"";if(gn.has(Q)){D+=2;continue}if(Q.startsWith("-")){D++;continue}return D}return D}function WR(O){let D=!1,B=0,Q=!1,ee=!1;for(let he=1;he<O.length;he++){let je=O[he];if(!je)continue;let at=tc(je);if(B>0){B--;continue}if(ee){if(je.text===";"||je.text==="+"){ee=!1,D=!0,Q=!1;continue}if(at&&(Q||ec(je)))return!0;Q=!1;continue}if(!D&&!je.text.startsWith("-")){if(at&&(he>1||ec(je)))return!0;continue}if(D=!0,at)return!0;let lt=sr(je.text);if(lt>0){B=lt;continue}if(Kn(je.text))ee=!0,Q=!0}return!1}function nc(O,D){return O.some((B)=>{if(B.value==="-"&&(B.kind==="main-script"||B.kind==="program-file"))return!0;return!Bi(D[B.tokenIndex],B.value)})}var GR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",FR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",zR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function ap(O,D){let B=D.slice(1);if(O==="dd"&&B.some((Q)=>/^of=\/dev\/.+/.test(Q)))return St("dd.device-write",GR);if((O==="mkfs"||O.startsWith("mkfs."))&&B.some((Q)=>Q.startsWith("/dev/")))return St("mkfs.device",FR);if(O==="shred"&&B.length>0)return St("shred.target",zR);return null}var cp=[{heads:new Set(["rm","rmdir"]),analyze:(O)=>Cs(O.words,{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,paranoid:O.options.paranoidRm,allowTmpdirVar:O.allowTmpdirVar,tmpdirWordSplittingUnsafe:ir(O.envAssignments,O.options.environment),trustedTmpdirValue:xr(O.envAssignments,O.options.environment),protectedGitMetadata:O.options.protectedGitMetadata,policy:O.options.policy,budget:O.options.budget})},{heads:new Set(["git"]),analyze:(O)=>bs(O.words,rc(O))},{heads:new Set(["find"]),analyze:(O)=>Kf(O.words,{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,allowTmpdirVar:O.allowTmpdirVar,tmpdirWordSplittingUnsafe:ir(O.envAssignments,O.options.environment),trustedTmpdirValue:xr(O.envAssignments,O.options.environment),protectedGitMetadata:O.options.protectedGitMetadata,budget:O.options.budget,envAssignments:O.envAssignments,policy:O.options.policy,analyzeTokens:O.analyzeChildTokens,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})},{heads:new Set(["xargs"]),analyze:(O)=>Om(O.words,{...lp(O),analyzeChild:O.analyzeChild,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})},{heads:new Set(["parallel"]),analyze:(O)=>Km(O.words,{...lp(O),analyzeChild:O.analyzeChild,analyzeNested:(D,B)=>kr(O.options.analyzeNested(D,B))})}];function lp(O){return{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,strict:O.options.strict,paranoidRm:O.options.paranoidRm,paranoidInterpreters:O.options.paranoidInterpreters,allowTmpdirVar:O.allowTmpdirVar,protectedGitMetadata:O.options.protectedGitMetadata,budget:O.options.budget,envAssignments:O.envAssignments,worktreeMode:O.options.worktreeMode,policy:O.options.policy}}function kr(O){return O?{id:O.ruleId??"",reason:O.reason,intent:O.intent??"manual_only"}:null}function rc(O){return{environment:O.options.environment,cwd:O.cwd,originalCwd:O.originalCwd,dynamicArguments:O.dynamicArguments,envAssignments:O.envAssignments,shellAssignments:O.options.shellAssignments,policy:O.options.policy,worktreeMode:O.options.worktreeMode}}function mp(O){return cp.find((D)=>D.heads.has(O))?.analyze}function no(O,D,B){let Q=B.trace;if(O.length===0)return null;let ee=B.commandView?.dialect??"posix",he=(Rt)=>Rt.map((At)=>ee==="posix"?t(At):At.text),je=B.child,at=je!==void 0&&!je.embedded,lt=je?.embedded===!0,ct=B.effectiveCwd===null,ut=je?je.cwd:ct?void 0:B.effectiveCwd??B.cwd,ft=je?je.originalCwd:ct?void 0:B.cwd,dt=ge(O);if(dt.envAssignments.size>0)Q?.recordSegment({type:"env-strip",input:he(O),envVars:[...dt.envAssignments.keys()],output:he(dt.words)});let mt=Sr(dt.words,B.environment,ut,new Map([...B.envAssignments??[],...dt.envAssignments])),pt=mt.envSplitValues??[];if(pt.length>0){let Rt=[...pt,...he(mt.words)].join(" "),At=xn(Rt);if(At)return Q?.recordSegment({type:"dangerous-text",token:Rt,matched:!0,reason:At.reason}),sn(At);if(B.strict)return fn(Q);let Mt=Yi(pt,he(mt.words));if(Mt){B.budget.charge("derivedTokens",Mt.length);let Yt=B.analyzeNested(Mt.join(" "),{effectiveCwd:mt.cwd===void 0?B.effectiveCwd:mt.cwd,envAssignments:new Map([...B.envAssignments??[],...dt.envAssignments,...mt.envAssignments])});if(Yt)return Yt}}let gt=mt.rewritten?$t(he(mt.words)):X(ee,mt.words),ht=he(gt),yt={...B,wrapperNormalizationBudget:B.wrapperNormalizationBudget??{iterations:0}};if(Q&&dt.words.length>gt.length){let Rt=he(dt.words);Q.recordSegment({type:"leading-tokens-stripped",input:Rt,removed:Rt.slice(0,Rt.length-gt.length),output:ht})}let Ct=new Map([...B.envAssignments??[],...dt.envAssignments,...mt.envAssignments]),Et=ht[0];if(!Et)return null;if(wr(Et))throw new s("wrapperPeelIterations");let vt=kt(Et),Pt=mt.cwd===null?void 0:mt.cwd??ut,xt=mt.cwd===null?void 0:ft,_t=mt.cwd===void 0?B.effectiveCwd:mt.cwd,Ut=je?je.allowTmpdirVar:!zo(Ct,B.environment),jt=ip(ee,mt.words,B.environment,D===0,B.strict,B.policy);if(jt)return Q?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:jt.reason}),sn(jt);let qt=fs(ht,B.policy);if(qt){for(let Rt of[qt.childIndex,...qt.alternativeChildIndices]){up(yt.wrapperNormalizationBudget);let At=gt.slice(Rt);Q?.recordSegment({type:"transparent-wrapper",wrapper:qt.wrapper,output:he(At)});let Mt=no(At,D,{...yt,effectiveCwd:_t,envAssignments:Ct});if(Mt)return Mt}return null}let Vt=lt?void 0:vt==="eval"?vs(gt):vt==="trap"&&!at?_m(gt):void 0;if(at&&je&&vt==="eval"){if(Vt?.kind==="dynamic")return to(je,B.policy);if(Vt?.kind==="literal"){let Rt=B.analyzeNested(Vt.source,{effectiveCwd:_t,envAssignments:Ct});if(Rt)return Rt}return ro(je,B.policy)}if(Vt?.kind==="dynamic"&&(B.strict||!B.commandView||!Kl(B.commandView)))return fn(Q);if(Vt?.kind==="literal"){Q?.recordSegment({type:"recurse",reason:vt==="eval"?"shell-eval":"shell-trap",innerCommand:Vt.source,depth:D+1});let Rt=B.analyzeNested(Vt.source,{effectiveCwd:_t,envAssignments:Ct,functionDefinitions:B.functionDefinitions});if(Rt)return Rt}if(at?Kt.has(vt):gp(Et,vt)){if(Zn(ht))return null;if(at&&je){let Rt=Yn(ht);if(Rt){if(je.dynamicSourceInput??je.dynamicInput){let Mt=to(je,B.policy);if(Mt)return Mt}if(Xo(Rt)){let Mt=to(je,B.policy);if(Mt)return Mt}return B.analyzeNested(Rt,{effectiveCwd:_t,envAssignments:Ct})}let At=qn(gt);if(At.kind==="dynamic")return to(je,B.policy);if(At.kind==="literal")return je.dynamicSourceInput?to(je,B.policy):null;return je.dynamicSourceInput??je.dynamicInput?to(je,B.policy):null}if(lt){let Rt=Yn(ht),At=Rt?B.analyzeNested(Rt,{effectiveCwd:_t,envAssignments:Ct}):qn(gt).kind==="dynamic"?fn(Q):null;if(At)return At}if(je===void 0){let Rt=HR(ht,Ct,_t,B,Q,D);if(Rt)return Rt;let At=Yn(ht);if(At){let Dr=Es(gt,At);if(Dr.kind==="dynamic")return fn(Q);let js=Dr.kind==="literal"?Dr.source:At,Ac=jR(js);Q?.recordSegment({type:"shell-wrapper",wrapper:vt,innerCommand:Ac}),Q?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Ac,depth:D+1});let Tc=B.analyzeNested(js,{effectiveCwd:_t,envAssignments:Ct});if(Tc)return Tc;return Xo(js)?fn(Q):null}let Mt=qn(gt);if(Mt.kind==="dynamic")return fn(Q);if(Mt.kind==="literal")return Is(Mt.source,_t,Ct,B,Q,D);let Yt=wm(gt,B.commandView?.redirections??[],B.hasPipelineInput??!1,B.literalShellInput);if(Yt.kind==="dynamic")return fn(Q);if(Yt.kind==="literal")return Q?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Yt.source,depth:D+1}),B.analyzeNested(Yt.source,{effectiveCwd:_t,envAssignments:Ct})}}if(!je&&(vt==="source"||vt===".")){let Rt=ht[1]==="-p"?2:null;if(Rt!==null){let Dr=B.commandView?gt[Rt]:void 0;if(!Dr)return null;if(Dr.provenance!=="literal")return fn(Q)}let At=Rt===null?1:3,Mt=ht[At]==="--"?At+1:At,Yt=B.commandView?gt[Mt]:void 0;if(!Yt)return null;if(Yt.provenance==="literal")return Is(Yt.text,_t,Ct,B,Q,D);if(B.strict||!B.commandView||!Kl(B.commandView))return fn(Q)}if(En.has(vt)&&!lt){if(!je&&B.strict&&nc(jo(ht),gt))return fn(Q);let Rt=$f(ht,(Mt)=>kr(B.analyzeNested(Mt,{effectiveCwd:_t,envAssignments:Ct}))),At=wt(Rt,B.policy);if(At)return Q?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:At.reason}),sn(At)}if(An(vt)&&!lt){if(!je&&B.strict&&nc(ji(ht),gt))return fn(Q);let Rt=Fd(ht);if(at&&je)return $R(vt,Rt,_t,Ct,B,je);if(Rt){let At=Jt(B.policy,"interpreter.one-liner-paranoid",!!B.paranoidInterpreters);if(Q?.recordSegment({type:"interpreter",interpreter:vt,codeArg:Rt,paranoidBlocked:At}),At){let Yt=wt(St("interpreter.one-liner-paranoid",ko),B.policy);if(Yt)return sn(Yt)}if(sl(vt,Rt))return null;Q?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:Rt,depth:D+1});let Mt=B.analyzeNested(Rt,{effectiveCwd:_t,envAssignments:Ct});if(Mt&&!pp(Mt,Rt))return Mt;if(Oo(Rt,void 0,!B.strict)){let Yt=wt(St("interpreter.dangerous-command",Kr),B.policy);if(Yt)return Q?.recordSegment({type:"dangerous-text",token:Rt,matched:!0,reason:Kr}),sn(Yt)}Q=void 0}}if(vt==="busybox"&&ht.length>1)return up(yt.wrapperNormalizationBudget),Q?.recordSegment({type:"busybox",subcommand:ht[1]??"unknown"}),Q?.recordSegment({type:"recurse",reason:"busybox",innerCommand:ht.slice(1).join(" "),depth:D+1}),no(gt.slice(1),D,{...yt,effectiveCwd:_t,envAssignments:Ct});let Ot=je?null:wt(ap(vt,ht),B.policy);if(Ot)return Q?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:Ot.reason}),sn(Ot);let on=Q===yt.trace?yt:{...yt,trace:Q},Cn={words:gt,head:vt,cwd:Pt,originalCwd:xt,envAssignments:Ct,allowTmpdirVar:Ut,dynamicArguments:mt.words.some((Rt)=>Rt.provenance==="command-substitution"),depth:D,effectiveCwd:_t,options:on,analyzeChildTokens:(Rt,At)=>at&&je?oc(Rt,D,on,{...je,cwd:At??void 0,effectiveCwd:At??void 0}):kr(no($t(Rt),D+1,{...on,child:void 0,commandView:void 0,effectiveCwd:At,envAssignments:Ct}))??_(Rt,on.policy.rules),analyzeChild:(Rt,At)=>oc(Rt,D,on,At)},Bn=je&&(vt==="xargs"||vt==="parallel")?void 0:mp(vt);if(vt==="rm"||vt==="xargs"||vt==="parallel")Q?.recordSegment({type:"tmpdir-check",tmpdirValue:Ct.has("TMPDIR")||B.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Ut});let wn=Q&&vt==="git"?ym(Cn.words,rc(Cn)):void 0,Us=dp(wn?wn.match:Bn?.(Cn)??null,B.policy);if(Q)VR(Cn,Us,wn?.relaxation??null);if(Us)return sn(Us);if(at&&je&&(vt==="rm"||vt==="rmdir")){if(!(vt==="rm"&&(Dn(ht)||je.dynamicRmInput)))return null;return(je.dynamicRmInput?ro(je,B.policy):null)??UR(je,B.policy)}let wc=Bn!==void 0,Pc=!je&&!wc&&!bi.has(vt),Hs=Q&&Pc?[]:void 0;if(Pc)for(let Rt=1;Rt<ht.length;Rt++){let At=ht[Rt];if(!At)continue;Hs?.push(At);let Mt=dp(BR(ht,Rt,D,on,Pt,xt,_t,Ct),B.policy);if(Mt)return Q?.recordSegment({type:"fallback-scan",tokensScanned:Hs??[],embeddedCommandFound:kt(At)}),sn(Mt)}if(Q?.recordSegment({type:"fallback-scan",tokensScanned:Hs??[]}),lt&&je&&!je.wrappedByTransparent)return null;if(!je&&D!==0&&wc)return Q?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let si=_(ht,B.policy.rules);if(Q?.recordSegment({type:"custom-rules-check",rulesChecked:B.policy.rules.length>0,matched:!!si,reason:si?.reason}),si)return sn(si);return at&&je?ro(je,B.policy):null}function oc(O,D,B,Q){return kr(no($t(O),D+1,{...B,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:Q.originalCwd,effectiveCwd:Q.effectiveCwd,envAssignments:Q.envAssignments,worktreeMode:Q.dynamicInput?!1:Q.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:Q}))}function BR(O,D,B,Q,ee,he,je,at){for(let lt of Mn(O.slice(D),{environment:Q.environment,cwd:ee,envAssignments:at,policy:Q.policy})){let ct=lt.tokens[0];if(!ct)continue;let ut=kt(ct);if(gp(ct,ut)||mp(ut)!==void 0&&ut!=="xargs"&&ut!=="parallel"||lt.wrappedByTransparent&&Q.policy.rules.length>0)Q.budget.charge("derivedTokens",O.length-D);let dt=oc(lt.tokens,B,Q,{embedded:!0,cwd:lt.cwd,originalCwd:lt.wrapperCwd===null?void 0:he,effectiveCwd:lt.wrapperCwd===void 0?je:lt.wrapperCwd,envAssignments:lt.envAssignments,allowTmpdirVar:!zo(lt.envAssignments,Q.environment),worktreeMode:!1,wrappedByTransparent:lt.wrappedByTransparent});if(dt)return dt}return null}function $R(O,D,B,Q,ee,he){if(!D)return ro(he,ee.policy);if(Jt(ee.policy,"interpreter.one-liner-paranoid",!!ee.paranoidInterpreters)){let at=wt(St("interpreter.one-liner-paranoid",ko),ee.policy);if(at)return sn(at)}if(sl(O,D))return ro(he,ee.policy);let je=ee.analyzeNested(D,{effectiveCwd:B,envAssignments:Q});if(je&&!pp(je,D))return je;if(Oo(D,void 0,!ee.strict)){let at=wt(St("interpreter.dangerous-command",Kr),ee.policy);if(at)return sn(at)}return ro(he,ee.policy)}function pp(O,D){if(O.ruleId==="raw-text.dangerous-command")return!0;return(O.reason.startsWith(cs)||O.reason===Xr)&&!Si(D)}function to(O,D){let B=O.shellDynamicMatch?wt(O.shellDynamicMatch,D):null;return B?sn(B):null}function ro(O,D){let B=O.dynamicSourceInput&&O.dynamicSourceMatch?wt(O.dynamicSourceMatch,D):null;return B?sn(B):null}function UR(O,D){let B=O.dynamicInput&&O.rmDynamicMatch?wt(O.rmDynamicMatch,D):null;return B?sn(B):null}function HR(O,D,B,Q,ee,he){let je=Tm(O);if(je.argvSource?.kind==="absent")return fn(ee);if(je.argvSourceApplies&&je.argvSource){let lt=Is(je.argvSource.value,B,D,Q,ee,he,!0);if(lt)return lt}if(!je.envSourceApplies||!je.envName)return null;let at=D.get(je.envName);if(!at)return null;return Is(at,B,D,Q,ee,he,!0)}function Is(O,D,B,Q,ee,he,je=!1){if(je&&/[$`*?[\]]/.test(O))return fn(ee);let at=Io(O,D,Q.environment.paths,Q.budget),lt=at?Q.literalHeredocFiles?.get(at):void 0;if(lt===void 0)return je?fn(ee):null;return Q.budget.charge("derivedTokens",1),ee?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:lt,depth:he+1}),Q.analyzeNested(lt,{effectiveCwd:D,envAssignments:B})}function jR(O){let D=O[0];return O.length>=2&&(D==='"'||D==="'")&&O.at(-1)===D?O.slice(1,-1):O}function VR(O,D,B){let Q={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[O.head];if(!Q)return;if(O.options.trace?.recordSegment({type:"rule-check",rule:Q,matched:!!D||!!B,reason:D?.reason??B?.originalReason}),B)O.options.trace?.recordSegment({type:B.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:B.originalReason,gitCwd:B.gitCwd})}function up(O){if(O.iterations>=a.wrapperPeelIterations.cap)throw new s("wrapperPeelIterations");O.iterations++}function sn(O){return{reason:O.reason,ruleId:O.id||void 0,intent:O.intent}}function fn(O){return O?.recordSegment({type:"error",message:Uo}),sn(KR())}function KR(){return{id:"",reason:Uo,intent:"stop_and_explain"}}function gp(O,D){return Kt.has(D)||O==="$SHELL"||O==="${SHELL}"||Kt.has(Tt(D))}function dp(O,D){return O?.id.startsWith("custom.")||O?.id==="raw-text.dangerous-command"?O:wt(O,D)}var qR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,YR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function ZR(O,D){let B=bp(O,D);if(B.length===0)return!1;let Q=B[yp(B)];if(Q==="cd"||Q==="pushd"||Q==="popd")return!0;return qR.test(O.join(" "))}function hp(O,D,B,Q,ee){if(O.dialect==="powershell"){let ht=JR(O.words,ee);if(ht.kind==="none")return;if(!D||ht.kind==="unknown")return null;return fp(n_(ht.target),D,B.paths)}let he=O.words.map(t),je=he.some((ht)=>/^CDPATH\+?=/.test(ht));if(!ZR(he,B))return je?null:void 0;if(!D)return null;let at=bp(he,B,D),lt=yp(at);if(lt===-1||at[lt]!=="cd")return null;let ct=at.slice(lt+1),ut=ct.findIndex((ht)=>ht.length<=1||!ht.startsWith("-")||ht==="--");if((ut===-1?ct:ct.slice(0,ut)).some((ht)=>!/^-[LP]+$/.test(ht)))return null;let dt=ut===-1?[]:ct.slice(ut),mt=dt[0]==="--"?dt.slice(1):dt;if(mt.length!==1)return null;let pt=mt[0]??"",gt=O.words.some((ht)=>ht.provenance==="variable"&&ht.text===pt)?XR(pt,Q):pt;if(gt===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(gt)&&(je||B.env.has("CDPATH")))return null;return fp(gt,D,B.paths)}function XR(O,D){let B=qo(O,D);return B.startsWith("~")||/[\s$`*?[]/.test(B)?null:B}function fp(O,D,B){if(!O||O==="-"||O.includes("$")||O.includes("`"))return null;try{return nr(D,O,B)}catch{return null}}function JR(O,D){let B=QR(O[0])?1:0,Q=O[B];if(!e_(Q,B===1))return{kind:"none"};let ee=Q.text.toLowerCase(),he=ee.split(/[\\/]/).pop()??ee;if(!YR.has(he))return{kind:"none"};if(ee!==he||he==="pop-location"||he==="popd")return{kind:"unknown"};return t_(O.slice(B+1),D)}function QR(O){return O?.provenance==="literal"&&!O.quoted&&O.raw===O.text&&(O.text==="&"||O.text===".")}function e_(O,D){return O?.provenance==="literal"&&(D||!O.quoted&&O.raw===O.text)}function t_(O,D){let B;for(let Q of O){if(Q.provenance!=="literal"||B!==void 0)return{kind:"unknown"};B=Q.text}if(B!==void 0)return{kind:"target",target:B};return D===void 0?{kind:"unknown"}:{kind:"target",target:D}}function n_(O){return O.includes("::")?void 0:O.replaceAll("\\","/")}function yp(O){let D=0;if(O[0]==="builtin"&&O.length>1)D=1;if(O[D]!=="time")return D;let B=D+1;while(O[B]?.startsWith("-"))B++;return B}function bp(O,D,B){let Q=r_(O);return rr([...Q],D,B)}function r_(O){let D=0;while(D<O.length){let B=O[D];if(B!=="{"&&B!=="("&&B!=="$(")break;D++}return O.slice(D)}var o_="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Or="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function cc(O,D,B,Q){if(D>=a.recursionDepth.cap)return B.trace?.recordSegment({type:"error",message:Wn}),{reason:Wn,segment:O,intent:"stop_and_explain"};let ee=Q??B.factStore?.getCommandProgram(O,B.shell??"auto")??h(O,B.shell);if(ee.status==="limited")return B.trace?.recordSegment({type:"error",message:Wn}),{reason:Wn,segment:O,intent:"stop_and_explain"};if(ee.status==="invalid"){let ct=ee.issues.find((ut)=>ut.code.includes("heredoc"));if(ct){if(!B.strict)return lc(O,B);let ut=`${cs}: ${ct.message}`;return B.trace?.recordGlobal({type:"error",message:ut}),{reason:ut,segment:O,intent:"stop_and_explain"}}return Rp(O,B),{reason:Xr,segment:O,intent:"stop_and_explain"}}if(B.strict&&ee.status==="partial")return Rp(O,B),{reason:Xr,segment:O,intent:"stop_and_explain"};if(ee.issues.some((ct)=>ct.code.includes("quote")))return lc(O,B);let je=B.cwd,at=B.effectiveCwd!==void 0?B.effectiveCwd:B.cwd,lt=im(B.environment.env,B.envAssignments);return Ms(ee,D,{...B,rootProgram:ee},je,[{effectiveCwd:at,shellGitContextState:lt,literalHeredocFiles:new Map(B.literalHeredocFiles),functionDefinitions:new Map(B.functionDefinitions)}]).result}function Ms(O,D,B,Q,ee){let he=[...ee],je,at;for(let[lt,ct]of O.nodes.entries()){if(ct.kind==="connector"){at=ct.operator;continue}let ut=O.nodes[lt+1],ft=ut?.kind==="connector"?ut.operator:void 0,dt=i_(O,lt,ct,at,ft),mt=at==="&&"||at==="||",pt=mt?je:void 0,gt=at==="&&"?pt?.success??he:at==="||"?pt?.failure??he:he,ht=at==="||"?pt?.success??[]:[],yt=at==="&&"?pt?.failure??[]:[],Ct=mt||io(ft);if(ct.kind==="function"){let jt=gt.flatMap((Vt)=>{let Ft=so(Vt);return Ft.functionDefinitions.set(ct.name,ct.body),ic(Vt,[Ft],dt,ft==="&",io(ft))}),qt=sc(jt,[],ht,yt,at,ft);he=qt.states,je=qt.conditionalStates,at=void 0;continue}if(ct.kind==="group"){let jt=[],qt=[];for(let Ft of gt){let Ot=Ms(ct.body,D,B,Q,[so(Ft)]);if(Ot.result)return Ot;if(jt.push(...ic(Ft,Ot.states,dt,ft==="&",io(ft))),Ct)qt.push(Ft,...dt?Ot.states.map((on)=>ks(Ft,on)):Ot.states)}let Vt=sc(jt,qt,ht,yt,at,ft);he=Vt.states,je=Vt.conditionalStates,at=void 0;continue}if(ct.kind!=="command")continue;let Et=B.trace?.flattenNested?B.trace.currentSegmentIndex:B.trace?.allocateSegment(),vt=O.nodes[lt-2],Pt=Ds(at)&&vt?.kind==="command"?Rm(vt)??a_(vt):void 0,xt=[],_t=[];for(let jt of gt){let qt=l_(ct,D,B,Q,[so(jt)]);if(qt.result)return{result:qt.result,states:he};let Vt=O.dialect==="powershell"?qt.states:qt.states.map((Ft)=>ks(jt,Ft));for(let Ft of Vt){let Ot=so(Ft),on=d_(ct,D,B.trace?{...B,trace:_p(B.trace,Et)}:B,Q,Ot,Ds(at),Pt);if(on)return{result:on,states:he};let Cn=P_(ct,Ot.functionDefinitions);if(Cn)B.budget.charge("derivedTokens",Ns(Cn));let Bn=Cn?D+1>=a.recursionDepth.cap?ac(ct.displayText,B,[Ot]):Ms(Cn,D+1,B,Q,[Ot]):{result:null,states:__(ct,Ot)};if(Bn.result)return Bn;if(xt.push(...ic(jt,Bn.states,dt,ft==="&",io(ft))),Ct)_t.push(jt),_t.push(...Bn.states.map((wn)=>dt?ks(jt,wn):wn))}}let Ut=sc(xt,_t,ht,yt,at,ft);he=Ut.states,je=Ut.conditionalStates,at=void 0}return{result:null,states:he}}function i_(O,D,B,Q,ee){if(B.kind==="group"&&B.style==="subshell")return!0;if(O.dialect==="posix"&&(Ds(Q)||Ds(ee)))return!0;if(ee==="&")return!0;return O.dialect==="powershell"&&B.kind==="group"&&B.style==="brace"&&s_(O,D)}function ic(O,D,B,Q,ee){let he=B?D.map((at)=>ks(O,at)):[...D],je=ee?he.flatMap((at)=>oo(O.literalHeredocFiles,at.literalHeredocFiles)?[at]:[{...at,literalHeredocFiles:new Map(O.literalHeredocFiles)},at]):he;return Q?[O,...je]:je}function ks(O,D){return{...O,literalHeredocFiles:new Map(D.literalHeredocFiles)}}function s_(O,D){let B=O.nodes.slice(0,D).reverse().find((ee)=>ee.kind==="command"||ee.kind==="connector");if(!B||B.kind!=="command")return!0;let Q=B.words[0]?.text.toLowerCase();if(Q==="&"||Q===".")return!1;if(Q==="write-output"||Q==="function"||Q==="start-job")return!0;if(c_(B))return!0;return B.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Ds(O){return O==="|"||O==="|&"}function a_(O){if(O?.dialect!=="powershell")return;if(O.words.length===1&&O.words[0]?.quoted&&O.words[0].provenance==="literal")return O.words[0].text;if(O.words[0]?.text.toLowerCase()==="write-output"&&O.words.length===2&&O.words[1]?.provenance==="literal")return O.words[1].text;return}function io(O){return O==="&&"||O==="||"}function sc(O,D,B,Q,ee,he){let je={success:Os([...B,...O]),failure:Os([...Q,...D])},at=io(he)?je:void 0;return{states:io(ee)||at?Os([...je.success,...je.failure]):je.success,conditionalStates:at}}function _p(O,D,B=O.flattenNested){return{currentSegmentIndex:D,flattenNested:B,allocateSegment:O.allocateSegment,getNextSegmentIndex:O.getNextSegmentIndex,recordGlobal:O.recordGlobal,recordSegment:(Q,ee=D)=>O.recordSegment(Q,ee)}}function l_(O,D,B,Q,ee){let he=O.nested.map((je)=>({program:je,depth:D}));if(O.dialect==="powershell"){let je=u_(O);if(je){if(D+1>=a.recursionDepth.cap)return ac(je,B,ee);let at=h(je,"powershell");if(at.status==="limited")return ac(je,B,ee);if(at.status!=="complete")return Sp(he,B,Q,ee);B.budget.charge("derivedTokens",Ns(at)),he.push({program:at,depth:D+1})}}return Sp(he,B,Q,ee)}function c_(O){let D=O.words[0];return D?.provenance==="variable"&&O.words.at(-1)?.text==="="?D.text.toLowerCase():void 0}function Sp(O,D,B,Q){let ee=[...Q];for(let he of O){let je=[];for(let at of ee){let lt=Ms(he.program,he.depth,D,B,[so(at)]);if(lt.result)return lt;je.push(...lt.states)}ee=Os(je)}return{result:null,states:ee}}function u_(O){let D=O.words[0]?.provenance==="literal"&&!O.words[0].quoted&&O.words[0].raw===O.words[0].text&&(O.words[0].text==="&"||O.words[0].text==="."),B=D?1:0,Q=O.words[B];if(Q?.provenance!=="literal"||!D&&(Q.quoted||Q.raw!==Q.text)||!["iex","invoke-expression"].includes(Q.text.toLowerCase()))return;let ee=O.words.slice(B+1),he=ee[0]&&!ee[0].quoted&&ee[0].raw===ee[0].text&&["-c","-command"].includes(ee[0].text.toLowerCase())?1:0,je=ee[he];return ee.length===he+1&&je?.quoted&&je.provenance==="literal"?je.text:void 0}function Ns(O){return O.nodes.reduce((D,B)=>D+(B.kind==="command"?B.words.length+B.nested.reduce((Q,ee)=>Q+Ns(ee),0):B.kind==="group"||B.kind==="function"?Ns(B.body):0),0)}function ac(O,D,B){return D.trace?.recordSegment({type:"error",message:Wn}),{result:{reason:Wn,segment:O,intent:"stop_and_explain"},states:[...B]}}function d_(O,D,B,Q,ee,he,je){let at={...B,environment:{...B.environment,env:ee.shellGitContextState.env}},lt=b_(O,!at.strict);if(lt&&at.strict)return at.trace?.recordSegment({type:"error",message:lt}),{reason:lt,segment:O.source,intent:"stop_and_explain"};wp(O,ee,"before-consumer",at.environment.paths,at.budget);let ct=X(O.dialect,O.words),ut=ct.map(t),ft=O.displayText,dt=om(ct,ee.shellGitContextState),mt=am(dt,ee.shellGitContextState);if(O.dialect==="powershell"){let ht=wt(Df(O,he,T_(at,ee.effectiveCwd)),at.policy);if(at.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!ht,reason:ht?.reason}),ht)return A_(ft,ht)}if(ut.length===1&&ut[0]?.includes(" ")&&!xo(O.dialect,O.words)){let ht=wt(xn(ut[0]),at.policy),yt=ht!==null&&!at.strict&&Nd(O,at.rootProgram);if(ht&&!yt)return at.trace?.recordSegment({type:"dangerous-text",token:ut[0],matched:!0,reason:ht.reason}),{reason:ht.reason,segment:ft,ruleId:ht.id,intent:ht.intent};at.trace?.recordSegment({type:"dangerous-text",token:ut[0],matched:!1});let Ct=Cp(O,lt,ee,mt,je,at);if(Ct)return Ct;return Bl(dt,ee.shellGitContextState),null}let pt=no(O.words,D,{...at,commandView:O,cwd:Q,effectiveCwd:ee.effectiveCwd,envAssignments:mt,shellAssignments:ee.shellGitContextState.shellAssignments,literalHeredocFiles:ee.literalHeredocFiles,functionDefinitions:ee.functionDefinitions,hasPipelineInput:he,literalShellInput:je,analyzeNested:(ht,yt)=>{let Ct=yt&&Object.hasOwn(yt,"effectiveCwd")?yt.effectiveCwd:ee.effectiveCwd,Et=cc(ht,D+1,{...at,effectiveCwd:Ct,envAssignments:yt?.envAssignments??mt,literalHeredocFiles:ee.literalHeredocFiles,functionDefinitions:yt?.functionDefinitions,worktreeMode:yt?.worktreeMode??at.worktreeMode,trace:at.trace?_p(at.trace,at.trace.currentSegmentIndex,!0):void 0});return Et?{reason:Et.reason,ruleId:Et.ruleId,intent:Et.intent}:null}});if(pt)return{...pt,segment:ft};let gt=Cp(O,lt,ee,mt,je,at);if(gt)return gt;return Bl(dt,ee.shellGitContextState),null}function Cp(O,D,B,Q,ee,he){let je=S_(O,D,B,Q??new Map,he);if(je)return je;return wp(O,B,"after-consumer",he.environment.paths,he.budget),B.literalHeredocFiles.clear(),p_(O,D,B,he.environment.paths,he.budget),E_(O,B,ee,he.environment,he.trace),null}var f_=new Set([">>","<>"]);function wp(O,D,B,Q,ee){for(let je of O.redirections){if(!(B==="before-consumer"?m_(je):f_.has(je.operator)))continue;vp(je.target,D,Q,ee)}if(B!=="before-consumer"||!nn(O.words[0],"tee"))return;let he=Pp(O.words.slice(1));if(!he)return;for(let je of he.operands)vp(je,D,Q,ee)}function m_(O){if(O.operator===">"||O.operator===">|")return!0;return O.operator===">&"&&O.fd===void 0&&O.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(O.target.text)}function vp(O,D,B,Q){let ee=O?.provenance==="literal"?Io(O.text,D.effectiveCwd,B,Q):void 0;if(!ee)return;D.literalHeredocFiles.delete(ee)}function p_(O,D,B,Q,ee){if(D)return;let he=O.redirections.find((je)=>je.operator==="<<"||je.operator==="<<-")?.heredoc;if(!he)return;for(let je of g_(O)){let at=Io(je.text,B.effectiveCwd,Q,ee);if(!at||!Gd(at))continue;if(!B.literalHeredocFiles.has(at)&&B.literalHeredocFiles.size>=a.trackedHeredocFiles.cap)throw new s("trackedHeredocFiles");B.literalHeredocFiles.set(at,he.body)}}function g_(O){let D=y_(O.redirections)?.target,B=Ep(D)?[D]:[];if(nn(O.words[0],"cat"))return h_(O.words)?B:[];if(!nn(O.words[0],"tee"))return[];let Q=Pp(O.words.slice(1));if(!Q||Q.append||Q.hasUnsupportedOptions||!Q.operands.every(Ep))return[];return[...Q.operands,...B]}function h_(O){let D=!1;for(let B of O.slice(1)){if(D||B.provenance!=="literal")return!1;if(B.text==="--"){D=!0;continue}if(!/^-u+$/.test(B.text))return!1}return!0}function y_(O){let D=O.findLast((B)=>(B.fd??([">",">|",">>",">&"].includes(B.operator)?1:0))===1);return D?.operator===">"||D?.operator===">|"?D:void 0}function Pp(O){let D=[],B=!0,Q=!1,ee=!1;for(let he of O){if(he.provenance!=="literal")return;if(B&&nn(he,"--")){B=!1;continue}if(B&&!he.quoted&&he.raw===he.text&&/^-[^-]/.test(he.text)){Q||=he.text.slice(1).includes("a"),ee||=Array.from(he.text.slice(1)).some((je)=>je!=="a"&&je!=="i");continue}if(B&&!he.quoted&&he.raw===he.text&&he.text.startsWith("--")){Q||=he.text==="--append",ee||=he.text!=="--append"&&he.text!=="--ignore-interrupts";continue}D.push(he)}return{operands:D,append:Q,hasUnsupportedOptions:ee}}function Ep(O){if(!O||O.provenance!=="literal"||O.text.length===0)return!1;if(O.quoted||O.raw!==O.text)return!0;return!O.raw.startsWith("~")&&!/[{}]/.test(O.raw)}function nn(O,D){return O?.text===D&&O.raw===D&&O.provenance==="literal"&&!O.quoted}function uc(O){return O.quotedDelimiter||!/[$`\\]/.test(O.body)}function b_(O,D){let B=O.redirections.filter((at)=>at.operator==="<<"||at.operator==="<<-");if(B.length===0)return;if(B.length!==1)return Or;let Q=B[0];if(!Q?.heredoc)return Or;if(!uc(Q.heredoc)&&!(D&&!/\$\(|`/.test(Q.heredoc.body)))return o_;if(Q.fd!==void 0&&Q.fd!==0)return Or;if(O.redirections.some((at)=>at!==Q&&["<","<<","<<-","<<<","<&","<>"].includes(at.operator)))return Or;let ee=O.redirections.some((at)=>at!==Q&&xp(at.target));if(nn(O.words[0],"cat"))return ee?Or:void 0;if(nn(O.words[0],"tee"))return ee||O.words.slice(1).some(xp)?Or:void 0;let he=O.words[0],je=O.words[1];if(nn(he,"git")&&(nn(je,"apply")||nn(je,"commit")))return;if(nn(he,"gh")&&(nn(je,"pr")||nn(je,"issue"))&&nn(O.words[2],"create"))return;return Or}function xp(O){return O?.parts.some((D)=>D.provenance==="command-substitution"&&D.raw.startsWith(">("))??!1}function S_(O,D,B,Q,ee){if(!D)return null;let he=O.redirections.filter((ct)=>ct.operator==="<<"||ct.operator==="<<-"),je=he.flatMap((ct)=>ct.heredoc?[ct.heredoc.body]:[]);if(v_(O,he,B,Q,ee))return null;let at=C_(O,he,ee);if(at!==void 0)return at?{reason:at.reason,segment:O.displayText,ruleId:at.id,intent:at.intent}:null;let lt=lc(je.length===he.length?je.join(`
+`):O.source,ee);return lt?{...lt,segment:O.displayText}:null}function C_(O,D,B){let Q=D.length===1?D[0]:void 0;if(!Q?.heredoc||!uc(Q.heredoc)||Q.fd!==void 0&&Q.fd!==0)return;let ee=nn(O.words[0],"uv")&&nn(O.words[1],"run")?O.words.slice(2):O.words,he=ee[0];if(he?.provenance!=="literal"||!An(he.text))return;let je=ee.findIndex((ft)=>nn(ft,"-"));if(!ee.slice(1,je===-1?void 0:je).every((ft)=>ft.provenance==="literal"&&ft.text.startsWith("-")))return;let lt=Q.heredoc.body,ct=Jt(B.policy,"interpreter.one-liner-paranoid",!!B.paranoidInterpreters);if(B.trace?.recordSegment({type:"interpreter",interpreter:he.text,codeArg:lt,paranoidBlocked:ct}),ct){let ft=wt(St("interpreter.one-liner-paranoid",ko),B.policy);if(ft)return ft}if(!Oo(lt,void 0,!B.strict))return null;let ut=wt(St("interpreter.dangerous-command",Kr),B.policy);if(!ut)return null;return B.trace?.recordSegment({type:"dangerous-text",token:lt,matched:!0,reason:ut.reason}),ut}function v_(O,D,B,Q,ee){let he=D.length===1?D[0]:void 0;if(!he?.heredoc||!uc(he.heredoc)||he.fd!==void 0&&he.fd!==0)return!1;let je=Sr(O.words,ee.environment,B.effectiveCwd,Q),at=je.words.map(t),lt=kt(at[0]??"");if((je.envSplitValues?.length??0)>0||!Kt.has(lt)&&!Kt.has(Tt(lt)))return!1;return Zn(at)}function E_(O,D,B,Q,ee){let he=hp(O,D.effectiveCwd,Q,D.shellGitContextState.shellAssignments,B);if(he===null)ee?.recordSegment({type:"cwd-change",segment:O.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(he!==void 0)D.effectiveCwd=he}var x_=/^[A-Za-z_][A-Za-z0-9_]*$/,R_=8;function __(O,D){let B=O.words[1]?.text;if(O.dialect!=="posix"||O.words[0]?.text!=="for"||B===void 0||!x_.test(B))return[D];let Q=O.words.slice(3);if(!(O.words[2]?.text==="in"&&Q.length>=1&&Q.length<=R_&&Q.every((he)=>he.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(he.text))))return D.shellGitContextState.shellAssignments.delete(B),[D];return Q.map((he)=>{let je=so(D);return je.shellGitContextState.shellAssignments.set(B,he.text),je})}function so(O){return{effectiveCwd:O.effectiveCwd,shellGitContextState:sm(O.shellGitContextState),literalHeredocFiles:new Map(O.literalHeredocFiles),functionDefinitions:new Map(O.functionDefinitions)}}function Os(O){let D=[];for(let B of O){if(!D.some((Q)=>w_(Q,B)))D.push(B);if(D.length>a.controlFlowStates.cap)throw new s("controlFlowStates")}return D}function w_(O,D){return O.effectiveCwd===D.effectiveCwd&&oo(O.shellGitContextState.env,D.shellGitContextState.env)&&oo(O.literalHeredocFiles,D.literalHeredocFiles)&&oo(O.functionDefinitions,D.functionDefinitions)&&oo(O.shellGitContextState.effectiveEnvAssignments,D.shellGitContextState.effectiveEnvAssignments)&&oo(O.shellGitContextState.shellAssignments,D.shellGitContextState.shellAssignments)&&O.shellGitContextState.bodyDepth===D.shellGitContextState.bodyDepth&&O.shellGitContextState.bodyAssignments.size===D.shellGitContextState.bodyAssignments.size&&[...O.shellGitContextState.bodyAssignments].every((B)=>D.shellGitContextState.bodyAssignments.has(B))}function oo(O,D){if(O===D)return!0;if(!O||!D||O.size!==D.size)return!1;return[...O].every(([B,Q])=>D.get(B)===Q&&D.has(B))}function P_(O,D){let B=Ro(O);return B===void 0?void 0:D.get(B)}function A_(O,D){if(!D)return null;return{reason:D.reason,segment:O,ruleId:D.id,intent:D.intent}}function T_(O,D=O.effectiveCwd){let B=D===null;return{environment:O.environment,cwd:B?void 0:D??O.cwd,originalCwd:B?void 0:O.cwd,strict:O.strict,paranoid:O.paranoidRm,allowTmpdirVar:O.allowTmpdirVar,protectedGitMetadata:O.protectedGitMetadata,policy:O.policy,budget:O.budget}}function lc(O,D){let B=wt(xn(O),D.policy),Q=D.trace?.currentSegmentIndex??D.trace?.allocateSegment(),ee={type:"dangerous-text",token:O,matched:!!B,reason:B?.reason};if(D.trace?.recordSegment(ee,Q),!B&&/^(?:cd|pushd)\s/.test(O))D.trace?.recordSegment({type:"cwd-change",segment:O,effectiveCwdNowUnknown:!0},Q);return B?{reason:B.reason,segment:O,ruleId:B.id,intent:B.intent}:null}function Rp(O,D){let B={type:"strict-unparseable",rawCommand:O,reason:Xr},Q=D.trace?.currentSegmentIndex;if(Q===void 0)D.trace?.recordGlobal(B);if(Q!==void 0)D.trace?.recordSegment(B)}var I_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Ap(O,D,B,Q){let ee=cc(O,0,{...D,...Fe(D),budget:D.budget??mn(),factStore:Q},B);if(!ee)return null;return{kind:"deny",reason:ee.reason,intent:ee.intent??"manual_only",...ee.ruleId?{ruleId:ee.ruleId}:{},evidence:{command:O,segment:ee.segment}}}function Tp(O,D,B){try{return{decision:O()}}catch(Q){let ee=k_(Q,D,B);if(!ee)throw Q;return ee}}function k_(O,D,B){if(!(O instanceof s)||!I_.has(O.kind))return null;let Q=a[O.kind];if(B?.currentSegmentIndex!==void 0)B.recordSegment({type:"error",message:Q.reason});if(B?.currentSegmentIndex===void 0)B?.recordGlobal({type:"error",message:Q.reason});return{decision:{kind:"deny",reason:Q.reason,intent:"stop_and_explain",evidence:{command:D,segment:D}},errorCode:Q.errorCode}}var O_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),fc=new Set(["cc-safety-net","ccsn"]),M_=new Set(["bunx","npx","pnpx"]),D_=new Set(["pnpm","yarn"]),N_=new Set(["npm","pnpm","yarn"]),L_=new Set(["bun","node"]);function Ws(O,D,B={}){if(fc.has(O))return 0;if(M_.has(O)){if(B.broad)return dc(D);let ee=D[0]==="-y"||D[0]==="--yes"?1:0;return Ls(D[ee])?ee+1:null}let Q=B.broad?D.findIndex((ee)=>!ee.startsWith("-")):0;if(Q!==-1&&N_.has(O)&&B.broad&&D[Q]==="exec"){let ee=dc(D.slice(Q+1));return ee===null?null:Q+1+ee}if(D_.has(O)){if(O==="yarn"&&!B.broad)return null;if(!B.broad)return D[0]==="dlx"&&Ls(D[1])?2:null;if(Q===-1||D[Q]!=="dlx")return null;let ee=dc(D.slice(Q+1));return ee===null?null:Q+1+ee}if(L_.has(O)){let ee=B.broad&&Q!==-1?Q:0;if(Ip(D[ee]))return ee+1;if(O==="bun"&&D[ee]==="run"&&Ip(D[ee+1]))return ee+2}return null}function dc(O){let D=O.findIndex((Q)=>Ls(Q));if(D===-1)return null;let B=D;while(B<O.length){let Q=O[B]??"";if(!Q.startsWith("-")&&!Ls(Q))break;B++}return B}function Ls(O){if(!O)return!1;let D=O.indexOf("@");if(D===-1)return fc.has(O);if(D===0)return!1;let B=O.slice(D+1);if(B===""||B.includes("/")||B.includes(":"))return!1;return fc.has(O.slice(0,D))}function Ip(O){let D=O?.replaceAll("\\","/");return[...O_].some((B)=>D===B||D?.endsWith(`/${B}`))}var Me="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function kp(O,D,B){let Q=un(O,"input-candidate");if(!Q)return null;let ee=Yr(Q.shell,O.invocation.context.executionCwd,D,B,{findSegmentTarget:(he)=>W_(he,D),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return ee?{target:ee}:null}function W_(O,D){let B=rr([...O],D),Q=B.slice(1),ee=Ws(Tt(B[0]??"").toLowerCase(),Q,{broad:!0});if(ee===null)return null;let he=Q.slice(ee).filter((je)=>je!=="-g"&&je!=="--global");return he[0]==="policy"&&he[1]==="apply"?B.join(" "):null}import{dirname as Gs}from"node:path";var $e="This path contains the protected policy config and you must not modify or delete it.",G_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Np(O,D,B){let Q=H_(O.invocation.context,D,B);if(O.invocation.route.kind==="patch")return Op(O.paths,!1,O.invocation.context.executionCwd,Q,D,B);let ee=un(O,"input-candidate");if(O.invocation.route.kind==="command")return ee?Mp(ee.shell,O.invocation.context.executionCwd,Q,D,B):null;if(O.invocation.route.kind==="unknown"&&ee){let he=Mp(ee.shell,O.invocation.context.executionCwd,Q,D,B);if(he)return he}return Op(O.paths,O.invocation.route.kind==="grep"||O.invocation.route.kind==="glob"||ui(O.invocation.toolName),O.invocation.context.executionCwd,Q,D,B)}function Op(O,D,B,Q,ee,he){if(D)return null;let je=O.find((at)=>ei(at,B,Q,ee,he));return je?{target:je}:null}function Mp(O,D,B,Q,ee){let he=Yr(O,D,Q,ee,{findSegmentTarget:(je,at)=>F_(je,at,B,Q,ee)?.target??null,isRedirectionTarget:(je,at)=>ei(je,at.cwd,B,Q,ee),findMalformedTarget:(je)=>U_(je,D,B,Q,ee)?.target??null});return he?{target:he}:null}function F_(O,D,B,Q,ee){if(Wo(O))return null;let he=Cr([...O],Q),je=Tt(he[0]??"").toLowerCase(),at=he.slice(1);if(je==="rm"&&z_(at)){let lt=B_(at).find((ct)=>Dp(cn(ct,D.variables),D.cwd,B,Q,ee));if(lt)return{target:lt}}if(je==="find"){if(gs(he,1)||Ol(he,Q)){let ct=(ps($t(he))??$t(["."])).find((ut)=>{let ft=cn(ut.text,D.variables);return ei(ft,D.cwd,B,Q,ee)||Dp(ft,D.cwd,B,Q,ee)})?.text;if(ct)return{target:ct}}}if(je==="mv"){let lt=ts(at).sources.find((ct)=>j_(cn(ct,D.variables),D.cwd,B,Q,ee));if(lt)return{target:lt}}if($_(he,je))return null;for(let lt of[...O,...he])for(let ct of Lp(lt))if(ei(cn(ct,D.variables),D.cwd,B,Q,ee))return{target:ct};return null}function z_(O){return O.some((D)=>D==="--recursive"||D.startsWith("-")&&!D.startsWith("--")&&/[rR]/.test(D.slice(1)))}function B_(O){let D=O.indexOf("--");if(D!==-1)return[...O.slice(0,D).filter((B)=>!B.startsWith("-")),...O.slice(D+1)];return O.filter((B)=>!B.startsWith("-"))}function $_(O,D){if(!G_.has(D))return!1;if(D!=="sed")return!0;return!O.slice(1).some((B)=>B.startsWith("-i")||B==="--in-place"||B.startsWith("--in-place="))}function U_(O,D,B,Q,ee){for(let he of O.split(/\s+/))for(let je of Lp(he))if(ei(je,D,B,Q,ee))return{target:je};return null}function Lp(O){let D=O.trim().replace(/^['"]|['"]$/g,""),B=D.indexOf("=");return B===-1||B===D.length-1?[D]:[D,D.slice(B+1)]}function H_(O,D,B){let Q=(at)=>ti(tn(at,O.executionCwd,D,B)),ee=Q(u(D)),he=[Q(b(O.executionCwd)),Q(b(O.configCwd))],je=new Set(he.map((at)=>Gs(at)));for(let at=Gs(ee);;at=Gs(at))if(je.add(at),Gs(at)===at)break;return{files:new Set([ee,...he]),directoriesAndAncestors:je}}function ei(O,D,B,Q,ee){let he=Dc(O,D,Q,ee,(je)=>ti(je)===hi);return he!==null&&B.files.has(ti(he))}function Dp(O,D,B,Q,ee){return B.directoriesAndAncestors.has(ti(tn(O,D,Q,ee)))}function j_(O,D,B,Q,ee){let he=ti(tn(O,D,Q,ee));return B.files.has(he)||B.directoriesAndAncestors.has(he)}function ti(O){return process.platform==="win32"?O.toLowerCase():O}import{isAbsolute as Fs,posix as qp,resolve as Bs,win32 as V_}from"node:path";import{fileURLToPath as K_}from"node:url";var Yp="Access to a sensitive path is not allowed.",Zp=new Set(["echo","printf"]),q_=new Set(["find"]),Y_=new Set(["!","do","elif","else","if","then","until","while"]),Z_=new Set(["-exec","-execdir"]),X_=new Set([";","+"]),J_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),Q_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Xp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),ew=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),tw=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Jp=new Set(["-c","-e","-r","-E","--eval","--exec"]),nw=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),rw=new Set(["grep","rg"]),ow=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),iw=new Set(["commit","merge","notes","stash","tag"]),sw=new Set(["-m","--message"]),aw=new Set(["--grep"]),Wp=new Set(["jq","gojq","jaq"]),Gp="f",Fp="file",lw="files",cw=new Set(["e","f"]),uw=new Set(["regexp","file"]),dw=new Set(["e","f","A","B","C","m"]),fw=new Set(["regexp","file","after-context","before-context","context","max-count"]),mc="__CC_SAFETY_NET_PIPE_INPUT__",gc=/[\w./~@+-]*[./~][\w./~@+-]*/g,mw=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,pw=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,gw=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,zp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Bp=/\b(?:system|exec|spawn|popen)\s*$/,hw=/\b(?:eval|exec)\s*\(/g,yw=/\b(?:eval|exec)\s*$/,bw=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function $p(O,D,B,Q,ee,he){for(let je of O){let at=je.target;if(gP(at,je.cwd,D?.denyPaths??[],B,Q,ee))return{target:at,ruleId:"secret.deny-path"};if(he&&!he.has(at))continue;let lt=mP(at,je.cwd,D,Q,ee);if(lt){let ct=!lt.startsWith("secret.home.")&&!lt.startsWith("secret.cli.");if(he&&(ct&&Q.paths.isDirectory(ig(at,je.cwd,Q,ee))||ct&&je.written===!0&&!at.includes("$")&&!yc(at,je.cwd,Q,ee)||ct&&/\s/.test(at)&&!at.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(at)&&!yc(at,je.cwd,Q,ee)))continue;if(!lt.startsWith("secret.cli.")&&hP(at,je.cwd,D?.allowPaths??[],B,Q,ee))continue;return{target:at,ruleId:lt}}}return null}function Qp(O,D,B,Q,ee={}){let he=Up(O,B,Q),je=$p(he,D,O.invocation.context.configCwd,B,Q);if(je===null||je.ruleId==="secret.deny-path"||ee.strict!==!1)return je;let at=$p(he,D,O.invocation.context.configCwd,B,Q,new Set(Up(O,B,Q,{standard:!0}).map((lt)=>lt.target)));return at?.ruleId!=="secret.deny-path"&&Sw(O,B)?null:at}function Sw(O,D){let B=un(O,"input-candidate")??un(O,"declared-command");if(!B)return!1;if(B.program.nodes.some((je)=>je.kind==="command"&&je.nested.length>0))return!1;let Q=[];for(let je of es(B.shell)){if(je.kind==="operator"&&je.boundary)return!1;if(je.kind==="redirection")return!1;if(je.kind==="operator")continue;Q.push(Vn(je.text,D))}let ee=Jn(Q);if(ee.length===0)return!1;let he=Ln(ee[0]??"").toLowerCase();if(O.invocation.route.kind==="unknown")return B.program.dialect==="powershell"&&(he==="ls"||he==="stat");return bc(he,ee.slice(1))}function bc(O,D){if(O==="ls"||O==="stat")return!0;if(O==="test")return D.length===2&&(D[0]==="-e"||D[0]==="-f");if(O==="[")return D.length===3&&(D[0]==="-e"||D[0]==="-f")&&D[2]==="]";if(O==="git")return D[0]==="check-ignore";if(O!=="find")return!1;return!D.some((B)=>J_.has(B))}function Up(O,D,B,Q={}){let ee=O.invocation.context.executionCwd,he=O.invocation.route.kind;if(he!=="command"&&he!=="unknown")return O.paths.map((at)=>({target:at,cwd:ee}));let je=un(O,"input-candidate");return[...je?ao(je.shell,O.store,Q,D,ee,B,Cw(je)):[],...he==="unknown"?O.paths.map((at)=>({target:at,cwd:ee})):[]]}function Cw(O){return O.program.dialect==="powershell"}function ao(O,D,B,Q,ee,he,je=!1){if(O.status==="structural-limit")throw new y;if(O.status==="unclosed-quote")return[];if(O.status==="invalid")throw Error("Unable to parse command for secret protection");let at=[...O.assignmentFallbacks.map((ct)=>({target:ct,cwd:ee})),...Zw(Vn(O.source,Q),D,B,Q,ee,he)],lt=(ct)=>Vn(kw(ct,je),Q);return Qi(O,ee,Q,he,{word:lt,segment:(ct,ut,ft,dt,mt)=>{if(ct.length===0)return null;if(at.push(...$s(ct,D,B,Q,ut.cwd,he,mt)),ft!==null)at.push(...Ew(ft,ct,D,B,Q,ut.cwd,he));return null},redirection:(ct,ut)=>{if(ct.body!==void 0&&ct.consumer!==void 0)at.push(...eg(ct.consumer,[ct.body],D,B,Q,ut.cwd,he,(ft)=>xw(ct.consumer??[],ft,D,B,Q,ut.cwd,he)));if(ct.targetOrder==="legacy-segment")return gl;return at.push({target:lt(ct.target),cwd:ut.cwd,...ct.role==="file-write"?{written:!0}:{}}),null}}),at}function Sc(O,D,B,Q,ee,he){let je=D.getShellSyntax(O);if(je.status==="structural-limit")throw new y;return je.status==="complete"?ao(je,D,B,Q,ee,he):null}function $s(O,D,B,Q,ee,he,je){let at=(gt)=>({target:gt,cwd:ee});if(je?.size){let gt=O.filter((ht,yt)=>!je.has(yt));if(Wp.has(Ln(Jn(gt)[0]??"").toLowerCase()))return[...O.filter((ht,yt)=>je.has(yt)).map(at),...$s(gt,D,B,Q,ee,he)]}let lt=Iw(O).map(at),ct=Jn(O);if(ct.length===0)return lt;let ut=ct[0]??"",ft=Ln(ut).toLowerCase(),dt=ct.slice(1),mt=ct.findIndex((gt)=>!Y_.has(gt));if(B.standard===!0&&mt!==-1&&bc(Ln(ct[mt]??"").toLowerCase(),ct.slice(mt+1)))return lt;let pt=vw(ut,ft,dt);if(pt)return[...lt,...pt.map(at)];if(Zp.has(ft))return B.capturedOutput===!0?[...lt,...tg(O).map(at)]:lt;if(ft==="eval")return[...lt,...Sc(dt.join(" "),D,B,Q,ee,he)??dt.map(at)];if(ft==="export")return[...lt,...dt.flatMap((gt)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(gt)?[gt.slice(gt.indexOf("=")+1)]:zn(ft,gt)).map(at)];if(ft==="git")return[...lt,...Mw(dt).map(at)];if(ft==="gh")return[...lt,...hc(ft,dt,ow).map(at)];if(Wp.has(ft))return[...lt,...Ow(dt).map(at)];if(rw.has(ft))return[...lt,...oP(dt).map(at)];if(q_.has(ft))return[...lt,...Ww(dt,D,B,Q,ee,he).map(at)];if(En.has(ft))return[...lt,...dt.flatMap((gt)=>zn("awk",gt)).map(at),...dt.flatMap((gt)=>Fw(gt,D,B,Q,ee,he)),...dt.flatMap(zw).map(at)];if(ft==="curl")return[...lt,...dt.flatMap((gt)=>zn(ft,gt)).map(at),...Dw(dt).map(at)];if(Go(ft)){let gt=Lo.has(ft)?hn([ft,...dt]):null;if(gt!==null&&gt.command!==null&&gt.commandIndex!==null){let ht=D.getShellSyntax(gt.command);if(ht.status==="structural-limit")throw new y;if(ht.status==="complete")return[...lt,...ao(ht,D,B,Q,ee,he),...dt.slice(gt.commandIndex).filter((yt)=>!yt.startsWith("-")).map(at)]}return[...lt,...Gw(ft,dt,D,B,Q,ee,he)]}return[...lt,...dt.flatMap((gt)=>zn(ft,gt)).map(at)]}function vw(O,D,B){let Q=Ws(D,B);if(Q===null||B[Q]!=="explain")return null;let ee=[O,...B.slice(0,Q)],he=B.slice(Q+1);for(let je=0;je<he.length;je++){let at=he[je];if(at==="--json"||at==="--help"||at==="-h")continue;if(at==="--cwd"){let lt=he[je+1];if(lt&&!lt.startsWith("--"))ee.push(lt);je++;continue}return ee}return ee}function Ew(O,D,B,Q,ee,he,je){if(Pw(D,B,Q,ee,he,je)){let at=Jn(O),lt=bc(Ln(at[0]??"").toLowerCase(),at.slice(1))?at.slice(1).filter((ct)=>!ct.startsWith("-")):[];return[...tg(O),...lt].map((ct)=>({target:ct,cwd:he}))}return eg(D,Rw(O),B,Q,ee,he,je,()=>[])}function xw(O,D,B,Q,ee,he,je){let at=Jn(O);if(!Go(Ln(at[0]??"").toLowerCase()))return[];return Sc(D,B,Q,ee,he,je)??[{target:D,cwd:he}]}function eg(O,D,B,Q,ee,he,je,at){let lt=Aw(O);if(lt===null)return D.flatMap(at);return D.flatMap((ct)=>Lo.has(lt)?ao(B.getShellSyntax(ct),B,Q,ee,he,je):zs(lt,ct,B,Q,ee,he,je))}function tg(O){let D=Jn(O);if(D.length===0)return[];let B=Ln(D[0]??"").toLowerCase();if(!Zp.has(B))return[];let Q=D[D[1]==="--"?2:1];if(B==="printf"&&Q!==void 0&&!Q.startsWith("-")&&!Q.replaceAll("%%","").includes("%"))return[Cc(Q.replaceAll("%%","%"))];return D.slice(1)}function Rw(O){let D=Jn(O);if(D.length===0)return[];let B=Ln(D[0]??"").toLowerCase(),Q=D.slice(1);if(B==="echo"){let ee=Q.findIndex((he)=>!/^-[neE]+$/.test(he));return[(ee===-1?[]:Q.slice(ee)).join(" ")]}if(B==="printf")return _w(Q);return[]}function _w(O){let D=O[0];if(D===void 0)return[];let B=(D.match(/%%|%[bqs]/g)??[]).filter((ee)=>ee!=="%%").length;if(B===0||O.length===1)return[Cc(D)];let Q=O.slice(1);return Array.from({length:Math.ceil(Q.length/B)},(ee,he)=>ww(D,Q.slice(he*B,(he+1)*B)))}function ww(O,D){let B=0;return Cc(O.replace(/%%|%[bqs]/g,(Q)=>{if(Q==="%%")return"%";let ee=D[B]??"";return B++,ee}))}function Cc(O){return O.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Pw(O,D,B,Q,ee,he){let je=Jn(O);if(je.length===0||Ln(je[0]??"").toLowerCase()!=="xargs")return!1;let at=Ir(je),lt=je.slice(at.childStart);if(lt.length===0)return!1;if(at.replacementToken==="")return!1;let ct=at.replacementToken,ut=ct===null?[...lt,mc]:lt.map((ft)=>ft.split(ct).join(mc));return $s(ut,D,B,Q,ee,he).some((ft)=>ft.target.includes(mc))}function Aw(O){let D=Jn(O);if(D.length===0)return null;let B=Ln(D[0]??"").toLowerCase();if(!Go(B))return null;return Tw(B,D.slice(1))?B:null}function Tw(O,D){let B=vc(O);for(let Q=0;Q<D.length;Q++){let ee=D[Q];if(ee===void 0)break;if(Jp.has(ee)||ng(O,ee)||/^--(?:eval|exec)=/.test(ee))return!1;if(ee==="-")return!0;if(ee.startsWith("-")){if(B==="python"&&ee==="-m")return!1;if(bw.get(B)?.has(ee))Q++;continue}return!1}return!0}function vc(O){return/^python\d/.test(O)?"python":O}function Iw(O){let D=[];for(let B of O){if(og(B))continue;let Q=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(B);if(Q===null)break;if(Q[1]!==void 0&&Q[1]!=="")D.push(Q[1])}return D}var Hp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function kw(O,D){if(!D||!Hp.test(O))return O;return`~${O.replace(Hp,"").replace(/\\/g,"/")}`}function zn(O,D){if(D==="--")return[];let B=[],Q=D.indexOf("=");if(Q>0&&Q<D.length-1)B.push(D.slice(Q+1));if(D.startsWith("-"))return B;if(O==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(D))return B;if(O==="zip"&&/\.zip$/i.test(D))return B;return B.push(D),B}function Ow(O){let D=-1,B=!1;for(let Q=0;Q<O.length;Q++){let ee=O[Q]??"";if(!B&&ee==="--"){B=!0;continue}if(B||!/^-(?:[A-Za-z]|-)/.test(ee)){if(D===-1)D=Q;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(ee)){Q+=2;continue}if(ee==="--indent"||ee==="-L"){Q++;continue}if(ee.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(ee)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(ee))continue;return O.flatMap((he)=>zn("jq",he))}return O.flatMap((Q,ee)=>ee===D?[]:zn("jq",Q))}function Mw(O){let D=[];for(let B=0;B<O.length;B++){let Q=O[B]??"";if(Q==="--"||!Q.startsWith("-"))return[...D,...iw.has(Q)?hc("git",O.slice(B).map((he)=>/^-[aeinopqsv]+m$/.test(he)?"-m":he),sw):hc("git",O.slice(B),aw)];if(D.push(...zn("git",Q)),!gn.has(Q))continue;let ee=O[B+1];if(ee===void 0)break;D.push(...Q==="-c"&&ee.includes("=")?[ee.slice(ee.indexOf("=")+1)]:zn("git",ee)),B++}return D}function hc(O,D,B){let Q=[];for(let ee=0;ee<D.length;ee++){let he=D[ee]??"";if(he==="--")return[...Q,...D.slice(ee).flatMap((je)=>zn(O,je))];if(B.has(he)){ee++;continue}if(he.includes("=")&&B.has(he.slice(0,he.indexOf("="))))continue;Q.push(...zn(O,he))}return Q}function Dw(O){return O.flatMap((D,B)=>{let Q=Lw(D);if(Q!==null)return jp(Q.flag,Q.value);let ee=Nw(O[B-1]);return ee===null?[]:jp(ee,D)})}function jp(O,D){if(O==="-F"||O==="--form"){let B=D.indexOf("="),Q=B===-1?D:D.slice(B+1);if(!Q.startsWith("@")&&!Q.startsWith("<"))return[];return pc(Q.slice(1).split(";")[0]??"")}if(O==="--data-urlencode"){let B=D.indexOf("@"),Q=D.indexOf("=");if(B===-1||Q!==-1&&Q<B)return[];return pc(D.slice(B+1))}return D.startsWith("@")?pc(D.slice(1)):[]}function Nw(O){if(O===void 0)return null;if(Xp.has(O))return O;return/^-[A-Za-z]+[dF]$/.test(O)?`-${O.slice(-1)}`:null}function Lw(O){let D=O.slice(0,2);if(O.length>2&&(D==="-d"||D==="-F"))return{flag:D,value:O.slice(2)};let B=O.indexOf("=");if(B===-1)return null;let Q=O.slice(0,B);return Xp.has(Q)?{flag:Q,value:O.slice(B+1)}:null}function pc(O){return O===""||O==="-"?[]:[O]}function Ww(O,D,B,Q,ee,he){let je=O.findIndex((lt)=>lt.startsWith("-")||lt==="("||lt==="!"||lt===";"),at=[...O.slice(0,je===-1?O.length:je),...O.flatMap((lt,ct)=>lt==="-files0-from"&&O[ct+1]!==void 0?[O[ct+1]??""]:[])];for(let lt=0;lt<O.length;lt++){if(!Z_.has(O[lt]??""))continue;let ct=O.slice(lt+1),ut=ct.findIndex((mt)=>X_.has(mt)),ft=ut===-1?ct:ct.slice(0,ut),dt=$s(ft,D,B,Q,ee,he).map((mt)=>mt.target);if(at.push(...dt.filter((mt)=>mt!=="{}")),!dt.includes("{}"))continue;at.push(...O.slice(0,lt).flatMap((mt,pt,gt)=>{if(!Q_.has(mt))return[];let ht=gt[pt+1];return ht===void 0?[]:[ht,ht.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return at}function Gw(O,D,B,Q,ee,he,je){let at=[];for(let lt=0;lt<D.length;lt++){let ct=D[lt];if(ct===void 0)break;if(Jp.has(ct)||ng(O,ct)){let ft=D[lt+1];if(ft!==void 0)at.push(...zs(O,ft,B,Q,ee,he,je)),lt++;continue}let ut=/^--(?:eval|exec)=(.*)$/.exec(ct);if(ut!==null&&ut[1]!==void 0){at.push(...zs(O,ut[1],B,Q,ee,he,je));continue}if(!ct.startsWith("-"))at.push({target:ct,cwd:he})}return at}function ng(O,D){if(!D.startsWith("-")||D.startsWith("--")||D.length<=2)return!1;return nw.get(D[D.length-1]??"")?.has(vc(O))??!1}function Fw(O,D,B,Q,ee,he){if(!O.includes("system"))return[];return Al(O)?.commands.flatMap((je)=>ao(D.getShellSyntax(je),D,B,Q,ee,he))??[]}function zw(O){return Array.from(O.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((D)=>D[1]).filter((D)=>D!==void 0&&D!=="")}function Bw(O){let D=Array.from(O.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((B)=>B[2]).filter((B)=>B!==void 0&&B!=="");return[...D,...D.flatMap(Ec),...O.match(gc)??[]]}function zs(O,D,B,Q,ee,he,je){let at=(gt)=>({target:gt,cwd:he}),lt=Uw(D,$w(O));if(lt===null)return Bw(D).map(at);let ct=lt.masked.match(zp)!==null||lt.literals.some((gt)=>Bp.test(lt.masked.slice(0,gt.start))),ut=lt.masked.match(hw)!==null||lt.literals.some((gt)=>yw.test(lt.masked.slice(0,gt.start))),ft=Q.standard===!0&&!Lo.has(O),dt=ft&&!(Kw(lt.masked)||ct||ut)?[]:lt.literals,mt=ft?Array.from(lt.masked.matchAll(zp),(gt)=>{let ht=gt.index+gt[0].length;return{start:ht,end:ll(lt.masked,ht)}}):[],pt=!ft||mt.some((gt)=>cl(lt.masked,gt.start))?lt.literals:lt.literals.filter((gt)=>Bp.test(lt.masked.slice(0,gt.start))||mt.some((ht)=>gt.start>=ht.start&&gt.start<ht.end));return[...dt.map((gt)=>gt.text).filter((gt)=>gt!=="").map(at),...dt.flatMap((gt)=>Ec(gt.text)).map(at),...ft?[]:lt.literals.flatMap((gt)=>gt.text.match(gc)??[]).map(at),...ct?pt.flatMap((gt)=>Sc(gt.text,B,Q,ee,he,je)??[at(gt.text)]):[],...ut?lt.literals.flatMap((gt)=>zs(O,gt.text.replace(/\\(.)/g,(ht,yt)=>yt==="n"?`
+`:yt),B,Q,ee,he,je)):[],...(lt.masked.match(gc)??[]).map(at)]}function $w(O){let D=vc(O);if(D==="python")return"python";if(D==="osascript")return"opaque";return D==="node"||D==="bun"||D==="deno"?"javascript":"simple"}function Uw(O,D){if(D==="opaque")return null;let B=O.split(""),Q=[];for(let ee=0;ee<O.length;ee++){let he=O[ee]??"";if(D==="simple"&&(he==="`"||he==="%"||he==="<")){if(pw.test(O.slice(ee)))return null}let je=he==="'"||he==='"'||D==="javascript"&&he==="`"?he:null;if(je===null)continue;if(je==="`"&&Vw(O,ee))return null;let at=D==="python"?Hw(O,ee):"",lt=D==="python"&&O.startsWith(je.repeat(3),ee)?je.repeat(3):je,ct=ee+lt.length,ut=jw(O,ct,lt);if(ut===null)return null;let ft=O.slice(ct,ut);if(/[fF]/.test(at)&&ft.includes("{"))return null;if(D==="simple"&&je==='"'&&gw.test(ft))return null;Q.push({start:ct,text:ft});for(let dt=ee;dt<ut+lt.length;dt++)B[dt]=" ";ee=ut+lt.length-1}return{masked:B.join(""),literals:Q}}function Hw(O,D){return mw.exec(O.slice(Math.max(0,D-3),D))?.[1]??""}function jw(O,D,B){let Q=B==="`",ee=Q||B.length===3;for(let he=D;he<O.length;he++){let je=O[he];if(je==="\\"){he++;continue}if(Q&&je==="$"&&O[he+1]==="{")return null;if(!ee&&(je===`
+`||je==="\r"))return null;if(O.startsWith(B,he))return he}return null}function Vw(O,D){for(let B=D-1;B>=0;B--){let Q=O[B];if(!Q||/\s/.test(Q))continue;return/[\w$\])]/.test(Q)}return!1}function Kw(O){for(let D of O.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let B=D[0],Q=D.index;if(ew.has(B.toLowerCase()))return!0;let ee=B.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((he)=>he.toLowerCase());if(!ee.some((he)=>tw.has(he)))continue;if(ee.length>1)return!0;if(qw(O,Q)===".")return!0;if(Yw(O,Q+B.length)==="(")return!0}return!1}function qw(O,D){for(let B=D-1;B>=0;B--)if(!/\s/.test(O[B]??""))return O[B];return}function Yw(O,D){for(let B=D;B<O.length;B++)if(!/\s/.test(O[B]??""))return O[B];return}function Zw(O,D,B,Q,ee,he){return tP(O).flatMap((je)=>{let at=D.getShellSyntax(je);if(at.status==="invalid")return[];return[...ao(at,D,{...B,capturedOutput:!0},Q,ee,he),...Xw(at,Q)?Jw(at,Q).map((lt)=>({target:lt,cwd:ee})):[]]})}function Xw(O,D){let B=es(O);for(let Q=0;Q<B.length;Q++){let ee=B[Q];if(ee?.kind!=="word"||Ln(Vn(ee.text,D)).toLowerCase()!=="base64")continue;for(let he=Q+1;he<B.length;he++){let je=B[he];if(je?.kind==="operator")break;if(je?.kind!=="word")continue;let at=Vn(je.text,D);if(at==="--decode"||!at.startsWith("--")&&at.startsWith("-")&&/[dD]/.test(at))return!0}}return!1}function Jw(O,D){return es(O).flatMap((B)=>B.kind==="word"?[Vn(B.text,D)]:B.kind==="redirection"&&B.target?[Vn(B.target,D)]:[]).flatMap(Ec)}function Ec(O){let D=eP(O);if(D===null)return[];let B=Buffer.from(D,"base64").toString("utf8");if(B===""||Qw(B))return[];return Buffer.from(B,"utf8").toString("base64").replace(/=+$/g,"")===D.replace(/=+$/g,"")?[B]:[]}function Qw(O){return Array.from(O).some((D)=>{let B=D.charCodeAt(0);return B<32||B===127})}function eP(O){if(O.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(O))return null;if(/=/.test(O.replace(/=+$/g,"")))return null;let D=O.replace(/=+$/g,"");if(D.length%4===1)return null;return`${D.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-D.length%4)%4)}`}function tP(O){let D=[],B={inSingle:!1,inDouble:!1,escaped:!1};for(let Q=0;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(So(ee,B))continue;if(rg(O,Q,B)){let he=nP(O,Q+1);if(he!==null)D.push(he.body),Q=he.endIndex;continue}if(!B.inSingle&&ee==="`"){let he=rP(O,Q);if(he!==null)D.push(he.body),Q=he.endIndex}}return D}function nP(O,D){let B={inSingle:!1,inDouble:!1,escaped:!1},Q=1;for(let ee=D+1;ee<O.length;ee++){let he=O[ee];if(!he)break;if(So(he,B))continue;if(rg(O,ee,B)){Q++,ee++;continue}if(!B.inSingle&&!B.inDouble&&he===")"){if(Q--,Q===0)return{body:O.slice(D+1,ee),endIndex:ee}}}return null}function rP(O,D){let B=!1;for(let Q=D+1;Q<O.length;Q++){let ee=O[Q];if(!ee)break;if(B){B=!1;continue}if(ee==="\\"){B=!0;continue}if(ee==="`")return{body:O.slice(D+1,Q),endIndex:Q}}return null}function rg(O,D,B){return!B.inSingle&&O[D]==="$"&&O[D+1]==="("&&O[D+2]!=="("}function oP(O){let D=[],B=[],Q=!1,ee=!1,he=!1;for(let lt=0;lt<O.length;lt++){let ct=O[lt];if(ct===void 0)break;if(!he&&ct==="--"){he=!0;continue}if(he){B.push(ct);continue}let ut=/^--([^=]+)(?:=(.*))?$/.exec(ct);if(ut!==null){let ft=ut[1]??"",dt=ut[2];if(ft===lw)ee=!0;if(uw.has(ft))Q=!0;if(dt!==void 0){if(ft===Fp)D.push(dt);continue}if(fw.has(ft)){let mt=O[lt+1];if(ft===Fp&&mt!==void 0)D.push(mt);lt++}continue}if(ct.startsWith("-")&&ct.length>1){let ft=ct.slice(1),dt="",mt="";for(let gt=0;gt<ft.length;gt++){let ht=ft[gt]??"";if(cw.has(ht))Q=!0;if(dw.has(ht)){dt=ht,mt=ft.slice(gt+1);break}}if(dt==="")continue;if(mt.length>0){if(dt===Gp)D.push(mt);continue}let pt=O[lt+1];if(dt===Gp&&pt!==void 0)D.push(pt);lt++;continue}B.push(ct)}let at=!Q&&!ee?B.slice(1):B;return[...D,...at]}function Jn(O){let D=O.findIndex((B)=>!og(B)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(B));return D===-1?[]:O.slice(D)}function og(O){return O==="env"||O==="command"||O==="builtin"||O==="sudo"}var iP=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),sP=".env.",aP=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),lP=[".env.example.",".env.sample."];function cP(O){let D;try{D=new URL(O.trim())}catch{return!1}return D.protocol!=="file:"&&D.host!==""}function uP(O){return O.length>0&&!/\s/.test(O)}function yc(O,D,B,Q){let ee=ig(O,D,B,Q);return ee!==""&&B.paths.entryKind(ee)!=="missing"}function ig(O,D,B,Q){try{return oi(O,D,B,Q)}catch(ee){if(ee instanceof s)throw ee;return""}}var dP=new Set(["node_modules","__pycache__"]),fP=[["vendor","bundle"],["vendor","cache"]];function mP(O,D,B,Q,ee){if(cP(O))return null;let he=Fn(O,D,Q,ee);if(!he)return null;let je=Lt(he.split("/").pop()??""),at=Lt(he),lt=()=>uP(je)||yc(O,D,Q,ee);if(aP.has(je)||lP.some((dt)=>je.startsWith(dt)))return null;let ct=Lt(SP(O,D,Q,ee));for(let dt of xa){let mt=`~/${dt.suffixParts.join("/")}`;if((Kp(at,mt)||Kp(ct,mt))&&Xn(dt.id,B))return dt.id}let ut=pP(he,D,B,Q,ee);if(ut)return ut;if(iP.has(je))return null;for(let dt of Ea)if(je===dt.basename&&Xn(dt.id,B))return dt.id;if(je.startsWith(sP)&&Xn(vi.id,B)&&lt())return vi.id;for(let dt of Ra)if(je.length>dt.prefix.length&&je.startsWith(dt.prefix)){let mt=je.slice(dt.prefix.length)[0];if((mt==="-"||mt==="_")&&Xn(dt.id,B)&&lt())return dt.id}for(let dt of _a)if(je.length>dt.prefix.length&&je.startsWith(dt.prefix)){if(je.slice(dt.prefix.length)===dt.suffix&&Xn(dt.id,B))return dt.id}if(yP(at))return null;if(!je.includes(".")&&Co.pattern.test(je)&&Xn(Co.id,B))return Co.id;let ft=bP(je,B);if(ft)return ft;return null}function pP(O,D,B,Q,ee){return Ei.find((he)=>{if(!Xn(he.id,B))return!1;switch(he.id){case"secret.cli.claude-code":return Dt(O,Gt(Q.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",D,Q,ee),[".credentials.json"]);case"secret.cli.claude-code.config":{let je=Lt(O).split("/");return Dt(O,Gt(Q.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",D,Q,ee),["settings.json","settings.local.json"])||ri(O,"~/.claude.json",D,Q,ee)||je.at(-1)==="settings.local.json"&&je.at(-2)===".claude"||je.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Dt(O,Fn("~/.gemini/config",D,Q,ee),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let je=Gt(Q.env.get("CODEX_HOME"),"~/.codex",D,Q,ee);return Dt(O,je,["auth.json",".credentials.json"])||ni(O,je,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let je=Gt(Q.env.get("CODEX_HOME"),"~/.codex",D,Q,ee),at=Lt(O).split("/").at(-1)??"";return Dt(O,je,["config.toml"])||at.endsWith(".config.toml")&&Dt(O,je,[at])}case"secret.cli.gemini":return Dt(O,rn(Gt(Q.env.get("GEMINI_CLI_HOME"),"~",D,Q,ee),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let je=Lt(O).split("/"),at=Q.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),lt=Q.env.get("ProgramData")?[rn(Gt(Q.env.get("ProgramData"),"",D,Q,ee),"gemini-cli")]:[];return Dt(O,rn(Gt(Q.env.get("GEMINI_CLI_HOME"),"~",D,Q,ee),".gemini"),["settings.json","google_accounts.json"])||je.at(-1)==="settings.json"&&je.at(-2)===".gemini"||(at?.trim()?ri(O,at,D,Q,ee):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...lt].some((ct)=>Dt(O,Fn(ct,D,Q,ee),["settings.json"]))}case"secret.cli.copilot-cli":{let je=Gt(Q.env.get("COPILOT_HOME"),"~/.copilot",D,Q,ee);return Dt(O,je,["config.json"])||ni(O,je,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Dt(O,Gt(Q.env.get("COPILOT_HOME"),"~/.copilot",D,Q,ee),["mcp-config.json"]);case"secret.cli.kimi-code":{let je=Gt(Q.env.get("KIMI_CODE_HOME"),"~/.kimi-code",D,Q,ee),at=Gt(Q.env.get("KIMI_SHARE_DIR"),"~/.kimi",D,Q,ee);return Dt(O,je,["server.token"])||ni(O,je,["credentials"])||ni(O,at,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let je=["config.toml","mcp.json"],at=Lt(O).split("/");return at.at(-1)==="mcp.json"&&at.at(-2)===".kimi-code"||Dt(O,Gt(Q.env.get("KIMI_CODE_HOME"),"~/.kimi-code",D,Q,ee),je)||Dt(O,Gt(Q.env.get("KIMI_SHARE_DIR"),"~/.kimi",D,Q,ee),[...je,"config.json","config.json.bak"])}case"secret.cli.opencode":{let je=rn(Gt(Q.env.get("XDG_DATA_HOME"),"~/.local/share",D,Q,ee),"opencode"),at=Lt(O).split("/").at(-1)??"",lt=Q.env.get("OPENCODE_DB")?.trim(),ct=lt&&lt!==":memory:"?[lt,`${lt}-wal`,`${lt}-shm`]:[];return Dt(O,je,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(at)&&Dt(O,je,[at])||ct.some((ut)=>ri(O,ut,D,Q,ee))}case"secret.cli.opencode.config":{let je=Q.env.get("OPENCODE_CONFIG_DIR")?Gt(Q.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",D,Q,ee):rn(Gt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"opencode"),at=Q.env.get("ProgramData")?[rn(Gt(Q.env.get("ProgramData"),"",D,Q,ee),"opencode")]:[],lt=["opencode.json","opencode.jsonc"],ct=Q.env.get("OPENCODE_CONFIG");return lt.includes(Lt(O).split("/").at(-1)??"")||Dt(O,je,lt)||(ct?.trim()?ri(O,ct,D,Q,ee):!1)||["/Library/Application Support/opencode","/etc/opencode",...at].some((ut)=>Dt(O,Fn(ut,D,Q,ee),lt))}case"secret.cli.pi":return Dt(O,Gt(Q.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",D,Q,ee),["auth.json"]);case"secret.cli.pi.config":return Dt(O,Gt(Q.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",D,Q,ee),["models.json"]);case"secret.cli.amp":{let je=Fn("~",D,Q,ee);return[rn(Gt(Q.env.get("XDG_DATA_HOME"),"~/.local/share",D,Q,ee),"amp"),rn(je,".local","share","amp")].some((lt)=>Dt(O,lt,["secrets.json"]))||ni(O,rn(je,".amp"),["oauth"])}case"secret.cli.amp.config":{let je=["settings.json","settings.jsonc"],at=[rn(Gt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"amp"),rn(Fn("~",D,Q,ee),".config","amp")],lt=Lt(O).split("/"),ct=Q.env.get("AMP_SETTINGS_FILE");return at.some((ut)=>Dt(O,ut,je))||lt.at(-2)===".amp"&&je.includes(lt.at(-1)??"")||(ct?.trim()?ri(O,ct,D,Q,ee):!1)}case"secret.cli.cursor":{let je=rn(Gt(Q.env.get("XDG_CONFIG_HOME"),"~/.config",D,Q,ee),"cursor"),at=rn(Gt(Q.env.get("CURSOR_DATA_DIR"),"~/.cursor",D,Q,ee),"projects");return Dt(O,Fn("~/.cursor",D,Q,ee),["auth.json"])||Dt(O,je,["auth.json"])||Lt(O).split("/").at(-1)==="mcp-auth.json"&&Mr(Lt(O),Lt(at))}case"secret.cli.cursor.config":{let je=Lt(O).split("/");return je.at(-1)==="mcp.json"&&je.at(-2)===".cursor"}case"secret.cli.grok-build":return Dt(O,Gt(Q.env.get("GROK_HOME"),"~/.grok",D,Q,ee),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let je=Lt(O).split("/");return je.at(-1)==="config.toml"&&je.at(-2)===".grok"||Dt(O,Gt(Q.env.get("GROK_HOME"),"~/.grok",D,Q,ee),["config.toml","managed_config.toml","requirements.toml"])||Dt(O,Fn("/etc/grok",D,Q,ee),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Vp=new WeakMap;function Gt(O,D,B,Q,ee){let he=Vp.get(ee)??new Map;Vp.set(ee,he);let je=`${B}\x00${O??""}\x00${D}`,at=he.get(je);if(at!==void 0)return at;let lt=Fn(O?.trim()?O:D,B,Q,ee);return he.set(je,lt),lt}function Dt(O,D,B){return B.some((Q)=>sg(O,rn(D,Q)))}function ni(O,D,B){return B.some((Q)=>Mr(Lt(O),Lt(rn(D,Q))))}function ri(O,D,B,Q,ee){return sg(O,Fn(D,B,Q,ee))}function sg(O,D){return Lt(O)===Lt(D)}function rn(O,...D){return Nn([O,...D].filter(Boolean).join("/"))}function gP(O,D,B,Q,ee,he){if(B.length===0)return!1;let je=Lt(oi(O,D,ee,he));return B.some((at)=>Mr(je,Lt(oi(at,Q,ee,he))))}function hP(O,D,B,Q,ee,he){if(B.length===0)return!1;let je=Lt(oi(O,D,ee,he));if(!je)return!1;let at=ee.env.get("HOME")??ee.home,lt=at?Nn(Wt(pn(at),ee.paths,he)):"",ct=Lt(lt),ut=ee.env.get("CC_SAFETY_NET_HOME"),ft=Lt(ut?Nn(Wt(Bs(pn(ut)),ee.paths,he)):lt&&Nn(Wt(`${lt}/.cc-safety-net`,ee.paths,he)));if(ft&&Mr(je,ft))return!1;return B.some((dt)=>{let mt=Ia(dt);if(mt&&qp.basename(je)!==Lt(mt.name))return!1;let pt=Lt(oi(mt?.root??dt,Q,ee,he));if(!pt)return!1;if(ct&&(ct===pt||ct.startsWith(pt.endsWith("/")?pt:`${pt}/`)))return!1;return Mr(je,pt)&&!(mt&&je===pt)})}function yP(O){let D=O.split("/");return D.some((B)=>dP.has(B))||fP.some(([B,Q])=>D.some((ee,he)=>ee===B&&D[he+1]===Q))}function bP(O,D){let B=O.lastIndexOf("."),Q=B>0&&B<O.length-1?O.slice(B+1):"";if(Q==="")return null;for(let ee of wa)if(Q===ee.extension&&Xn(ee.id,D))return ee.id;for(let ee of Pa)if(ee.pattern.test(Q)&&Xn(ee.id,D))return ee.id;return null}function Lt(O){return O.toLowerCase()}function Xn(O,D){return!D?.disabledRules?.includes(O)}function Fn(O,D,B,Q){let{home:ee,normalized:he}=xc(O,B,Q);if(!he)return"";if(!ee)return he;let je=Rc(he,ee),at=Fs(je)?je:Nn(Bs(D,je)),lt=Nn(Wt(at,B.paths,Q));if(!Mr(lt,ee)){if(Fs(je))return lt;return lt===at?he:lt}let ct=lt.slice(ee.length);return ct?`~${ct}`:"~"}function Kp(O,D){return O===D||O.startsWith(`${D}/`)}function SP(O,D,B,Q){let{home:ee,normalized:he}=xc(O,B,Q);if(!he||!ee)return"";let je=Rc(he,ee),at=qp.normalize(Fs(je)?je:Nn(Bs(D,je))),lt=Nn(pn(B.env.get("HOME")??B.home)),ct=(dt)=>process.platform==="win32"?dt.toLowerCase():dt,ut=[ee,lt].find((dt)=>dt!==""&&Mr(ct(at),ct(dt)));if(ut===void 0)return"";let ft=at.slice(ut.length);return ft?`~${ft}`:"~"}function oi(O,D,B,Q){let{home:ee,normalized:he}=xc(O,B,Q);if(!he)return"";let je=ee?Rc(he,ee):he;return Nn(Wt(Fs(je)?je:Bs(D,je),B.paths,Q))}function xc(O,D,B){let Q=D.env.get("HOME")??D.home,ee=Q?Nn(Wt(pn(Q),D.paths,B)):"",he=Nn(pn(CP(Vn(O,D))));return{home:ee,normalized:he}}function CP(O){if(!O.trim().toLowerCase().startsWith("file:"))return O;try{return K_(O)}catch{return O}}function Rc(O,D){if(O==="~")return D;if(O.startsWith("~/"))return rn(D,O.slice(2));return O}function vP(O){if(process.platform==="win32")return!0;return V_.parse(O).root.length>1}function Nn(O){let D=O.trim(),B=(D.includes("\\")&&vP(D)?D.replace(/\\/g,"/"):D).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(B==="/")return B;return B.replace(/\/+$/g,"")}function Mr(O,D){return O===D||O.startsWith(D.endsWith("/")?D:`${D}/`)}function Ln(O){return O.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??O}class p extends Error{stage;evaluation;name="GuardEvaluationError";constructor(O,D,B){super(`CC Safety Net ${O} dependency failed`,{cause:B});this.stage=O;this.evaluation=D}}var EP={findPolicyMutation:Np,findGitMetadataMutation:hf,resolveGitMetadata:xP,loadPolicySnapshot:E,findSensitiveTarget:Qp,analyzeCommand:Ap,getModes:R};function W(O,D){let B={...EP,...D.dependencies},Q=wP(O),ee=ii(O)?O.command:Q,he=ur("policy-protection",ee,()=>Fo(O)),je=un(he,"input-candidate"),at=un(he,"declared-command");if(ii(O)&&O.command?.trim()&&at?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Wn,intent:"stop_and_explain",evidence:{command:O.command,segment:O.command}}};if(je?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Nf,intent:"stop_and_explain"}};let lt=mn(),ct=ur("policy-protection",ee,()=>B.resolveGitMetadata([O.context.executionCwd,O.context.configCwd],D.environment)),ut=ur("policy-protection",ee,()=>B.findPolicyMutation(he,D.environment,lt));if(ut){let Et=ee??ut.target;return{stage:"policy-protection",decision:{kind:"deny",reason:$e,intent:"hard_stop",evidence:{command:Et,segment:ut.target}}}}let ft=ur("policy-protection",ee,()=>kp(he,D.environment,lt));if(ft){let Et=ee??ft.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Me,intent:"hard_stop",evidence:{command:Et,segment:ft.target}}}}let dt=ur("policy-protection",ee,()=>B.findGitMetadataMutation(he,ct,D.environment,lt));if(dt){let Et=ee??dt.target;return{stage:"policy-protection",decision:{kind:"deny",reason:x,intent:"hard_stop",evidence:{command:Et,segment:dt.target}}}}let mt=ur("config-load",ee,()=>B.loadPolicySnapshot(D.environment,{...D.policyOptions,cwd:O.context.configCwd})),pt=mt.policy,gt=B.getModes(pt,D.environment.env),ht={level:gt.effectiveLevel,...RP(mt)},yt=pt.secretProtection.enabled===!1?null:ur("secret-protection",ee,()=>B.findSensitiveTarget(he,pt.secretProtection,D.environment,lt,{strict:ii(O)||je?.program.dialect==="powershell"?gt.strict:void 0}));if(yt){let Et=ee??yt.target;return{stage:"secret-protection",...ht,decision:{kind:"deny",reason:Yp,intent:"hard_stop",ruleId:yt.ruleId,evidence:{command:Et,segment:yt.target}}}}if(!ii(O))return{stage:"non-command",...ht,decision:{kind:"allow"}};if(!O.command||O.command.trim()==="")return{..._c("command-validation",ee),...ht};let Ct=ur("command-analysis",ee,()=>Tp(()=>B.analyzeCommand(O.command,{cwd:O.context.executionCwd,shell:O.route.shell,policySnapshot:mt,environment:D.environment,protectedGitMetadata:ct,effectiveCapabilities:gt.capabilities,strict:gt.strict,paranoidRm:gt.paranoidRm,paranoidInterpreters:gt.paranoidInterpreters,worktreeMode:gt.worktreeMode,budget:lt,...D.trace?{trace:D.trace}:{}},_P(he),he.store),O.command,D.trace));if(Ct.decision){let Et=!gt.strict&&Ct.decision.kind==="deny"&&(Ct.decision.ruleId==="raw-text.dangerous-command"||Ct.decision.reason===Uo&&!/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/.test(Ct.decision.evidence?.segment??"")&&xn(O.command)===null);return{stage:"command-analysis",...ht,..."errorCode"in Ct?{errorCode:Ct.errorCode}:{},decision:Et?{...Ct.decision,ask:!0}:Ct.decision}}return{stage:"command-analysis",...ht,decision:{kind:"allow"}}}function xP(O,D){let B=[...new Set(O.filter((Q)=>typeof Q==="string"&&Q!==""))].flatMap((Q)=>D.gitMetadata(Q)??[]);if(B.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(B.flatMap((Q)=>Q.entries))]),markerFiles:Object.freeze([...new Set(B.flatMap((Q)=>Q.markerFiles))]),directories:Object.freeze([...new Set(B.flatMap((Q)=>Q.directories))]),hooksDirectories:Object.freeze([...new Set(B.flatMap((Q)=>Q.hooksDirectories))])})}function RP(O){if(O.state==="ready")return{};return{configFallback:{reason:O.reason}}}function _P(O){return un(O,"declared-command")?.program}function wP(O){try{return ne(O.input)}catch(D){let B=ii(O)?O.command:void 0;throw new p("policy-protection",_c("policy-protection",D instanceof f?void 0:B,D),D)}}function ur(O,D,B){try{return B()}catch(Q){throw new p(O,_c(O,Q instanceof f?void 0:D,Q),Q)}}function _c(O,D,B){let Q=B instanceof s||B instanceof y;return{stage:O,decision:{kind:"deny",reason:Q?Ks:te,intent:"stop_and_explain",...D?{evidence:{command:D,segment:D}}:{}}}}function ii(O){return O.route.kind==="command"}
 export{te,a,s,z,ke,Ue,k,Ze,Ge,ye,P,be,Xe,c,o,He,xe,R,L,ve,Qe,f,V,ne,ce,et,We,d,Re,r,v,i,re,n,g,le,N,tt,nt,l,ue,de,rt,A,q,oe,S,ot,F,b,Se,M,u,K,Be,ze,I,w,T,pe,fe,Le,it,m,e,Te,we,Ve,qe,ie,Ce,se,_e,J,j,Pe,me,U,Ke,G,Y,Z,ae,Je,Ye,C,H,Ae,Ie,Oe,De,E,Ne,Ee,Fe,h,t,X,ge,y,x,_,st,Me,$e,p,W};